c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5

General

Target

c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Size

261KB
MD5

b6314df8ec9fd1c6c4cd2db7400bf84b
SHA1

9e0eb98d59a6f7191674b1f673ebfbd17dba27b7
SHA256

c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5
SHA512

c422e0888495379542998a03c7d8639be20c7c73031785c2c033fc6dbaca8a74680b02df3a6e5fb3cdc8b8d6afb1691f446e4f89c3a92f4b1a7e2a193dd59e4d
SSDEEP

6144:a5O89S69xxY3hkm1ZDLZA3M7KrD37lSCVzhhy4:blhGmvLZA3M7KrDJVX

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3100	SeFastInstall2_3218.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e2b-134.dat	upx
behavioral2/files/0x0006000000022e2b-135.dat	upx
behavioral2/memory/3100-141-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/3100-142-0x0000000000400000-0x00000000004AB000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
360	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
360	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
360	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
360	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
360	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SeFastInstall2_3218.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\ = "Internet Explorer"	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\InfoTip = "Internet Explorer"	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\DefaultIcon	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\DefaultIcon\ = "C:\\Windows\\SysWow64\\SHELL32.DLL,220"	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\TypeLib	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\Shell	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\Shell\Internet Explorer\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.pp2345.com"	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\ShellFolder\Attributes = "0"	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\Shell\Internet Explorer\Command	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\Shell\Internet Explorer	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\ShellFolder	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10A8D663-77FE-4154-9BBC-10897B46B877}\TypeLib\ = "{10A8D663-77FE-4154-9BBC-10897B46B877}"	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3100	SeFastInstall2_3218.exe
3100	SeFastInstall2_3218.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 3100	360	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe	87
PID 360 wrote to memory of 3100	360	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe	87
PID 360 wrote to memory of 3100	360	c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe	87

C:\Users\Admin\AppData\Local\Temp\c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe
"C:\Users\Admin\AppData\Local\Temp\c60366befd483ab51c95d3a1ad4f104838357693c956046a52e2764aff6e8bc5.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:360
- C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe
  "C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:3100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe

Filesize
227KB

MD5
006bcf6d8e9bcda4ad8323f3622e245b

SHA1
45b88bd752ea8853a3aebf5779ae47666253251c

SHA256
8854b97a765d20e2f15cc2da23bd78584bc3f67ec05a7e3f16020690f25d3821

SHA512
4008fbce2719618acd2a4f852a601517935a018f56ff361c4c08a88fb1446f2e35652c8128ed86b313bd198966ffb8892c6ee7000132551d396dbcb40ba48ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe

Filesize
227KB

MD5
006bcf6d8e9bcda4ad8323f3622e245b

SHA1
45b88bd752ea8853a3aebf5779ae47666253251c

SHA256
8854b97a765d20e2f15cc2da23bd78584bc3f67ec05a7e3f16020690f25d3821

SHA512
4008fbce2719618acd2a4f852a601517935a018f56ff361c4c08a88fb1446f2e35652c8128ed86b313bd198966ffb8892c6ee7000132551d396dbcb40ba48ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyCD73.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyCD73.tmp\inetc.dll

Filesize
20KB

MD5
8d8fdad7e153d6b82913f6fdc407d12c

SHA1
aabbeed33cd5221e4cb22aab6e48310df94facfd

SHA256
e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b

SHA512
42bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyCD73.tmp\inetc.dll

Filesize
20KB

MD5
8d8fdad7e153d6b82913f6fdc407d12c

SHA1
aabbeed33cd5221e4cb22aab6e48310df94facfd

SHA256
e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b

SHA512
42bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyCD73.tmp\md5dll.dll

Filesize
8KB

MD5
a7d710e78711d5ab90e4792763241754

SHA1
f31cecd926c5d497aba163a17b75975ec34beb13

SHA256
9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

SHA512
f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyCD73.tmp\md5dll.dll

Filesize
8KB

MD5
a7d710e78711d5ab90e4792763241754

SHA1
f31cecd926c5d497aba163a17b75975ec34beb13

SHA256
9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

SHA512
f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

Download Submit
memory/360-140-0x0000000002231000-0x0000000002234000-memory.dmp

Filesize
12KB

Download
memory/3100-141-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/3100-142-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download

Analysis

Sharing