Analysis

  • max time kernel
    140s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 01:03

General

  • Target

    7e176f521d268cf22a4c913c17cdfab671becdaab92d5c1cbef3c3b71ca09775.exe

  • Size

    820KB

  • MD5

    6d2bcf3fcb7692d8cd3c3324ba3f02e0

  • SHA1

    b4454f1d358b9d1a6069474ab0fd1c81c19fb230

  • SHA256

    7e176f521d268cf22a4c913c17cdfab671becdaab92d5c1cbef3c3b71ca09775

  • SHA512

    759465d6b21e11e61e6368774e09f2adeff8919ee4cfd78b65e76beee8b1c8a533be9434b63aebef70956ee4dd48908ef4d8904b3aa5601a2ff239cafa501a9e

  • SSDEEP

    24576:7LSC526Cl0FWfLYsDWo0JBQd9ZkuDl96zt3:26ldsiVM9qu6z5

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 13 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e176f521d268cf22a4c913c17cdfab671becdaab92d5c1cbef3c3b71ca09775.exe
    "C:\Users\Admin\AppData\Local\Temp\7e176f521d268cf22a4c913c17cdfab671becdaab92d5c1cbef3c3b71ca09775.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4704
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 744
      2⤵
      • Program crash
      PID:1192
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 784
      2⤵
      • Program crash
      PID:4532
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1232
      2⤵
      • Program crash
      PID:3984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1240
      2⤵
      • Program crash
      PID:404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1292
      2⤵
      • Program crash
      PID:3656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1384
      2⤵
      • Program crash
      PID:2868
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1392
      2⤵
      • Program crash
      PID:4176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1392
      2⤵
      • Program crash
      PID:3376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1444
      2⤵
      • Program crash
      PID:2904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1792
      2⤵
      • Program crash
      PID:4052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1836
      2⤵
      • Program crash
      PID:4076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1380
      2⤵
      • Program crash
      PID:1232
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4704 -ip 4704
    1⤵
      PID:808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4704 -ip 4704
      1⤵
        PID:2856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4704 -ip 4704
        1⤵
          PID:640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4704 -ip 4704
          1⤵
            PID:2932
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4704 -ip 4704
            1⤵
              PID:2212
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4704 -ip 4704
              1⤵
                PID:4652
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4704 -ip 4704
                1⤵
                  PID:3676
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4704 -ip 4704
                  1⤵
                    PID:2600
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4704 -ip 4704
                    1⤵
                      PID:3584
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:4844
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4144
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:2864
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:960
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:2556
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:3196
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:3724
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:4656
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 500 -p 2704 -ip 2704
                      1⤵
                        PID:876
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 2704 -s 1288
                        1⤵
                        • Program crash
                        PID:3580
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4704 -ip 4704
                        1⤵
                          PID:1600
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4704 -ip 4704
                          1⤵
                            PID:4792
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4704 -ip 4704
                            1⤵
                              PID:4268

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Persistence

                            Registry Run Keys / Startup Folder

                            1
                            T1060

                            Bootkit

                            1
                            T1067

                            Defense Evasion

                            Modify Registry

                            1
                            T1112

                            Discovery

                            Query Registry

                            3
                            T1012

                            Peripheral Device Discovery

                            1
                            T1120

                            System Information Discovery

                            4
                            T1082

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • memory/4704-132-0x0000000000400000-0x0000000000A0B000-memory.dmp
                              Filesize

                              6.0MB

                            • memory/4704-133-0x0000000000400000-0x0000000000A0B000-memory.dmp
                              Filesize

                              6.0MB

                            • memory/4704-135-0x0000000000400000-0x0000000000A0B000-memory.dmp
                              Filesize

                              6.0MB

                            • memory/4704-136-0x0000000000400000-0x0000000000A0B000-memory.dmp
                              Filesize

                              6.0MB

                            • memory/4704-137-0x0000000000400000-0x0000000000A0B000-memory.dmp
                              Filesize

                              6.0MB