284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c

General

Target

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
Size

912KB
MD5

fe53937c6e56a168967d32d99909d8d5
SHA1

a7e0cb24994667ab405c9721ab100083ec7ea063
SHA256

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c
SHA512

c858d922032766a723a2185ed2ecaf6d61c631b7efdb7e6ba1bb716cd2c1d05fd8f7736f943732c0ff7fabae178abca2443f8f5c0d60c9e9e1e16d858e9b0551
SSDEEP

12288:lOZMFIoIieG1IA/QbrT5Jmo6stpj58OE4O77JSWMwnOZMSSRHm+yWy0:EeI2eCIA6b7j58OCJBhOZMSSm+Xy

Score

9^/10

Malware Config

Signatures

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/3076-146-0x00000000003E0000-0x00000000003FB000-memory.dmp	MailPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3076-146-0x00000000003E0000-0x00000000003FB000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exetakshost.exetakshost.exe

description	pid	process	target process
PID 236 set thread context of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 3356 set thread context of 1332	3356	takshost.exe	takshost.exe
PID 1332 set thread context of 3076	1332	takshost.exe	takshost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exetakshost.exemsedge.exe

pid	process
236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
3356	takshost.exe
3356	takshost.exe
4932	msedge.exe
4932	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe

pid process

236 284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exetakshost.exetakshost.exe

description	pid	process
Token: SeDebugPrivilege	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
Token: SeDebugPrivilege	3356	takshost.exe
Token: SeDebugPrivilege	1332	takshost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exetakshost.exetakshost.exe284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exemsedge.exe

description	pid	process	target process
PID 236 wrote to memory of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 236 wrote to memory of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 236 wrote to memory of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 236 wrote to memory of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 236 wrote to memory of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 236 wrote to memory of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 236 wrote to memory of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 236 wrote to memory of 3004	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 236 wrote to memory of 3356	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	takshost.exe
PID 236 wrote to memory of 3356	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	takshost.exe
PID 236 wrote to memory of 3356	236	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	takshost.exe
PID 3356 wrote to memory of 1332	3356	takshost.exe	takshost.exe
PID 3356 wrote to memory of 1332	3356	takshost.exe	takshost.exe
PID 3356 wrote to memory of 1332	3356	takshost.exe	takshost.exe
PID 3356 wrote to memory of 1332	3356	takshost.exe	takshost.exe
PID 3356 wrote to memory of 1332	3356	takshost.exe	takshost.exe
PID 3356 wrote to memory of 1332	3356	takshost.exe	takshost.exe
PID 3356 wrote to memory of 1332	3356	takshost.exe	takshost.exe
PID 3356 wrote to memory of 1332	3356	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 1332 wrote to memory of 3076	1332	takshost.exe	takshost.exe
PID 3004 wrote to memory of 3992	3004	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	msedge.exe
PID 3004 wrote to memory of 3992	3004	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	msedge.exe
PID 3992 wrote to memory of 4180	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4180	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4264	3992	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
"C:\Users\Admin\AppData\Local\Temp\284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:236

C:\Users\Admin\AppData\Local\Temp\284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
"C:\Users\Admin\AppData\Local\Temp\284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
- Suspicious use of WriteProcessMemory
PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff91ff246f8,0x7ff91ff24708,0x7ff91ff24718
4⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11251161485748029977,8213266103424318694,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
4⤵
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11251161485748029977,8213266103424318694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11251161485748029977,8213266103424318694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 /prefetch:8
4⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xb8,0x104,0x7ff91ff246f8,0x7ff91ff24708,0x7ff91ff24718
4⤵
PID:1892

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe" /stext C:\ProgramData\Mails.txt
4⤵
PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6102471af38b45f30decc8db2f59a8e2

SHA1
35428c52f58b3a35d5028929b6298d6b95d6bdec

SHA256
57e3a5210c5872fc5d56b4111a4d07e512ef54a79128391084c167c101a9d7c4

SHA512
1040720fe63680c7a17ced8026e3a2e31e0e73066bd0c3d74e5cd4a19c0e6f23dc30e0a41f62d92c0b9cc9840895ece4b3d36a200816e400feec49e54599b3fe

Download Submit
\??\pipe\LOCAL\crashpad_3992_MZJKTZKPMRWDFMBZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/236-133-0x0000000074630000-0x0000000074BE1000-memory.dmp

Filesize
5.7MB

Download
memory/236-132-0x0000000074630000-0x0000000074BE1000-memory.dmp

Filesize
5.7MB

Download
memory/236-142-0x0000000074630000-0x0000000074BE1000-memory.dmp

Filesize
5.7MB

Download
memory/1332-141-0x0000000074630000-0x0000000074BE1000-memory.dmp

Filesize
5.7MB

Download
memory/1332-151-0x0000000074630000-0x0000000074BE1000-memory.dmp

Filesize
5.7MB

Download
memory/1332-139-0x0000000000000000-mapping.dmp

Download
memory/1332-140-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1348-157-0x0000000000000000-mapping.dmp

Download
memory/1892-159-0x0000000000000000-mapping.dmp

Download
memory/3004-135-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3004-134-0x0000000000000000-mapping.dmp

Download
memory/3076-144-0x0000000000000000-mapping.dmp

Download
memory/3076-146-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/3356-143-0x0000000074630000-0x0000000074BE1000-memory.dmp

Filesize
5.7MB

Download
memory/3356-138-0x0000000074630000-0x0000000074BE1000-memory.dmp

Filesize
5.7MB

Download
memory/3356-137-0x0000000074630000-0x0000000074BE1000-memory.dmp

Filesize
5.7MB

Download
memory/3356-136-0x0000000000000000-mapping.dmp

Download
memory/3992-149-0x0000000000000000-mapping.dmp

Download
memory/4180-150-0x0000000000000000-mapping.dmp

Download
memory/4264-153-0x0000000000000000-mapping.dmp

Download
memory/4444-158-0x0000000000000000-mapping.dmp

Download
memory/4932-154-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads