Analysis

  • max time kernel
    56s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 04:55

General

  • Target

    03568cf423fd658b3799b3cd687e4d537f3788bec138352c252434ef8fc041bd.exe

  • Size

    3.6MB

  • MD5

    f7f54b4990122d9befde831905fd5955

  • SHA1

    81622ef7179128f8f5f59ba21df8efdf56f902d2

  • SHA256

    03568cf423fd658b3799b3cd687e4d537f3788bec138352c252434ef8fc041bd

  • SHA512

    67d80ea11116a34ed3d5dbe2a6bda0a6f6932b18db5fcf9d57a6db1b6342a5de5bffa0d0b8e40b04d84d8c11c56ae0706ceddd1d248368af1f796f3e70232d1a

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03568cf423fd658b3799b3cd687e4d537f3788bec138352c252434ef8fc041bd.exe
    "C:\Users\Admin\AppData\Local\Temp\03568cf423fd658b3799b3cd687e4d537f3788bec138352c252434ef8fc041bd.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Internet Explorer settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:240
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x474
    1⤵
      PID:1404

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Bootkit

    1
    T1067

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/240-54-0x00000000757C1000-0x00000000757C3000-memory.dmp
      Filesize

      8KB

    • memory/240-55-0x0000000000050000-0x00000000007D0000-memory.dmp
      Filesize

      7.5MB