5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d

General

Target

5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe
Size

847KB
MD5

030a85605dcbad5ab2e76197a51773b0
SHA1

14412b08f4ed847c1c442e682e9990f1e9fa2398
SHA256

5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d
SHA512

55982fb73085432b1712a3fafd9f946b8bfebce23cad8a2745425f00576ae476fff0025a38d682fe9cf3f2ca3f129859717af62c895304e82b7a8694ac1e2f51
SSDEEP

12288:DcCyEQR8/FIZxdV841GoqE6bxl9a/OXvcd7ERtEUqvgdX59RW3lC3TE3NhBClkII:3yX3ZxdV39+oEckdqvcX53WEEX0KII

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
944	bsprotection.exe

Loads dropped DLL 2 IoCs

pid	Process
1132	5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe
1132	5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	bsprotection.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\bsprotection.exe"	bsprotection.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	bsprotection.exe
File opened (read-only)	\??\X:	bsprotection.exe
File opened (read-only)	\??\Y:	bsprotection.exe
File opened (read-only)	\??\E:	bsprotection.exe
File opened (read-only)	\??\K:	bsprotection.exe
File opened (read-only)	\??\M:	bsprotection.exe
File opened (read-only)	\??\N:	bsprotection.exe
File opened (read-only)	\??\R:	bsprotection.exe
File opened (read-only)	\??\Z:	bsprotection.exe
File opened (read-only)	\??\I:	bsprotection.exe
File opened (read-only)	\??\G:	bsprotection.exe
File opened (read-only)	\??\O:	bsprotection.exe
File opened (read-only)	\??\S:	bsprotection.exe
File opened (read-only)	\??\T:	bsprotection.exe
File opened (read-only)	\??\U:	bsprotection.exe
File opened (read-only)	\??\W:	bsprotection.exe
File opened (read-only)	\??\F:	bsprotection.exe
File opened (read-only)	\??\J:	bsprotection.exe
File opened (read-only)	\??\L:	bsprotection.exe
File opened (read-only)	\??\P:	bsprotection.exe
File opened (read-only)	\??\V:	bsprotection.exe
File opened (read-only)	\??\H:	bsprotection.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bsprotection.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1132	5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe
944	bsprotection.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
944	bsprotection.exe
944	bsprotection.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 944	1132	5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe	28
PID 1132 wrote to memory of 944	1132	5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe	28
PID 1132 wrote to memory of 944	1132	5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe	28
PID 1132 wrote to memory of 944	1132	5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe	28

C:\Users\Admin\AppData\Local\Temp\5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe
"C:\Users\Admin\AppData\Local\Temp\5bdaab99b9bc24a292a315cc2f70fcd8a5836f5d76748704887369e140657e7d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1132
- C:\ProgramData\bsprotection.exe
  C:\ProgramData\bsprotection.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\bsprotection.exe

Filesize
830KB

MD5
fd2099f35981e860093d4cd0083ed207

SHA1
44721929f82ba7152f1415ee3f8a48cdafea0dd3

SHA256
bb4cc1678a75d94996ed17612bbf01be52de797588259d66f37087dfc42a5acc

SHA512
0979d795d864306e8d772a3e4e5f122394cb7ca441cd14dbe8f9c9a5b30cbf641817d1339ecaa10cba54b3a5347883d42af061e61204fc3dbedd950465e54c17

Download Submit
\ProgramData\bsprotection.exe

Filesize
830KB

MD5
fd2099f35981e860093d4cd0083ed207

SHA1
44721929f82ba7152f1415ee3f8a48cdafea0dd3

SHA256
bb4cc1678a75d94996ed17612bbf01be52de797588259d66f37087dfc42a5acc

SHA512
0979d795d864306e8d772a3e4e5f122394cb7ca441cd14dbe8f9c9a5b30cbf641817d1339ecaa10cba54b3a5347883d42af061e61204fc3dbedd950465e54c17

Download Submit
\ProgramData\bsprotection.exe

Filesize
830KB

MD5
fd2099f35981e860093d4cd0083ed207

SHA1
44721929f82ba7152f1415ee3f8a48cdafea0dd3

SHA256
bb4cc1678a75d94996ed17612bbf01be52de797588259d66f37087dfc42a5acc

SHA512
0979d795d864306e8d772a3e4e5f122394cb7ca441cd14dbe8f9c9a5b30cbf641817d1339ecaa10cba54b3a5347883d42af061e61204fc3dbedd950465e54c17

Download Submit
memory/944-62-0x0000000000400000-0x0000000000A1C000-memory.dmp

Filesize
6.1MB

Download
memory/944-64-0x0000000000400000-0x0000000000A1C000-memory.dmp

Filesize
6.1MB

Download
memory/944-65-0x0000000000400000-0x0000000000A1C000-memory.dmp

Filesize
6.1MB

Download
memory/1132-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1132-55-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1132-56-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download

Analysis

Sharing