Analysis

  • max time kernel
    109s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2022 17:20

General

  • Target

    ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630.exe

  • Size

    863KB

  • MD5

    2aefe26eba53a75ca3b663545549f020

  • SHA1

    9be4c98aaaf9669138a98fbd1008c82d35dbefb9

  • SHA256

    ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630

  • SHA512

    e6c82853bf943325ba49e767058750c5e5164ea38623d917f2fa46853df3425df3dc2dd96fb225349b87203855491361f5611c533f316117244900cd3fa85bd1

  • SSDEEP

    12288:ti7TnKAB6uTsseXay+oD02kJvIqYXQ/byNZj6CGtp4juSl0I1whVIMHclz0/3Cgb:4xo2eKIFUIlXQ/sZ+alN1qd8B0/31

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630.exe
    "C:\Users\Admin\AppData\Local\Temp\ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\ProgramData\indefender.exe
      C:\ProgramData\indefender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 884
        3⤵
        • Program crash
        PID:4636
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 884
        3⤵
        • Program crash
        PID:4952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1208
        3⤵
        • Program crash
        PID:4732
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1252
        3⤵
        • Program crash
        PID:1484
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1344
        3⤵
        • Program crash
        PID:3364
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1252
        3⤵
        • Program crash
        PID:400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1368
        3⤵
        • Program crash
        PID:1300
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1368
        3⤵
        • Program crash
        PID:1424
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1428
        3⤵
        • Program crash
        PID:4504
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1772
        3⤵
        • Program crash
        PID:1444
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 456 -ip 456
    1⤵
      PID:4668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 456 -ip 456
      1⤵
        PID:3420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 456 -ip 456
        1⤵
          PID:1152
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 456 -ip 456
          1⤵
            PID:2084
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 456 -ip 456
            1⤵
              PID:1016
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 456 -ip 456
              1⤵
                PID:2448
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 456 -ip 456
                1⤵
                  PID:208
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 456 -ip 456
                  1⤵
                    PID:2504
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 456 -ip 456
                    1⤵
                      PID:3372
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:4884
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:3380
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:896
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:4992
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:4248
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:3224
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:2172
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:1432
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 456 -ip 456
                      1⤵
                        PID:4364
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 544 -p 2720 -ip 2720
                        1⤵
                          PID:4336
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 2720 -s 6244
                          1⤵
                          • Program crash
                          PID:4144

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\indefender.exe

                          Filesize

                          836KB

                          MD5

                          06da0c5c19a0b3f33321abec211b642a

                          SHA1

                          1d3bfecbd67d35a47b4f56d264bd481ff8f7f3e9

                          SHA256

                          b93712a07bf740e87d869772097d673b122d648df6cc123855206df39c3662f1

                          SHA512

                          dd55dd124ae483f3bf64fc4eca5d13f17330c5d4002188613ea4c6db4327c9d779cc4f1259ff048494d4f53d0030dd7cfdcd268f515b9addd6b5c8e1e5fa8071

                        • C:\ProgramData\indefender.exe

                          Filesize

                          836KB

                          MD5

                          06da0c5c19a0b3f33321abec211b642a

                          SHA1

                          1d3bfecbd67d35a47b4f56d264bd481ff8f7f3e9

                          SHA256

                          b93712a07bf740e87d869772097d673b122d648df6cc123855206df39c3662f1

                          SHA512

                          dd55dd124ae483f3bf64fc4eca5d13f17330c5d4002188613ea4c6db4327c9d779cc4f1259ff048494d4f53d0030dd7cfdcd268f515b9addd6b5c8e1e5fa8071

                        • memory/456-134-0x0000000000000000-mapping.dmp

                        • memory/456-138-0x0000000000400000-0x0000000000A1C000-memory.dmp

                          Filesize

                          6.1MB

                        • memory/456-140-0x0000000000400000-0x0000000000A1C000-memory.dmp

                          Filesize

                          6.1MB

                        • memory/456-141-0x0000000000400000-0x0000000000A1C000-memory.dmp

                          Filesize

                          6.1MB

                        • memory/3312-133-0x0000000000400000-0x00000000004EF000-memory.dmp

                          Filesize

                          956KB

                        • memory/3312-137-0x0000000000400000-0x00000000004EF000-memory.dmp

                          Filesize

                          956KB