e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

General

Target

Trojan-Ransom.Win32.Blocker.exe
Size

701KB
MD5

7628aac51cee728c82b96729b1d23f6e
SHA1

55a96bde06bfe7ee0c038cc04547a991b4a0c693
SHA256

e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4
SHA512

fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46
SSDEEP

6144:3PNDXW8jOD/gSwgQM6/lkw3RRHxNjfOB8xOE5SLv/:NW77gSw7WwBq

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	Trojan-Ransom.Win32.Blocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Trojan-Ransom.Win32.Blocker.exe

Executes dropped EXE 2 IoCs

pid	Process
976	svchosts.exe
1432	svchosts.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1788-58-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1788-60-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1788-61-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1788-65-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1788-66-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1788-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1788-75-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1432-90-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1788	Trojan-Ransom.Win32.Blocker.exe
1788	Trojan-Ransom.Win32.Blocker.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Trojan-Ransom.Win32.Blocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	Trojan-Ransom.Win32.Blocker.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Trojan-Ransom.Win32.Blocker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	Trojan-Ransom.Win32.Blocker.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Trojan-Ransom.Win32.Blocker.exe
File opened for modification	\??\PhysicalDrive0	svchosts.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 976 set thread context of 1432	976	svchosts.exe	30

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
536	Trojan-Ransom.Win32.Blocker.exe
976	svchosts.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 536 wrote to memory of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 536 wrote to memory of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 536 wrote to memory of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 536 wrote to memory of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 536 wrote to memory of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 536 wrote to memory of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 536 wrote to memory of 1788	536	Trojan-Ransom.Win32.Blocker.exe	28
PID 1788 wrote to memory of 976	1788	Trojan-Ransom.Win32.Blocker.exe	29
PID 1788 wrote to memory of 976	1788	Trojan-Ransom.Win32.Blocker.exe	29
PID 1788 wrote to memory of 976	1788	Trojan-Ransom.Win32.Blocker.exe	29
PID 1788 wrote to memory of 976	1788	Trojan-Ransom.Win32.Blocker.exe	29
PID 976 wrote to memory of 1432	976	svchosts.exe	30
PID 976 wrote to memory of 1432	976	svchosts.exe	30
PID 976 wrote to memory of 1432	976	svchosts.exe	30
PID 976 wrote to memory of 1432	976	svchosts.exe	30
PID 976 wrote to memory of 1432	976	svchosts.exe	30
PID 976 wrote to memory of 1432	976	svchosts.exe	30
PID 976 wrote to memory of 1432	976	svchosts.exe	30
PID 976 wrote to memory of 1432	976	svchosts.exe	30

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
  2⤵
  - Adds policy Run key to start application
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Users\Admin\AppData\Roaming\svchosts.exe
    /NEWSHIT
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Users\Admin\AppData\Roaming\svchosts.exe
      /NEWSHIT
      4⤵
      Executes dropped EXE
      PID:1432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
701KB

MD5
7628aac51cee728c82b96729b1d23f6e

SHA1
55a96bde06bfe7ee0c038cc04547a991b4a0c693

SHA256
e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

SHA512
fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46

Download Submit
C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
701KB

MD5
7628aac51cee728c82b96729b1d23f6e

SHA1
55a96bde06bfe7ee0c038cc04547a991b4a0c693

SHA256
e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

SHA512
fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46

Download Submit
C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
701KB

MD5
7628aac51cee728c82b96729b1d23f6e

SHA1
55a96bde06bfe7ee0c038cc04547a991b4a0c693

SHA256
e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

SHA512
fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46

Download Submit
\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
701KB

MD5
7628aac51cee728c82b96729b1d23f6e

SHA1
55a96bde06bfe7ee0c038cc04547a991b4a0c693

SHA256
e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

SHA512
fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46

Download Submit
\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
701KB

MD5
7628aac51cee728c82b96729b1d23f6e

SHA1
55a96bde06bfe7ee0c038cc04547a991b4a0c693

SHA256
e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

SHA512
fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46

Download Submit
memory/536-67-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/536-56-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/976-89-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/976-76-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1432-90-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-66-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-65-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-75-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-64-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1788-61-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-60-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-58-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads