Analysis

  • max time kernel
    145s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 14:28

General

  • Target

    0531bcd90fb2426b5eb306eec924285703ea1f2d80786df2d03ee67f8c6cce5b.exe

  • Size

    1.7MB

  • MD5

    7dc329c08eb80f602e8fb5f1e577eb8f

  • SHA1

    76af05bec9bf9c33df9af39c765ab6decd99cd28

  • SHA256

    0531bcd90fb2426b5eb306eec924285703ea1f2d80786df2d03ee67f8c6cce5b

  • SHA512

    1463059b333ec159a96b2afb43eee0e65df6a4e7b217ffdcc72bcd3d62e89a5d86de52a0a4f1f7c7ad7626b8d82c4ec225ad75d70a91d85925ec187aa58e525d

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0531bcd90fb2426b5eb306eec924285703ea1f2d80786df2d03ee67f8c6cce5b.exe
    "C:\Users\Admin\AppData\Local\Temp\0531bcd90fb2426b5eb306eec924285703ea1f2d80786df2d03ee67f8c6cce5b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\MyDiskPro\wbjExMzM1.exe
      "C:\Users\Admin\AppData\Local\Temp\MyDiskPro\wbjExMzM1.exe" TEw9aHR0cDovL21maWxlLnNpdGUvZC8qTk49ZnJpZGF5LXRoZS0xM3RoLXRoZS1nYW1lLnRvcnJlbnQqRkY9MTQzMjIqQVBJPSpTSVpFPTE2NjQ5Kk1VPWh0dHA6Ly9tZGlzLmZ1bi9sLypTVT1NeURpc2sucHJvKg==
      2⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1980

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Discovery

Query Registry

7
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MyDiskPro\wbjExMzM1.exe
    Filesize

    1.4MB

    MD5

    9a0541ea8737a6eb833b4d7f2a6ed633

    SHA1

    d7cf0332a3a4ee116b070061f4cc76141734a422

    SHA256

    a3176f27d1eb90ed92360db780cc33ef09040cf29b74fd974966948255ad83da

    SHA512

    461d7b48b187e8a0be8465d1592d9d3c6bb0b08b146eefa188082bbdb511d88c07cc013df45eee9bee1e1fbfe1d1d953401fe398269367be7a5296c530eac01a

  • \Users\Admin\AppData\Local\Temp\MyDiskPro\wbjExMzM1.exe
    Filesize

    1.4MB

    MD5

    9a0541ea8737a6eb833b4d7f2a6ed633

    SHA1

    d7cf0332a3a4ee116b070061f4cc76141734a422

    SHA256

    a3176f27d1eb90ed92360db780cc33ef09040cf29b74fd974966948255ad83da

    SHA512

    461d7b48b187e8a0be8465d1592d9d3c6bb0b08b146eefa188082bbdb511d88c07cc013df45eee9bee1e1fbfe1d1d953401fe398269367be7a5296c530eac01a

  • memory/624-54-0x00000000769D1000-0x00000000769D3000-memory.dmp
    Filesize

    8KB

  • memory/624-58-0x0000000000400000-0x0000000000684000-memory.dmp
    Filesize

    2.5MB

  • memory/624-60-0x0000000000230000-0x0000000000233000-memory.dmp
    Filesize

    12KB

  • memory/1980-56-0x0000000000000000-mapping.dmp
  • memory/1980-62-0x00000000001C0000-0x00000000001C3000-memory.dmp
    Filesize

    12KB

  • memory/1980-61-0x0000000000400000-0x000000000092C000-memory.dmp
    Filesize

    5.2MB