91f4b7ae747bfd036882e084650f608782b6054ecc8ab32f5fe91b91caf80e5d

General

Target

Bot_Checker.exe
Size

56KB
MD5

391ca27e1e5cc0da88d1fcc8df1d0d85
SHA1

25bd7c5b7d88bcd01610226fccb0910b48dc1eee
SHA256

a9ee4862c1e7931ef8366b090ac1f3212e79cc17d7737f537978d9a3fb0c5ef1
SHA512

2dbb84eb664798766a669c7d407be76d5154bd7d0b99f2c2371ad0ae3e1124605df0771b228f7a3406f023fa9cbba3022afb5b48207cf1eb14d94cda7a5117f9

Score

10^/10

bootkit persistence

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4580 created 4828 4580 WerFault.exe Bot_Checker.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

File opened (read-only) \??\D: svchost.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

svchost.exe

description ioc process

File opened for modification \??\PhysicalDrive0 svchost.exe

description	pid	process	target process
PID 4580 created 4828	4580	WerFault.exe	Bot_Checker.exe

description	ioc	process
File opened (read-only)	\??\D:	svchost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.override	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4664 4828 WerFault.exe Bot_Checker.exe

pid	pid_target	process	target process
4664	4828	WerFault.exe	Bot_Checker.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

svchost.exesvchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WerFault.exe

pid process

4664 WerFault.exe
4664 WerFault.exe

pid	process
4664	WerFault.exe
4664	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

svchost.exeWerFault.exe

description	pid	process
Token: SeSystemEnvironmentPrivilege	4136	svchost.exe
Token: SeRestorePrivilege	4664	WerFault.exe
Token: SeBackupPrivilege	4664	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Bot_Checker.exeWerFault.exesvchost.exesvchost.exe

description	pid	process	target process
PID 3852 wrote to memory of 4828	3852	Bot_Checker.exe	Bot_Checker.exe
PID 3852 wrote to memory of 4828	3852	Bot_Checker.exe	Bot_Checker.exe
PID 3852 wrote to memory of 4828	3852	Bot_Checker.exe	Bot_Checker.exe
PID 4580 wrote to memory of 4828	4580	WerFault.exe	Bot_Checker.exe
PID 4580 wrote to memory of 4828	4580	WerFault.exe	Bot_Checker.exe
PID 772 wrote to memory of 1360	772	svchost.exe	pcaui.exe
PID 772 wrote to memory of 1360	772	svchost.exe	pcaui.exe
PID 1848 wrote to memory of 1664	1848	svchost.exe	mpcmdrun.exe
PID 1848 wrote to memory of 1664	1848	svchost.exe	mpcmdrun.exe

C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe" -a
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 640
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4828 -ip 4828
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\System32\pcaui.exe
  C:\Windows\System32\pcaui.exe -n 0 -a "" -v "" -g "" -x ""
  2⤵
  PID:1360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:1492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files\Windows Defender\mpcmdrun.exe
  "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
  2⤵
  PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-150-0x0000000000000000-mapping.dmp

Download
memory/1664-151-0x0000000000000000-mapping.dmp

Download
memory/3540-147-0x00000258EA490000-0x00000258EA4A0000-memory.dmp

Filesize
64KB

Download
memory/3540-148-0x00000258EA510000-0x00000258EA520000-memory.dmp

Filesize
64KB

Download
memory/3540-149-0x00000258ECB10000-0x00000258ECB14000-memory.dmp

Filesize
16KB

Download
memory/3540-152-0x00000258ECE00000-0x00000258ECE04000-memory.dmp

Filesize
16KB

Download
memory/3540-153-0x00000258ECDC0000-0x00000258ECDC1000-memory.dmp

Filesize
4KB

Download
memory/3540-154-0x00000258ECB40000-0x00000258ECB44000-memory.dmp

Filesize
16KB

Download
memory/3540-155-0x00000258ECB30000-0x00000258ECB31000-memory.dmp

Filesize
4KB

Download
memory/3540-156-0x00000258ECB30000-0x00000258ECB34000-memory.dmp

Filesize
16KB

Download
memory/3540-157-0x00000258ECA10000-0x00000258ECA11000-memory.dmp

Filesize
4KB

Download
memory/4828-146-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads