Analysis
-
max time kernel
152s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 05:16
Static task
static1
Behavioral task
behavioral1
Sample
684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe
Resource
win10v2004-20221111-en
General
-
Target
684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe
-
Size
845KB
-
MD5
340d640282d2b8af6838bffc2eececa0
-
SHA1
ba33257b2a96bef8cdf08d20dabf3b7a165b9916
-
SHA256
684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e
-
SHA512
ff17c6784a5f8b92307923af033dc948167dc532361744dc81812a9794242ac14966f299962f3f2d23423c1401dab2668840e90f2bd8c2b05a10a35f35230055
-
SSDEEP
24576:9Y8/UaHDWHLrKF52YEqJ3Z597nKOV2UAQd15N:HUaH+aMYN97Ac
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
isecurity.exepid process 1152 isecurity.exe -
Loads dropped DLL 3 IoCs
Processes:
684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exepid process 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
isecurity.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\isecurity.exe" isecurity.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run isecurity.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
isecurity.exedescription ioc process File opened (read-only) \??\F: isecurity.exe File opened (read-only) \??\G: isecurity.exe File opened (read-only) \??\I: isecurity.exe File opened (read-only) \??\L: isecurity.exe File opened (read-only) \??\M: isecurity.exe File opened (read-only) \??\R: isecurity.exe File opened (read-only) \??\E: isecurity.exe File opened (read-only) \??\P: isecurity.exe File opened (read-only) \??\Q: isecurity.exe File opened (read-only) \??\X: isecurity.exe File opened (read-only) \??\Y: isecurity.exe File opened (read-only) \??\K: isecurity.exe File opened (read-only) \??\N: isecurity.exe File opened (read-only) \??\O: isecurity.exe File opened (read-only) \??\S: isecurity.exe File opened (read-only) \??\H: isecurity.exe File opened (read-only) \??\T: isecurity.exe File opened (read-only) \??\U: isecurity.exe File opened (read-only) \??\V: isecurity.exe File opened (read-only) \??\W: isecurity.exe File opened (read-only) \??\Z: isecurity.exe File opened (read-only) \??\J: isecurity.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
isecurity.exedescription ioc process File opened for modification \??\PhysicalDrive0 isecurity.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exeisecurity.exepid process 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exepid process 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
isecurity.exepid process 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe -
Suspicious use of SendNotifyMessage 11 IoCs
Processes:
isecurity.exepid process 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe 1152 isecurity.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
isecurity.exepid process 1152 isecurity.exe 1152 isecurity.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exedescription pid process target process PID 2028 wrote to memory of 1152 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe isecurity.exe PID 2028 wrote to memory of 1152 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe isecurity.exe PID 2028 wrote to memory of 1152 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe isecurity.exe PID 2028 wrote to memory of 1152 2028 684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe isecurity.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe"C:\Users\Admin\AppData\Local\Temp\684a6a02bc105dec6af660a46bb1db1353f8c4f4f9166da7fcb3680d21c70c8e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\isecurity.exeC:\ProgramData\isecurity.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\isecurity.exeFilesize
840KB
MD560ce69a06b03553eda119377e4de2319
SHA169eb4666f380b56fca1bcd582abca4d1cb494e86
SHA25699b11aa46b72d08d22d4506bea8c86d0216028c75be60d5de25d7fc7465672a5
SHA5120f0a8ecf7840d6aa07136b82f940fab5f783b5ba7e8fb335498266f3eeb18cd724a8aabb498febaca7f8c3c699afabd51138c2f473242a812b00ab9eed33a7b0
-
\ProgramData\isecurity.exeFilesize
840KB
MD560ce69a06b03553eda119377e4de2319
SHA169eb4666f380b56fca1bcd582abca4d1cb494e86
SHA25699b11aa46b72d08d22d4506bea8c86d0216028c75be60d5de25d7fc7465672a5
SHA5120f0a8ecf7840d6aa07136b82f940fab5f783b5ba7e8fb335498266f3eeb18cd724a8aabb498febaca7f8c3c699afabd51138c2f473242a812b00ab9eed33a7b0
-
\ProgramData\isecurity.exeFilesize
840KB
MD560ce69a06b03553eda119377e4de2319
SHA169eb4666f380b56fca1bcd582abca4d1cb494e86
SHA25699b11aa46b72d08d22d4506bea8c86d0216028c75be60d5de25d7fc7465672a5
SHA5120f0a8ecf7840d6aa07136b82f940fab5f783b5ba7e8fb335498266f3eeb18cd724a8aabb498febaca7f8c3c699afabd51138c2f473242a812b00ab9eed33a7b0
-
\ProgramData\isecurity.exeFilesize
840KB
MD560ce69a06b03553eda119377e4de2319
SHA169eb4666f380b56fca1bcd582abca4d1cb494e86
SHA25699b11aa46b72d08d22d4506bea8c86d0216028c75be60d5de25d7fc7465672a5
SHA5120f0a8ecf7840d6aa07136b82f940fab5f783b5ba7e8fb335498266f3eeb18cd724a8aabb498febaca7f8c3c699afabd51138c2f473242a812b00ab9eed33a7b0
-
memory/1152-60-0x0000000000000000-mapping.dmp
-
memory/1152-63-0x0000000000400000-0x0000000000A39000-memory.dmpFilesize
6.2MB
-
memory/1152-65-0x0000000000400000-0x0000000000A39000-memory.dmpFilesize
6.2MB
-
memory/1152-66-0x0000000000400000-0x0000000000A39000-memory.dmpFilesize
6.2MB
-
memory/1152-67-0x0000000000400000-0x0000000000A39000-memory.dmpFilesize
6.2MB
-
memory/2028-54-0x0000000076651000-0x0000000076653000-memory.dmpFilesize
8KB
-
memory/2028-55-0x0000000000400000-0x0000000000506000-memory.dmpFilesize
1.0MB
-
memory/2028-56-0x0000000000400000-0x0000000000506000-memory.dmpFilesize
1.0MB