Overview

overview

8

Static

static

323878df53...e4.exe

windows7-x64

8

323878df53...e4.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2022 17:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    323878df53824cf86708f257e4668c890ef438ffe53604de61d411807f44ffe4.exe

  • Size

    883KB

  • MD5

    7987922b75849f9b2b0b17cf302cfbf2

  • SHA1

    22ce6807db61cba9a4e3c71a0e2dd10eb1013600

  • SHA256

    323878df53824cf86708f257e4668c890ef438ffe53604de61d411807f44ffe4

  • SHA512

    b5ca4f74c95bfdd640b9ba83ca1c5f16120fe9fb6d38f9ea73fd321b7511ed8389b02ae0610222c34643e93c7c4b72a2d5fc17fceadc449530256c80c65c4e88

  • SSDEEP

    12288:hjQrFfzQ5bwd4GeziwB+8YpuMQSr4e7lvGjDG59Dh3LA4bwXPQqP5tmgYENiOv:hjl5bwd4X9guMjrLZhDh3KXYO5tmDu

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 28 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\323878df53824cf86708f257e4668c890ef438ffe53604de61d411807f44ffe4.exe
    "C:\Users\Admin\AppData\Local\Temp\323878df53824cf86708f257e4668c890ef438ffe53604de61d411807f44ffe4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4548
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 964
        3⤵
        • Program crash
        PID:2732
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1056
        3⤵
        • Program crash
        PID:2920
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1244
        3⤵
        • Program crash
        PID:4312
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1300
        3⤵
        • Program crash
        PID:4084
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1360
        3⤵
        • Program crash
        PID:5056
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1368
        3⤵
        • Program crash
        PID:3204
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1384
        3⤵
        • Program crash
        PID:4556
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1384
        3⤵
        • Program crash
        PID:4984
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1444
        3⤵
        • Program crash
        PID:4248
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1844
        3⤵
        • Program crash
        PID:1060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1412
        3⤵
        • Program crash
        PID:2136
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4548 -ip 4548
    1⤵
      PID:3208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4548 -ip 4548
      1⤵
        PID:3300
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4548 -ip 4548
        1⤵
          PID:1216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4548 -ip 4548
          1⤵
            PID:3256
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4548 -ip 4548
            1⤵
              PID:1732
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4548 -ip 4548
              1⤵
                PID:4692
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4548 -ip 4548
                1⤵
                  PID:5080
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4548 -ip 4548
                  1⤵
                    PID:2388
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4548 -ip 4548
                    1⤵
                      PID:376
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2232
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:864
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:3220
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2536
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:2868
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:1512
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2480
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:4012
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:3640
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3560
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:3224
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3756
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4504
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:752
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4548 -ip 4548
                      1⤵
                        PID:4924
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4548 -ip 4548
                        1⤵
                          PID:2388

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\defender.exe
                          Filesize

                          843KB

                          MD5

                          d28ad3e494e22192f95bac39762e9776

                          SHA1

                          dcd61b8783ada347fa532859fdbaf112751a9c15

                          SHA256

                          7c33939e87dd7f1f5c89d7a71e552ff127a959b5218a38c5e69ca77d015b1cd9

                          SHA512

                          037baff9cc36874232bab3fda4fc5c7e4c442e17656a1a5f17043d4c953b13f287a0d7c4900d44a8f72ddba77b411c46f5cc657ab1118651206f52ae38ac245c

                          Download Submit

                        • C:\ProgramData\defender.exe
                          Filesize

                          843KB

                          MD5

                          d28ad3e494e22192f95bac39762e9776

                          SHA1

                          dcd61b8783ada347fa532859fdbaf112751a9c15

                          SHA256

                          7c33939e87dd7f1f5c89d7a71e552ff127a959b5218a38c5e69ca77d015b1cd9

                          SHA512

                          037baff9cc36874232bab3fda4fc5c7e4c442e17656a1a5f17043d4c953b13f287a0d7c4900d44a8f72ddba77b411c46f5cc657ab1118651206f52ae38ac245c

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                          Filesize

                          1KB

                          MD5

                          38b14d3af3941ac4596da066b4a1ea69

                          SHA1

                          a62910dab6708d51e01a68c0cd62adb5c2c26392

                          SHA256

                          fd66e9308f5657f80e8317cd0a48028cbde50bcaec858ba00e1bb80a4c69e2da

                          SHA512

                          4b17e6a214e53572150291aa57ddf64181d11a7a9474c13e070173ff99ae1bfeff914b48e4bdf53959f36b24ff756fa563a4abeca254ac324a5655837af95fe2

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                          Filesize

                          434B

                          MD5

                          64fae6819d6ecfae82b62d90ac336211

                          SHA1

                          503c04ee45481c897eeb809eecce155d2499b545

                          SHA256

                          7284926a8230a4b8ebda0077612f78acc340876cec5b44fc4bfd01663e5847c3

                          SHA512

                          ca5ef0836a94e56b7edad009c0304fd90399f43486a16d28e119a8e0a665dae75434c9a7aa733aebaf1fab8454b81fcd6fc34c53c5d248aa6796943d5cede5a7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                          Filesize

                          1016B

                          MD5

                          0e4048ae343932ec4deecd5c28d41120

                          SHA1

                          d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                          SHA256

                          d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                          SHA512

                          bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                          Filesize

                          1016B

                          MD5

                          0e4048ae343932ec4deecd5c28d41120

                          SHA1

                          d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                          SHA256

                          d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                          SHA512

                          bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                          Filesize

                          1016B

                          MD5

                          0e4048ae343932ec4deecd5c28d41120

                          SHA1

                          d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                          SHA256

                          d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                          SHA512

                          bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                          Filesize

                          1016B

                          MD5

                          0e4048ae343932ec4deecd5c28d41120

                          SHA1

                          d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                          SHA256

                          d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                          SHA512

                          bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                          Filesize

                          1016B

                          MD5

                          0e4048ae343932ec4deecd5c28d41120

                          SHA1

                          d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                          SHA256

                          d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                          SHA512

                          bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                          Download Submit

                        • C:\Users\Public\Desktop\Security Protection.lnk
                          Filesize

                          681B

                          MD5

                          4bf0c6601b34a9e306687933bdb82763

                          SHA1

                          2deaba5160c0a44e9c3075d6b905c5463e76c679

                          SHA256

                          da586a3c8fd8507418fd8675b050d62acd5b7e5eee59fe9a02248d5468de70e2

                          SHA512

                          cb0cd0640339f3e674390264f806d7797e396189df17632e6d3e7eedaee81874557dacc8db7fcdc1c1d57db1313950e74dbd5ad5857f199eab7347eba2141ef6

                          Download Submit

                        • memory/4548-141-0x0000000000400000-0x0000000000AE4000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/4548-140-0x0000000000400000-0x0000000000AE4000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/4548-139-0x0000000002DE0000-0x0000000002DE8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/4548-137-0x0000000000400000-0x0000000000AE4000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/4964-132-0x0000000000400000-0x00000000005C3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4964-133-0x0000000002500000-0x0000000002508000-memory.dmp

                          Filesize

                          32KB

                          Download