c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe
Size

499KB
MD5

584f828b2210d6e6ea59614180529c64
SHA1

7851d2ef0c4fdc78d8e85ca7753427be250b035c
SHA256

c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467
SHA512

a9e2fbebf1479912101809acd9abb6e809f7aae23dfc3df0443148855fc55ce1332c3d76f7893bcbbef9071f28e016f9353b58bb096b9f76a47daa4fc4c1608d
SSDEEP

12288:UJUzLBeJqq8N1BB+pCqbX3xDUsVlUMMz+e40/Wzz:UG3BePm1BB+pZnKsVlUMMz+eT+

Score

7^/10

bootkit persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1784	cmd.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe Media Player\assets\iebbbce.jse	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe
File created	C:\Program Files (x86)\DriveTheLife\Drivers\mifffgi.jse	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 41 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\NeverShowExt	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\NeverShowExt	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex\ContextMenuHandlers\	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\open\CLSID = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\open\command\ = "WScript.exe /B \"C:\\Program Files (x86)Intel\\Logs\\gczzzac.jse\" \"%1\""	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\open\command	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\open\command\ = "WScript.exe /B \"C:\\Program Files (x86)Intel\\Logs\\gczzzac.jse\" \"%1\""	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex\IconHandler\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\ = "open"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\open	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex\IconHandler	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex\IconHandler\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.solll	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.solll\ = "uqnnnoq"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\ = "????"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\IsShortcut	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\CLSID\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex\ContextMenuHandlers	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\CLSID	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.solll	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.solll\ = "uqnnnoq"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\open	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\open\CLSID = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex\IconHandler	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex\ContextMenuHandlers\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\open\command	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\ = "????"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\IsShortcut	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\CLSID\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shell\ = "open"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\shellex\ContextMenuHandlers	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uqnnnoq\CLSID	wscript.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe
896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1280	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	29
PID 896 wrote to memory of 1280	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	29
PID 896 wrote to memory of 1280	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	29
PID 896 wrote to memory of 1280	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	29
PID 896 wrote to memory of 1712	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	30
PID 896 wrote to memory of 1712	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	30
PID 896 wrote to memory of 1712	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	30
PID 896 wrote to memory of 1712	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	30
PID 896 wrote to memory of 676	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	32
PID 896 wrote to memory of 676	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	32
PID 896 wrote to memory of 676	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	32
PID 896 wrote to memory of 676	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	32
PID 896 wrote to memory of 1784	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	34
PID 896 wrote to memory of 1784	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	34
PID 896 wrote to memory of 1784	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	34
PID 896 wrote to memory of 1784	896	c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe	34

C:\Users\Admin\AppData\Local\Temp\c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe
"C:\Users\Admin\AppData\Local\Temp\c6fd892c18cf36eae2d8f8e033e85e61a30332084cd4f22cdab6f6604f0ca467.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe /B "C:\Program Files (x86)\DriveTheLife\Drivers\mifffgi.jse"
  2⤵
  - Modifies registry class
  PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$dss.bat
  2⤵
  PID:1712
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe /B "C:\Program Files (x86)Intel\Logs\gczzzac.jse" FirstSetup
  2⤵
  - Modifies registry class
  PID:676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat
  2⤵
  - Deletes itself
  PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)Intel\Logs\gczzzac.jse

Filesize
28KB

MD5
0e333bab9dc604f29cd1da6c34bacefa

SHA1
c78094283924e6dd7be6c0304eb74d2bfbd92e01

SHA256
b97bfd684f0fc41fa7f8bdddaa58497f93a1ac60327dc0b18e2c0353146047fe

SHA512
d18022aa87aaa7ad8669d102da828e9e92a3ff3a9a4825799234eb5cdaf13c7dab7863de484a39d21bc10c8b3d9b6b3c94f50472f3823cd79ec423aa029c453f

Download Submit
C:\Program Files (x86)\DriveTheLife\Drivers\mifffgi.jse

Filesize
1KB

MD5
1e4063e05d1eb1ecc08cf945df34d5ce

SHA1
6a78abb59b1b19d0493d8f2487b96688da78cdcf

SHA256
f9a887ddac026115c0dfe4fad564b7caac17c2c7d9237e3bb886cfebccdfd1c8

SHA512
b0f1bf871c692bc73985bf9c6d597b2eac2e7160252f7247b42d2f45544089db0d55df21d41d61eb10f14517a88c6dc59cd9a5fa51d13cc2b01de4da06485e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat

Filesize
309B

MD5
77cfac59fe843d4e7b8da3338fdbc0cd

SHA1
68bde3a7b17ed7f57ecc13c70d85ad47a1efe64a

SHA256
668b53e58f66992dd2ee65875442b20780182da918f14d669efade9dc9c56bb2

SHA512
35cb674247ec70835a4c6d8aab3010a4afc34001d6216b3ee0fa6b9ab120694237dfca90ba8e563ae6cf4e8f5bfd4123132326d1d41cf03b4a532506d2f743aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$dss.bat

Filesize
246B

MD5
b211c858d10413d5a58614b36a4c2c86

SHA1
5c374bd632cc5199c6e73bee53567a6e4f0787e1

SHA256
1ffc57fda104ab8bd80a025624bd558d1b69332f55cb20844c5122c7af0e3654

SHA512
a65ff4d4658fb409f2470cbeef5e128bf6ef439bef9c6dc3046afa19ff731ae349571f0dcf50dc20932f3508e43049a3a9455a9a4d6861b3a7fb1f312a5d3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaoBao.tmp

Filesize
143B

MD5
fdbe75eee63e579fc4d54d5e96ffdc05

SHA1
6e4e0665f4ef8f058f815d9457f55d1fd1b1681e

SHA256
4434bbb1a63da852a06a95cae272a9387e045f2327f1aa71b10e8e524761ff44

SHA512
2a478daeded3250d3dfa1ac0d8d3f6fe763bccd29d8b116e4b7db5e28f6c2ba6cf5d19e44db1e1c4a4f10df5aab87c1196c8140b5bcc34a997853f6b971a2f8b

Download Submit
memory/896-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download