630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f

General

Target

630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe
Size

866KB
MD5

8987d327ea5a5163b2587f4211f9a650
SHA1

a0a196021a4fe9c8d42f00834dcddcf5ffd20e21
SHA256

630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f
SHA512

3c654e22c78981ef3fba2b0b9638e96abcef459c0a5a90044d7051b91cf6d959e6a562c5beef19fa7dc05687a517db1324610dc19eab9679ad05e0ac34253587
SSDEEP

24576:v1UNALy7E3T7rpK56hITme5rtqwjgqN8Rf67TA:v1gA+E3Ie9e5rtFcRf67TA

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1748	isecurity.exe

Loads dropped DLL 3 IoCs

pid	Process
1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe
1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe
1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	isecurity.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\isecurity.exe"	isecurity.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	isecurity.exe
File opened (read-only)	\??\E:	isecurity.exe
File opened (read-only)	\??\J:	isecurity.exe
File opened (read-only)	\??\K:	isecurity.exe
File opened (read-only)	\??\L:	isecurity.exe
File opened (read-only)	\??\M:	isecurity.exe
File opened (read-only)	\??\O:	isecurity.exe
File opened (read-only)	\??\R:	isecurity.exe
File opened (read-only)	\??\P:	isecurity.exe
File opened (read-only)	\??\T:	isecurity.exe
File opened (read-only)	\??\Z:	isecurity.exe
File opened (read-only)	\??\F:	isecurity.exe
File opened (read-only)	\??\H:	isecurity.exe
File opened (read-only)	\??\Q:	isecurity.exe
File opened (read-only)	\??\Y:	isecurity.exe
File opened (read-only)	\??\G:	isecurity.exe
File opened (read-only)	\??\I:	isecurity.exe
File opened (read-only)	\??\N:	isecurity.exe
File opened (read-only)	\??\U:	isecurity.exe
File opened (read-only)	\??\V:	isecurity.exe
File opened (read-only)	\??\W:	isecurity.exe
File opened (read-only)	\??\X:	isecurity.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	isecurity.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe
1748	isecurity.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1748	isecurity.exe
1748	isecurity.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1748	1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe	27
PID 1620 wrote to memory of 1748	1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe	27
PID 1620 wrote to memory of 1748	1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe	27
PID 1620 wrote to memory of 1748	1620	630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe	27

C:\Users\Admin\AppData\Local\Temp\630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe
"C:\Users\Admin\AppData\Local\Temp\630bd236472a5602d91cf44815d6479215c17cb08f8c04830e81268e11a1aa8f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1620
- C:\ProgramData\isecurity.exe
  C:\ProgramData\isecurity.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\isecurity.exe

Filesize
851KB

MD5
492c9fcbead68774be714323dfd0bf20

SHA1
9e801c95c7a713e71b2cf0a0d8e5db1e06e03f4a

SHA256
567473d6f594646715987a98e1cced80173d2f3a45408cae381f64168b872b23

SHA512
a840086093d00a923b594abd03d6f28f73594b5024f0ddd91554b02a9a25f28cb1ddc8655dd0313c12d63c6cac838a733f467206030e739fd6294b6ad82fd545

Download Submit
\ProgramData\isecurity.exe

Filesize
851KB

MD5
492c9fcbead68774be714323dfd0bf20

SHA1
9e801c95c7a713e71b2cf0a0d8e5db1e06e03f4a

SHA256
567473d6f594646715987a98e1cced80173d2f3a45408cae381f64168b872b23

SHA512
a840086093d00a923b594abd03d6f28f73594b5024f0ddd91554b02a9a25f28cb1ddc8655dd0313c12d63c6cac838a733f467206030e739fd6294b6ad82fd545

Download Submit
\ProgramData\isecurity.exe

Filesize
851KB

MD5
492c9fcbead68774be714323dfd0bf20

SHA1
9e801c95c7a713e71b2cf0a0d8e5db1e06e03f4a

SHA256
567473d6f594646715987a98e1cced80173d2f3a45408cae381f64168b872b23

SHA512
a840086093d00a923b594abd03d6f28f73594b5024f0ddd91554b02a9a25f28cb1ddc8655dd0313c12d63c6cac838a733f467206030e739fd6294b6ad82fd545

Download Submit
\ProgramData\isecurity.exe

Filesize
851KB

MD5
492c9fcbead68774be714323dfd0bf20

SHA1
9e801c95c7a713e71b2cf0a0d8e5db1e06e03f4a

SHA256
567473d6f594646715987a98e1cced80173d2f3a45408cae381f64168b872b23

SHA512
a840086093d00a923b594abd03d6f28f73594b5024f0ddd91554b02a9a25f28cb1ddc8655dd0313c12d63c6cac838a733f467206030e739fd6294b6ad82fd545

Download Submit
memory/1620-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1620-55-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1748-62-0x0000000000400000-0x0000000000A36000-memory.dmp

Filesize
6.2MB

Download
memory/1748-64-0x0000000000400000-0x0000000000A36000-memory.dmp

Filesize
6.2MB

Download
memory/1748-65-0x0000000000400000-0x0000000000A36000-memory.dmp

Filesize
6.2MB

Download
memory/1748-66-0x0000000000400000-0x0000000000A36000-memory.dmp

Filesize
6.2MB

Download

Analysis

Sharing