Overview

overview

8

Static

static

ba6c8a5c36...59.exe

windows7-x64

6

ba6c8a5c36...59.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2022 06:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ba6c8a5c36451f87d7ba614de5c15b1e01678acd0db8f482689191d9873c6659.exe

  • Size

    830KB

  • MD5

    0d87c84d642f5a1d2df5df72091549c0

  • SHA1

    7fcf4e214cb1d981b940fd393140c2fa4b13e898

  • SHA256

    ba6c8a5c36451f87d7ba614de5c15b1e01678acd0db8f482689191d9873c6659

  • SHA512

    517580ba21ccfdf63bb9269b2d0e8489078e57685ea1d71235d54ba002469729dc08a9f9cace3daeafcb5319cf481882bd6a018ae7d8876cfc483698c0fce153

  • SSDEEP

    12288:kt8Q83MKOEAsl2T4bswqIERX0fNs1MVPQMqfwBKnotJJeDOVXVoBL0MbrI+Ekz3s:esbsBTXQNh75BKnKJd7+t6eHXKN

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba6c8a5c36451f87d7ba614de5c15b1e01678acd0db8f482689191d9873c6659.exe
    "C:\Users\Admin\AppData\Local\Temp\ba6c8a5c36451f87d7ba614de5c15b1e01678acd0db8f482689191d9873c6659.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4872
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:460
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 460 -s 2904
        3⤵
        • Program crash
        PID:1168
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4832
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3796
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies registry class
      PID:4556
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1704
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 460 -p 460 -ip 460
    1⤵
      PID:4312
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4204
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:4984
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Modifies Installed Components in the registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3404
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3404 -s 2252
            3⤵
            • Program crash
            PID:1484
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3132
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Modifies registry class
          PID:1416
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 568 -p 3404 -ip 3404
        1⤵
          PID:3244
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4044
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
          1⤵
            PID:2932
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3064
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Modifies Installed Components in the registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SendNotifyMessage
              PID:2456
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2456 -s 2772
                3⤵
                • Program crash
                PID:4684
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 596 -p 2456 -ip 2456
            1⤵
              PID:3768
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:4688
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                  PID:2372
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies Installed Components in the registry
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2152
              • C:\Windows\System32\rundll32.exe
                C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                1⤵
                  PID:2700

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Initial Access

                Execution

                Persistence

                Registry Run Keys / Startup Folder

                2
                T1060

                Bootkit

                1
                T1067

                Privilege Escalation

                Defense Evasion

                Modify Registry

                3
                T1112

                Credential Access

                Discovery

                Query Registry

                2
                T1012

                Peripheral Device Discovery

                2
                T1120

                System Information Discovery

                3
                T1082

                Lateral Movement

                Collection

                Exfiltration

                Command and Control

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                  Filesize

                  1KB

                  MD5

                  d890aa26457262e1c52fb827a1ad5636

                  SHA1

                  738cea1ff83b566eefccacc83fef03c0b8107688

                  SHA256

                  06a6790eadb6335e57e097a5d02d5ff6fab99ee72cd124ebc298428abfdd78f7

                  SHA512

                  d0aca171c4d4ebba938da461e32dd2261115e0130a2707a0a8479eeaedfda842d59cee368e76f4cabb6367c008c479aec30ca75ba6167ed855990a4a3e5fc36b

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                  Filesize

                  434B

                  MD5

                  87677ae7be2c79f0509bfd618a27d6a3

                  SHA1

                  ecb6938b35a19cbce36c29bfc262932598d861bf

                  SHA256

                  5d9e68a62b09f14fbf52d5e7d968f27b16cd830b5a5a7ecccdbe49ffbd1ddd2d

                  SHA512

                  1d06ec292f07ad12b5f8b257ab4a0e7e2801ccd86d4be7726518271ebb1bdb7ea3a6d46b80482819199295fdf0361fbdf8a08e20fef693410d3c9cc70ce559cb

                  Download Submit
                • C:\Users\Admin\AppData\Local\IconCache.db
                  Filesize

                  13KB

                  MD5

                  58c38fa2b1784c3124b81dda6ce59710

                  SHA1

                  bc6aec4505a3d556ffbd127399fa2335014ecede

                  SHA256

                  53e5eea1835a22b65beb3610fa67098c8aa1401967293081013439404eb7e0fb

                  SHA512

                  1d9683cb46282ee8eaa244c382f91a4ab92f6c025c7611d5491539d76975457a7ff22d7c5fa4d5ca4ecdbf4922959dbd8e61f993c100b14a840e982d28569811

                  Download Submit
                • C:\Users\Admin\AppData\Local\IconCache.db
                  Filesize

                  14KB

                  MD5

                  7afe6edda380bd42e7e265a599564201

                  SHA1

                  18dfadad33ddfbad50a82cfc52e632f1ed1e3859

                  SHA256

                  4f1a98b6eec8375703dcd32cf148fe930e782042035bfe7830d716bd62c5a826

                  SHA512

                  9ee276f994aa1aeb91187e3590b65eff992a15fec13d9837ee73f7c3ed6a0d92043efdd461b42503d09edf189ae78e43bd16f93cc8ef2cac885dc4cb47a38330

                  Download Submit
                • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                  Filesize

                  1016B

                  MD5

                  0e4048ae343932ec4deecd5c28d41120

                  SHA1

                  d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                  SHA256

                  d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                  SHA512

                  bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                  Download Submit
                • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                  Filesize

                  1016B

                  MD5

                  0e4048ae343932ec4deecd5c28d41120

                  SHA1

                  d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                  SHA256

                  d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                  SHA512

                  bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                  Download Submit
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                  Filesize

                  28KB

                  MD5

                  35f416a8690df3a52cfed8d859103a7a

                  SHA1

                  5e2eb35327314879c434d7747deb75c74fa72a9c

                  SHA256

                  0721721748737649a06a1aed0a1963750b526632699d47fee8f6eb85f24018fa

                  SHA512

                  a3716e56590e7a6c2e3f9565c7c2ec4e4872ba6e94f090a8ca08324badba0f014b7e9d0e3055e3fe1c4d63f10f89eabe1980300fd661ab84334dba0c0f23327e

                  Download Submit
                • memory/460-135-0x0000000000000000-mapping.dmp
                  Download
                • memory/1416-139-0x0000000000000000-mapping.dmp
                  Download
                • memory/2372-147-0x0000000000000000-mapping.dmp
                  Download
                • memory/2456-145-0x0000000000000000-mapping.dmp
                  Download
                • memory/3404-138-0x0000000000000000-mapping.dmp
                  Download
                • memory/4556-136-0x0000000000000000-mapping.dmp
                  Download
                • memory/4872-132-0x0000000000400000-0x0000000000A1D000-memory.dmp
                  Filesize

                  6.1MB

                  Download
                • memory/4872-137-0x0000000000400000-0x0000000000A1D000-memory.dmp
                  Filesize

                  6.1MB

                  Download
                • memory/4872-134-0x0000000000400000-0x0000000000A1D000-memory.dmp
                  Filesize

                  6.1MB

                  Download