2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1

General

Target

2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe
Size

846KB
MD5

7cfdc65f4feb349feb8e0024604e1313
SHA1

0acf2ee8a5cfe9d6f1dec5a0aed15bee45746527
SHA256

2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1
SHA512

34fa60c4625424658798c056a6a748d33f911895ef1fb4a743e0b9441afb27bb320e2cf38a0d9dac434b9d0eff0fccec5deebf38f1457593a6d708b7fe4ff90d
SSDEEP

24576:yws5IlKswgKNn0bVPi8zPsPy2Hhc+2w2fMQdxN:ydIF+0bM8z0JHu9b/

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

isecurity.exe

pid process

760 isecurity.exe

Loads dropped DLL 3 IoCs

Processes:

2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe

pid	process
620	2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe
620	2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe
620	2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

isecurity.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	isecurity.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\isecurity.exe"	isecurity.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

isecurity.exe

description	ioc	process
File opened (read-only)	\??\H:	isecurity.exe
File opened (read-only)	\??\J:	isecurity.exe
File opened (read-only)	\??\O:	isecurity.exe
File opened (read-only)	\??\T:	isecurity.exe
File opened (read-only)	\??\Y:	isecurity.exe
File opened (read-only)	\??\K:	isecurity.exe
File opened (read-only)	\??\L:	isecurity.exe
File opened (read-only)	\??\M:	isecurity.exe
File opened (read-only)	\??\R:	isecurity.exe
File opened (read-only)	\??\S:	isecurity.exe
File opened (read-only)	\??\V:	isecurity.exe
File opened (read-only)	\??\E:	isecurity.exe
File opened (read-only)	\??\G:	isecurity.exe
File opened (read-only)	\??\N:	isecurity.exe
File opened (read-only)	\??\U:	isecurity.exe
File opened (read-only)	\??\W:	isecurity.exe
File opened (read-only)	\??\F:	isecurity.exe
File opened (read-only)	\??\I:	isecurity.exe
File opened (read-only)	\??\P:	isecurity.exe
File opened (read-only)	\??\Q:	isecurity.exe
File opened (read-only)	\??\X:	isecurity.exe
File opened (read-only)	\??\Z:	isecurity.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

isecurity.exe

description ioc process

File opened for modification \??\PhysicalDrive0 isecurity.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	isecurity.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exeisecurity.exe

pid	process
620	2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe

pid process

620 2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

isecurity.exe

pid	process
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

isecurity.exe

pid	process
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe
760	isecurity.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

isecurity.exe

pid process

760 isecurity.exe
760 isecurity.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe

description	pid	process	target process
PID 620 wrote to memory of 760	620	2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe	isecurity.exe
PID 620 wrote to memory of 760	620	2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe	isecurity.exe
PID 620 wrote to memory of 760	620	2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe	isecurity.exe
PID 620 wrote to memory of 760	620	2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe	isecurity.exe

C:\Users\Admin\AppData\Local\Temp\2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe
"C:\Users\Admin\AppData\Local\Temp\2992f676851f6952a2d320102af62a190efb24a9a9946c1f777f69f389e5afe1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:620
- C:\ProgramData\isecurity.exe
  C:\ProgramData\isecurity.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\isecurity.exe

Filesize
838KB

MD5
995dbe80bc53454c1c4f07a6e08e7e10

SHA1
d28ccc826e54225efb69882c59787a3e6bbd32d0

SHA256
aaa766a6a3f9fd691f5e90fb7170e2e4db6eb44dc951d2a3650b21733e4457bb

SHA512
cd49bcc3944bbbfbb3b4a8b80736be7eca6363bafe7f1f6ff475f0d15b1603eef6bbbce9852eab118096909c491a4e617b1a309e9f4997ac2403dc03066064c2

Download Submit
\ProgramData\isecurity.exe

Filesize
838KB

MD5
995dbe80bc53454c1c4f07a6e08e7e10

SHA1
d28ccc826e54225efb69882c59787a3e6bbd32d0

SHA256
aaa766a6a3f9fd691f5e90fb7170e2e4db6eb44dc951d2a3650b21733e4457bb

SHA512
cd49bcc3944bbbfbb3b4a8b80736be7eca6363bafe7f1f6ff475f0d15b1603eef6bbbce9852eab118096909c491a4e617b1a309e9f4997ac2403dc03066064c2

Download Submit
\ProgramData\isecurity.exe

Filesize
838KB

MD5
995dbe80bc53454c1c4f07a6e08e7e10

SHA1
d28ccc826e54225efb69882c59787a3e6bbd32d0

SHA256
aaa766a6a3f9fd691f5e90fb7170e2e4db6eb44dc951d2a3650b21733e4457bb

SHA512
cd49bcc3944bbbfbb3b4a8b80736be7eca6363bafe7f1f6ff475f0d15b1603eef6bbbce9852eab118096909c491a4e617b1a309e9f4997ac2403dc03066064c2

Download Submit
\ProgramData\isecurity.exe

Filesize
838KB

MD5
995dbe80bc53454c1c4f07a6e08e7e10

SHA1
d28ccc826e54225efb69882c59787a3e6bbd32d0

SHA256
aaa766a6a3f9fd691f5e90fb7170e2e4db6eb44dc951d2a3650b21733e4457bb

SHA512
cd49bcc3944bbbfbb3b4a8b80736be7eca6363bafe7f1f6ff475f0d15b1603eef6bbbce9852eab118096909c491a4e617b1a309e9f4997ac2403dc03066064c2

Download Submit
memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/620-55-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/760-59-0x0000000000000000-mapping.dmp

Download
memory/760-62-0x0000000000400000-0x0000000000A3F000-memory.dmp

Filesize
6.2MB

Download
memory/760-64-0x0000000000400000-0x0000000000A3F000-memory.dmp

Filesize
6.2MB

Download
memory/760-65-0x0000000000400000-0x0000000000A3F000-memory.dmp

Filesize
6.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads