Analysis

  • max time kernel
    151s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 20:18

General

  • Target

    a2b0531a61ba1928ee484d1e0883979667309903166aa830c1f6719425a92436.exe

  • Size

    847KB

  • MD5

    22e400a57bb3843a22b7fa495d1838b6

  • SHA1

    5f193630afa84d30e46ce64d20ab6aedb0cb4660

  • SHA256

    a2b0531a61ba1928ee484d1e0883979667309903166aa830c1f6719425a92436

  • SHA512

    0a00369fe514d6f5018e3aea1f73f3770dd78b67532fcc412883afb2e5febb4c820e5afed7f82497d9a4f63fb6a434061d290c8f0bff00283274309e48d1878b

  • SSDEEP

    24576:XlHU6Z3HDApIDkgZqwxVYil8y6Q4XyOifcM:XlzZzAhgpxNiyHAc

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2b0531a61ba1928ee484d1e0883979667309903166aa830c1f6719425a92436.exe
    "C:\Users\Admin\AppData\Local\Temp\a2b0531a61ba1928ee484d1e0883979667309903166aa830c1f6719425a92436.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\ProgramData\msprotection.exe
      C:\ProgramData\msprotection.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4800
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 780
        3⤵
        • Program crash
        PID:2348
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 880
        3⤵
        • Program crash
        PID:224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1100
        3⤵
        • Program crash
        PID:4148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1148
        3⤵
        • Program crash
        PID:1220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1240
        3⤵
        • Program crash
        PID:3540
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1248
        3⤵
        • Program crash
        PID:4736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1272
        3⤵
        • Program crash
        PID:828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1284
        3⤵
        • Program crash
        PID:3532
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1284
        3⤵
        • Program crash
        PID:632
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1676
        3⤵
        • Program crash
        PID:1232
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1244
        3⤵
        • Program crash
        PID:4908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4800 -ip 4800
    1⤵
      PID:4500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4800 -ip 4800
      1⤵
        PID:4456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4800 -ip 4800
        1⤵
          PID:364
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4800 -ip 4800
          1⤵
            PID:3788
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4800 -ip 4800
            1⤵
              PID:2736
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4800 -ip 4800
              1⤵
                PID:3604
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4800 -ip 4800
                1⤵
                  PID:4820
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4800 -ip 4800
                  1⤵
                    PID:3824
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4800 -ip 4800
                    1⤵
                      PID:2096
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:1844
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:1852
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:2984
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4296
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:2392
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:996
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:1116
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:428
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4800 -ip 4800
                      1⤵
                        PID:4380
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4800 -ip 4800
                        1⤵
                          PID:4448

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Persistence

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Bootkit

                        1
                        T1067

                        Defense Evasion

                        Modify Registry

                        1
                        T1112

                        Discovery

                        Query Registry

                        1
                        T1012

                        Peripheral Device Discovery

                        1
                        T1120

                        System Information Discovery

                        2
                        T1082

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\msprotection.exe
                          Filesize

                          825KB

                          MD5

                          d223093c45d018c56fda06944940dc4f

                          SHA1

                          d586f4f18eed4ae4ef5dc6084b02b68ee04889cd

                          SHA256

                          09bfb1d21cf9fd028b38a5178d531ee5776674f36f85dd49a22c215c42947780

                          SHA512

                          f5eb187cf2ae196bc7d56a5a0a9a3159057ad1339668dc252835c621a00e340ee4fc759f4241bbf6fec082d90253642b7d9ab4dd2bda4898557cc2bdfe70bdfa

                        • C:\ProgramData\msprotection.exe
                          Filesize

                          825KB

                          MD5

                          d223093c45d018c56fda06944940dc4f

                          SHA1

                          d586f4f18eed4ae4ef5dc6084b02b68ee04889cd

                          SHA256

                          09bfb1d21cf9fd028b38a5178d531ee5776674f36f85dd49a22c215c42947780

                          SHA512

                          f5eb187cf2ae196bc7d56a5a0a9a3159057ad1339668dc252835c621a00e340ee4fc759f4241bbf6fec082d90253642b7d9ab4dd2bda4898557cc2bdfe70bdfa

                        • memory/4800-134-0x0000000000000000-mapping.dmp
                        • memory/4800-137-0x0000000000400000-0x0000000000A1B000-memory.dmp
                          Filesize

                          6.1MB

                        • memory/4800-138-0x0000000000400000-0x0000000000A1B000-memory.dmp
                          Filesize

                          6.1MB

                        • memory/4800-140-0x0000000000400000-0x0000000000A1B000-memory.dmp
                          Filesize

                          6.1MB

                        • memory/4800-142-0x0000000000400000-0x0000000000A1B000-memory.dmp
                          Filesize

                          6.1MB

                        • memory/4800-143-0x0000000000400000-0x0000000000A1B000-memory.dmp
                          Filesize

                          6.1MB

                        • memory/4892-132-0x0000000000400000-0x00000000004EC000-memory.dmp
                          Filesize

                          944KB

                        • memory/4892-133-0x0000000000400000-0x00000000004EC000-memory.dmp
                          Filesize

                          944KB

                        • memory/4892-141-0x0000000000400000-0x00000000004EC000-memory.dmp
                          Filesize

                          944KB