91f4b7ae747bfd036882e084650f608782b6054ecc8ab32f5fe91b91caf80e5d

Resubmissions

12-08-2021 21:22

210812-n6l9952p1a 10

12-08-2021 20:38

210812-sm95c1t59j 10

Analysis

max time kernel
1140s
max time network
1604s
platform
windows11_x64
resource
win11
submitted
12-08-2021 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bot_Checker.exe
Size

56KB
MD5

391ca27e1e5cc0da88d1fcc8df1d0d85
SHA1

25bd7c5b7d88bcd01610226fccb0910b48dc1eee
SHA256

a9ee4862c1e7931ef8366b090ac1f3212e79cc17d7737f537978d9a3fb0c5ef1
SHA512

2dbb84eb664798766a669c7d407be76d5154bd7d0b99f2c2371ad0ae3e1124605df0771b228f7a3406f023fa9cbba3022afb5b48207cf1eb14d94cda7a5117f9

Score

10^/10

bootkit persistence

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 692 created 4284 692 WerFault.exe Bot_Checker.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

File opened (read-only) \??\D: svchost.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

svchost.exe

description ioc process

File opened for modification \??\PhysicalDrive0 svchost.exe

description	pid	process	target process
PID 692 created 4284	692	WerFault.exe	Bot_Checker.exe

description	ioc	process
File opened (read-only)	\??\D:	svchost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in Windows directory 4 IoCs

Processes:

svchost.exeWerFault.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.override	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst	svchost.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 4284 WerFault.exe Bot_Checker.exe

pid	pid_target	process	target process
1184	4284	WerFault.exe	Bot_Checker.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeMoUsoCoreWorker.exeMoUsoCoreWorker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MoUsoCoreWorker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MoUsoCoreWorker.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MoUsoCoreWorker.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 48 IoCs

Processes:

sihclient.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WerFault.exe

pid process

1184 WerFault.exe
1184 WerFault.exe

pid	process
1184	WerFault.exe
1184	WerFault.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

svchost.exeWerFault.exeMoUsoCoreWorker.exeMoUsoCoreWorker.exe

description	pid	process
Token: SeSystemEnvironmentPrivilege	4944	svchost.exe
Token: SeRestorePrivilege	1184	WerFault.exe
Token: SeBackupPrivilege	1184	WerFault.exe
Token: SeBackupPrivilege	1184	WerFault.exe
Token: SeShutdownPrivilege	4852	MoUsoCoreWorker.exe
Token: SeCreatePagefilePrivilege	4852	MoUsoCoreWorker.exe
Token: SeShutdownPrivilege	4852	MoUsoCoreWorker.exe
Token: SeCreatePagefilePrivilege	4852	MoUsoCoreWorker.exe
Token: SeShutdownPrivilege	4852	MoUsoCoreWorker.exe
Token: SeCreatePagefilePrivilege	4852	MoUsoCoreWorker.exe
Token: SeShutdownPrivilege	368	MoUsoCoreWorker.exe
Token: SeCreatePagefilePrivilege	368	MoUsoCoreWorker.exe
Token: SeShutdownPrivilege	368	MoUsoCoreWorker.exe
Token: SeCreatePagefilePrivilege	368	MoUsoCoreWorker.exe
Token: SeShutdownPrivilege	368	MoUsoCoreWorker.exe
Token: SeCreatePagefilePrivilege	368	MoUsoCoreWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Bot_Checker.exeWerFault.exesvchost.exesvchost.exe

description	pid	process	target process
PID 4608 wrote to memory of 4284	4608	Bot_Checker.exe	Bot_Checker.exe
PID 4608 wrote to memory of 4284	4608	Bot_Checker.exe	Bot_Checker.exe
PID 4608 wrote to memory of 4284	4608	Bot_Checker.exe	Bot_Checker.exe
PID 692 wrote to memory of 4284	692	WerFault.exe	Bot_Checker.exe
PID 692 wrote to memory of 4284	692	WerFault.exe	Bot_Checker.exe
PID 576 wrote to memory of 3528	576	svchost.exe	pcaui.exe
PID 576 wrote to memory of 3528	576	svchost.exe	pcaui.exe
PID 1080 wrote to memory of 2276	1080	svchost.exe	mpcmdrun.exe
PID 1080 wrote to memory of 2276	1080	svchost.exe	mpcmdrun.exe

C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe" -a
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 592
    3⤵
    - Drops file in Windows directory
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1184

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv AQ4ciwWch0+5spMnjZvMow.0.2
1⤵
- Modifies data under HKEY_USERS
PID:5060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\wlrmdr.exe
-c -s 0 -f 0 -t Empty -m Empty -a 0 -u Empty
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4284 -ip 4284
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\System32\pcaui.exe
  C:\Windows\System32\pcaui.exe -n 0 -a "" -v "" -g "" -x ""
  2⤵
  PID:3528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:2540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files\Windows Defender\mpcmdrun.exe
  "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
  2⤵
  PID:2276

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\USOPrivate\UpdateStore\store.db

MD5
af696e2fcb908c0d9c62ac53a969f282

SHA1
035340e30b98d87f835a9dbfb09a0239459bdb49

SHA256
9685003be2c818812629f7143b68b4023f7a72bc7f99d40bbb8dc35ef227b0cc

SHA512
2171e83c20181feb4c3401f3dcdfbbd2cda7d89d660ec791dac794dde3e5d7d11cfb40a34f7bc2aead101fd77f95b6321ed6af5566f5816f0894cb16a7c26b00

Download Submit
memory/2276-151-0x0000000000000000-mapping.dmp

Download
memory/3528-150-0x0000000000000000-mapping.dmp

Download
memory/3692-148-0x0000017DEEC10000-0x0000017DEEC20000-memory.dmp

Filesize
64KB

Download
memory/3692-147-0x0000017DEEB90000-0x0000017DEEBA0000-memory.dmp

Filesize
64KB

Download
memory/3692-152-0x0000017DF1500000-0x0000017DF1504000-memory.dmp

Filesize
16KB

Download
memory/3692-153-0x0000017DF14C0000-0x0000017DF14C1000-memory.dmp

Filesize
4KB

Download
memory/3692-154-0x0000017DF1240000-0x0000017DF1244000-memory.dmp

Filesize
16KB

Download
memory/3692-155-0x0000017DF1230000-0x0000017DF1231000-memory.dmp

Filesize
4KB

Download
memory/3692-156-0x0000017DF1230000-0x0000017DF1234000-memory.dmp

Filesize
16KB

Download
memory/3692-157-0x0000017DEEF10000-0x0000017DEEF11000-memory.dmp

Filesize
4KB

Download
memory/4284-146-0x0000000000000000-mapping.dmp

Download