Overview

overview

8

Static

static

e7e175f13e...de.exe

windows7-x64

8

e7e175f13e...de.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 12:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e7e175f13efb06b883eadbcf64763d17f82447363ec1806be9bbf751dae200de.exe

  • Size

    860KB

  • MD5

    d446cc682dc1aaf3811524d796e9c10c

  • SHA1

    6e75979cd990273413d1e20fe45a3e1d73422b77

  • SHA256

    e7e175f13efb06b883eadbcf64763d17f82447363ec1806be9bbf751dae200de

  • SHA512

    ff8db73394fb966f403423ee52fa0155430effe8544ad376799fb812d7cc55805c7beb7ba85b6e74c3ae3116592376f1abe6465a6b6730f7cb926523817160e4

  • SSDEEP

    24576:7Tvtt6UDKwny3EAV1xnDwdfJj50jscibFo1:H1vy0qTohj5pN

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7e175f13efb06b883eadbcf64763d17f82447363ec1806be9bbf751dae200de.exe
    "C:\Users\Admin\AppData\Local\Temp\e7e175f13efb06b883eadbcf64763d17f82447363ec1806be9bbf751dae200de.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\ProgramData\iwdefender.exe
      C:\ProgramData\iwdefender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 688
        3⤵
        • Program crash
        PID:2368
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 892
        3⤵
        • Program crash
        PID:1928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1164
        3⤵
        • Program crash
        PID:4684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1196
        3⤵
        • Program crash
        PID:2156
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1296
        3⤵
        • Program crash
        PID:4704
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1312
        3⤵
        • Program crash
        PID:4768
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1304
        3⤵
        • Program crash
        PID:1664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1304
        3⤵
        • Program crash
        PID:3180
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1332
        3⤵
        • Program crash
        PID:1908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3052 -ip 3052
    1⤵
      PID:4180
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3052 -ip 3052
      1⤵
        PID:1760
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3052 -ip 3052
        1⤵
          PID:392
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3052 -ip 3052
          1⤵
            PID:4960
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3052 -ip 3052
            1⤵
              PID:4248
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3052 -ip 3052
              1⤵
                PID:1620
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3052 -ip 3052
                1⤵
                  PID:2776
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3052 -ip 3052
                  1⤵
                    PID:3064
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3052 -ip 3052
                    1⤵
                      PID:1072
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4508
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:224
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:1276
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4756
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:324

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\iwdefender.exe
                      Filesize

                      827KB

                      MD5

                      abd57435cadec1d2a1457de28e2a824d

                      SHA1

                      dfbf66fdb7adc4bc32cd3e32eb6a686d263d2793

                      SHA256

                      55c9c59928ecd307250f16642ae1e2abab9b71d9b04d2867b99135d7753b7eb3

                      SHA512

                      2459d411c142a017233c68c873ccc5d320a074b7c7398aa00e9a1ba2ecda5ca0b35bda3411fde8eaf0424a9aa01aa0e38c8784626e807601c7447106f180d322

                      Download Submit

                    • C:\ProgramData\iwdefender.exe
                      Filesize

                      827KB

                      MD5

                      abd57435cadec1d2a1457de28e2a824d

                      SHA1

                      dfbf66fdb7adc4bc32cd3e32eb6a686d263d2793

                      SHA256

                      55c9c59928ecd307250f16642ae1e2abab9b71d9b04d2867b99135d7753b7eb3

                      SHA512

                      2459d411c142a017233c68c873ccc5d320a074b7c7398aa00e9a1ba2ecda5ca0b35bda3411fde8eaf0424a9aa01aa0e38c8784626e807601c7447106f180d322

                      Download Submit

                    • C:\Users\Public\Desktop\Internet Security PRO.lnk
                      Filesize

                      695B

                      MD5

                      438b43744afb68e84a7c7e3cbb78c68c

                      SHA1

                      ad3242db8774da241aefe99bd6e31363d5bff240

                      SHA256

                      caddefc75e3a88e006fc584c148c6825b11c7b19b29225f97ae6b96dbc1677ab

                      SHA512

                      e3f1e68902f41111149c23b33b56bf1863f1351d4e015bbdd7f824a066aa389cf608b95bacbfe5296eb74b1e024755fe8c9589b4ef79156f000f5ed5683c9006

                      Download Submit

                    • memory/1276-141-0x0000000000000000-mapping.dmp

                      Download

                    • memory/2720-132-0x0000000000400000-0x00000000004E3000-memory.dmp

                      Filesize

                      908KB

                      Download

                    • memory/2720-133-0x0000000000400000-0x00000000004E3000-memory.dmp

                      Filesize

                      908KB

                      Download

                    • memory/3052-134-0x0000000000000000-mapping.dmp

                      Download

                    • memory/3052-137-0x0000000000400000-0x0000000000A19000-memory.dmp

                      Filesize

                      6.1MB

                      Download

                    • memory/3052-139-0x0000000000400000-0x0000000000A19000-memory.dmp

                      Filesize

                      6.1MB

                      Download

                    • memory/3052-140-0x0000000000400000-0x0000000000A19000-memory.dmp

                      Filesize

                      6.1MB

                      Download