87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de

General

Target

87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
Size

3.0MB
MD5

80e2ffb0f159fb00e6c82e9fb2953c64
SHA1

b7bc942336fd880725a60216fe1e3b614e727a0f
SHA256

87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de
SHA512

c43a7bf5da76304bc5c99c90c60a475b665da042881ee7060e1ad82deda7620d749b14d28c22a007498e9fb0253a18e817f37f060248c3a4cee39ca9aeeb4c94
SSDEEP

98304:60sZRAjlhv4OP+tbL+02cOcp/+qhm9TGEgwN:QATRP+tbL+/Lcp/+qhA

Score

9^/10

bootkit discovery evasion persistence upx

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1364-59-0x0000000013140000-0x0000000013746000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\Z:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\H:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\M:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\U:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\V:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\P:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\R:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\S:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\Y:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\F:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\G:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\J:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\O:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\K:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\N:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\T:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\W:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\E:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\I:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\L:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
File opened (read-only)	\??\Q:	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	1364	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1356	1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe	26
PID 1364 wrote to memory of 1356	1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe	26
PID 1364 wrote to memory of 1356	1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe	26
PID 1364 wrote to memory of 1356	1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe	26
PID 1364 wrote to memory of 948	1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe	28
PID 1364 wrote to memory of 948	1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe	28
PID 1364 wrote to memory of 948	1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe	28
PID 1364 wrote to memory of 948	1364	87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe	28

C:\Users\Admin\AppData\Local\Temp\87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe
"C:\Users\Admin\AppData\Local\Temp\87f4a0d27f2a2783c0022340859944827e106b28e6e07ad414fc3b22ef82a2de.exe"
1⤵
- Enumerates VirtualBox registry keys
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\del.bat"
  2⤵
  PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 244
  2⤵
  - Program crash
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Software Discovery

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
183B

MD5
6c4405b7de4190cff477328d07ab6417

SHA1
e6e63ec222765056b64af966f62ae6318da1dab2

SHA256
7febfa396b44a0ef85abea9b51ac26a781062f6a0ee499a7318fcf95c3edc878

SHA512
c16f71fc84622df31fbd99a48148c354ec9748dd3ab8e0e230b7355228613dfb2196e0d5cd97c677f07793360b6c13ca04f0dcb05a04ac65b59f43a7ca7669f4

Download Submit
memory/1364-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-58-0x00000000004C0000-0x00000000004C9000-memory.dmp

Filesize
36KB

Download
memory/1364-59-0x0000000013140000-0x0000000013746000-memory.dmp

Filesize
6.0MB

Download
memory/1364-60-0x00000000004C0000-0x00000000004C9000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads