64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370

General

Target

64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe
Size

841KB
MD5

06034bc1fb52273ac0e5227c62800240
SHA1

fafed6af6a1476e4470e8682a0da501273ada33c
SHA256

64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370
SHA512

cb6b28bb37d3c9eb2ce565c343ceae9c2ad4d038a45e45db300973fa689072f3734df257d8e97d16bd44802cb41480be665876c33d61f33fc5a6702dfe889ea8
SSDEEP

12288:FIh/Qztxs+YjZrottJYAZAXqZE+n7uCaxBkmz782xOqu0zoWRrsFlR8dzcEeBsUp:FuSKIJYQA6ZbnK0eDno58dzcEeup0V

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1252	bsprotection.exe

Loads dropped DLL 2 IoCs

pid	Process
1792	64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe
1792	64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	bsprotection.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\bsprotection.exe"	bsprotection.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	bsprotection.exe
File opened (read-only)	\??\N:	bsprotection.exe
File opened (read-only)	\??\O:	bsprotection.exe
File opened (read-only)	\??\T:	bsprotection.exe
File opened (read-only)	\??\V:	bsprotection.exe
File opened (read-only)	\??\W:	bsprotection.exe
File opened (read-only)	\??\Z:	bsprotection.exe
File opened (read-only)	\??\F:	bsprotection.exe
File opened (read-only)	\??\L:	bsprotection.exe
File opened (read-only)	\??\I:	bsprotection.exe
File opened (read-only)	\??\J:	bsprotection.exe
File opened (read-only)	\??\K:	bsprotection.exe
File opened (read-only)	\??\M:	bsprotection.exe
File opened (read-only)	\??\P:	bsprotection.exe
File opened (read-only)	\??\X:	bsprotection.exe
File opened (read-only)	\??\E:	bsprotection.exe
File opened (read-only)	\??\H:	bsprotection.exe
File opened (read-only)	\??\Y:	bsprotection.exe
File opened (read-only)	\??\S:	bsprotection.exe
File opened (read-only)	\??\U:	bsprotection.exe
File opened (read-only)	\??\G:	bsprotection.exe
File opened (read-only)	\??\R:	bsprotection.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bsprotection.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1792	64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1792	64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe
1252	bsprotection.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1252	bsprotection.exe
1252	bsprotection.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1252	1792	64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe	28
PID 1792 wrote to memory of 1252	1792	64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe	28
PID 1792 wrote to memory of 1252	1792	64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe	28
PID 1792 wrote to memory of 1252	1792	64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe	28

C:\Users\Admin\AppData\Local\Temp\64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe
"C:\Users\Admin\AppData\Local\Temp\64b5293cf312f20766b40e2c9e16e24d6e33308e00ae2964b0b135685f780370.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1792
- C:\ProgramData\bsprotection.exe
  C:\ProgramData\bsprotection.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\bsprotection.exe

Filesize
824KB

MD5
a6841c61c353c6110d15417fc72cbad7

SHA1
412513364d161fff36a3a26b3cab922533e59d2e

SHA256
936cd15c031f4b76375b6febcd35cc214fc9a6931e045a68848af293be86564f

SHA512
4e2100e2d99c56e9d3b6eacdbc8a50664d54a4aed1edf8cd285baaaebbfb1ab7f705cb6419cd50afe311ae2def92c04e9b7bd57c4b4d9952e7d7594db0ec3ba1

Download Submit
\ProgramData\bsprotection.exe

Filesize
824KB

MD5
a6841c61c353c6110d15417fc72cbad7

SHA1
412513364d161fff36a3a26b3cab922533e59d2e

SHA256
936cd15c031f4b76375b6febcd35cc214fc9a6931e045a68848af293be86564f

SHA512
4e2100e2d99c56e9d3b6eacdbc8a50664d54a4aed1edf8cd285baaaebbfb1ab7f705cb6419cd50afe311ae2def92c04e9b7bd57c4b4d9952e7d7594db0ec3ba1

Download Submit
\ProgramData\bsprotection.exe

Filesize
824KB

MD5
a6841c61c353c6110d15417fc72cbad7

SHA1
412513364d161fff36a3a26b3cab922533e59d2e

SHA256
936cd15c031f4b76375b6febcd35cc214fc9a6931e045a68848af293be86564f

SHA512
4e2100e2d99c56e9d3b6eacdbc8a50664d54a4aed1edf8cd285baaaebbfb1ab7f705cb6419cd50afe311ae2def92c04e9b7bd57c4b4d9952e7d7594db0ec3ba1

Download Submit
memory/1252-62-0x0000000000400000-0x0000000000A1B000-memory.dmp

Filesize
6.1MB

Download
memory/1252-64-0x0000000000400000-0x0000000000A1B000-memory.dmp

Filesize
6.1MB

Download
memory/1252-66-0x0000000000400000-0x0000000000A1B000-memory.dmp

Filesize
6.1MB

Download
memory/1792-54-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1792-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1792-56-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1792-65-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download

Analysis

Sharing