Resubmissions
24-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 1022-11-2020 06:42
201122-6x1at779dj 10Analysis
-
max time kernel
255s -
max time network
256s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-02-2021 11:43
General
-
Target
Endermanch@PCDefenderv2.msi
-
Size
860KB
-
MD5
b3dce5c3f95a18fd076fad0f73bb9e39
-
SHA1
e80cc285a77302ee221f47e4e94823d4b2eba368
-
SHA256
df2e3b2222dcdbb5e0dbdd1200ec8fd5f67fcbea99e0023df54307eab60030ff
-
SHA512
c184436055cf74884ad0d2bd5ca00bcd5a62d6be46253fe8c71b4daaa5c710b9df34af1b6e41f6d1af94bcdec0d33679a6a1b34bf9755678b4e177f368c11d4c
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 12 IoCs
-
Checks SCSI registry key(s) 3 TTPs 96 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 23 IoCs
-
Modifies registry class 80 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 83 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Endermanch@PCDefenderv2.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 35172627D05D2B123A6EEE05FDD5AA72 E Global\MSI00002⤵
- Modifies WinLogon for persistence
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "DEL /F /Q C:\Windows\Prefetch\pcdef*"3⤵
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe"C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe" "shutdown -r -t 0"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe"C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe" "shutdown -r -t 0" 14⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exeMD5
c05ccc260692e8bfb5b6ba7238dbb943
SHA14ad185a7acb1c4ffcb3c03daa77cc77a833ae7e6
SHA2560d58d2b03e3f6d5f32216e74badae8ad0d7f94cc4f207d06883ba953a1594cba
SHA5127707d1c3f9085a710527e2d1559c8268ca3a1fb70fca9f1cf391a02cd81002193c6971cefd7b00b371e14adf5ae7b83b63206b88ead13b04a20ad08c7154ac22
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exeMD5
c05ccc260692e8bfb5b6ba7238dbb943
SHA14ad185a7acb1c4ffcb3c03daa77cc77a833ae7e6
SHA2560d58d2b03e3f6d5f32216e74badae8ad0d7f94cc4f207d06883ba953a1594cba
SHA5127707d1c3f9085a710527e2d1559c8268ca3a1fb70fca9f1cf391a02cd81002193c6971cefd7b00b371e14adf5ae7b83b63206b88ead13b04a20ad08c7154ac22
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exeMD5
c05ccc260692e8bfb5b6ba7238dbb943
SHA14ad185a7acb1c4ffcb3c03daa77cc77a833ae7e6
SHA2560d58d2b03e3f6d5f32216e74badae8ad0d7f94cc4f207d06883ba953a1594cba
SHA5127707d1c3f9085a710527e2d1559c8268ca3a1fb70fca9f1cf391a02cd81002193c6971cefd7b00b371e14adf5ae7b83b63206b88ead13b04a20ad08c7154ac22
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2MD5
e8fba70fe2ec9d1c54eb3e0c387d29b9
SHA1854b744f70d21649a48c6c2072b579180d0e9598
SHA25672c15a0a4fcf3c60bd21ba9ae72c1db76ee67defb23437ffd153eff939bdb5d4
SHA5120915112f6724cc2b8af0a996079d692d8874ee4f18ca8c5955501b294fbd25bda184de828963e203e997648727d81604794c98ec048ef5ce91335eb0f804751e
-
\??\Volume{f994966a-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{cba68c1d-1bda-4170-855c-095fbedf0345}_OnDiskSnapshotPropMD5
aa70f8283c4c389bd7085f7eb803e965
SHA1a94b1b3b3920d03ec2ebaa5fa937290d1e356e92
SHA256b0a2cbb8917a9758b7f3ceb941b3e638a5526fd9bd6a34b9f420a0c9a7c10095
SHA512c64a68021cb1eff24bdb956320de0f38380ac3a7921099f031440d18cb317ea1a48b66f20b74df0cfd4d0739bc44af757e2da69ebc78766cf342d59fa62569bd
-
memory/184-3-0x0000000000000000-mapping.dmp
-
memory/192-4-0x0000000000000000-mapping.dmp
-
memory/216-5-0x0000000000000000-mapping.dmp
-
memory/2028-2-0x0000000000000000-mapping.dmp
-
memory/2092-12-0x000001C2978C0000-0x000001C2978C4000-memory.dmpFilesize
16KB
-
memory/4140-6-0x0000000000000000-mapping.dmp
-
memory/4196-7-0x0000000000000000-mapping.dmp
-
memory/4268-8-0x0000000000000000-mapping.dmp
-
memory/4320-10-0x0000000000000000-mapping.dmp
-
memory/4444-13-0x0000000000000000-mapping.dmp