e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

General

Target

Trojan-Ransom.Win32.Blocker.exe
Size

701KB
MD5

7628aac51cee728c82b96729b1d23f6e
SHA1

55a96bde06bfe7ee0c038cc04547a991b4a0c693
SHA256

e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4
SHA512

fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46
SSDEEP

6144:3PNDXW8jOD/gSwgQM6/lkw3RRHxNjfOB8xOE5SLv/:NW77gSw7WwBq

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Trojan-Ransom.Win32.Blocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	Trojan-Ransom.Win32.Blocker.exe

Executes dropped EXE 2 IoCs

pid	Process
1212	svchosts.exe
3124	svchosts.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4968-136-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4968-138-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4968-139-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4968-140-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4968-147-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3124-155-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Trojan-Ransom.Win32.Blocker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	Trojan-Ransom.Win32.Blocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Trojan-Ransom.Win32.Blocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	Trojan-Ransom.Win32.Blocker.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchosts.exe
File opened for modification	\??\PhysicalDrive0	Trojan-Ransom.Win32.Blocker.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2700 set thread context of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 1212 set thread context of 3124	1212	svchosts.exe	85

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2700	Trojan-Ransom.Win32.Blocker.exe
1212	svchosts.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 2700 wrote to memory of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 2700 wrote to memory of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 2700 wrote to memory of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 2700 wrote to memory of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 2700 wrote to memory of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 2700 wrote to memory of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 2700 wrote to memory of 4968	2700	Trojan-Ransom.Win32.Blocker.exe	81
PID 4968 wrote to memory of 1212	4968	Trojan-Ransom.Win32.Blocker.exe	82
PID 4968 wrote to memory of 1212	4968	Trojan-Ransom.Win32.Blocker.exe	82
PID 4968 wrote to memory of 1212	4968	Trojan-Ransom.Win32.Blocker.exe	82
PID 1212 wrote to memory of 3124	1212	svchosts.exe	85
PID 1212 wrote to memory of 3124	1212	svchosts.exe	85
PID 1212 wrote to memory of 3124	1212	svchosts.exe	85
PID 1212 wrote to memory of 3124	1212	svchosts.exe	85
PID 1212 wrote to memory of 3124	1212	svchosts.exe	85
PID 1212 wrote to memory of 3124	1212	svchosts.exe	85
PID 1212 wrote to memory of 3124	1212	svchosts.exe	85
PID 1212 wrote to memory of 3124	1212	svchosts.exe	85

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Users\Admin\AppData\Roaming\svchosts.exe
    /NEWSHIT
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Users\Admin\AppData\Roaming\svchosts.exe
      /NEWSHIT
      4⤵
      Executes dropped EXE
      PID:3124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
701KB

MD5
7628aac51cee728c82b96729b1d23f6e

SHA1
55a96bde06bfe7ee0c038cc04547a991b4a0c693

SHA256
e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

SHA512
fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46

Download Submit
C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
701KB

MD5
7628aac51cee728c82b96729b1d23f6e

SHA1
55a96bde06bfe7ee0c038cc04547a991b4a0c693

SHA256
e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

SHA512
fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46

Download Submit
C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
701KB

MD5
7628aac51cee728c82b96729b1d23f6e

SHA1
55a96bde06bfe7ee0c038cc04547a991b4a0c693

SHA256
e4887cb4cd0c7f18b466ab0f256d83fd698246335f8e4b9482226010972c98c4

SHA512
fec32c323c8ca3803de6d92330412d9efaa85408febb6ca9c5e47459738fe3207cb00356e074921a7e81cf6c71f31f8b3bd7572c4727847dd652bd3e7dee7c46

Download Submit
memory/1212-156-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1212-146-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2700-132-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2700-148-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/3124-155-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4968-140-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4968-147-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4968-139-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4968-138-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4968-136-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads