34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3

Analysis

max time kernel
206s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe
Size

3.6MB
MD5

d19e46d2845954c8b05d9287ff9f7b1f
SHA1

67d056c5f07c8c0a8d15b5c316724eb4f5fc7698
SHA256

34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3
SHA512

79815b0f8a839cb1b270adc810f35b5afea740ce3ef061196bf624b1dec6a561d3462d35df6b165132013c315a892e4b4c359fc2b5919fdea102c5992f72216f
SSDEEP

49152:/Q1AUw9V16ATZaqdwk0c05HGi+BRCTZaqdwk0c05HGi0f:sTwTUAYqdwkLcHH8CYqdwkLcHHe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1360	34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe
1360	34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe
1360	34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe
1360	34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2172	1360	34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe	80
PID 1360 wrote to memory of 2172	1360	34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe	80
PID 2172 wrote to memory of 1752	2172	msedge.exe	82
PID 2172 wrote to memory of 1752	2172	msedge.exe	82
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3484	2172	msedge.exe	83
PID 2172 wrote to memory of 3720	2172	msedge.exe	84
PID 2172 wrote to memory of 3720	2172	msedge.exe	84
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85
PID 2172 wrote to memory of 800	2172	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe
"C:\Users\Admin\AppData\Local\Temp\34278139325d1445cb24c3623c0a4089215e96aa2ebf277e2ceff578109d0bb3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.jiejiewg.com/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x44,0x104,0x7ff8ccfa46f8,0x7ff8ccfa4708,0x7ff8ccfa4718
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3839722736176400929,18177815827810835367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3839722736176400929,18177815827810835367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3839722736176400929,18177815827810835367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3839722736176400929,18177815827810835367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3839722736176400929,18177815827810835367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,3839722736176400929,18177815827810835367,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3839722736176400929,18177815827810835367,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3839722736176400929,18177815827810835367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6244 /prefetch:2
    3⤵
    PID:3432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads