4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb

General

Target

4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe
Size

841KB
MD5

cf47ee9f9d6fb14dd856308505c3229c
SHA1

1701e546ec25237b5890d05f4a4d90dfc2c4b7ac
SHA256

4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb
SHA512

ecdbaba1320167bd2113f77a29d9c95f9c3680cd71a3f32fd41238eff0741b3964540655e0dcb9ace508966807839d3f2edb04d81749920dfb2c4967538d8b55
SSDEEP

24576:70MdxO63Kc5PTgIfQQAnOsRJo0swQTtNGRPo:70QxO63p90IYQiOL025U

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5080	bsprotection.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	bsprotection.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\bsprotection.exe"	bsprotection.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	bsprotection.exe
File opened (read-only)	\??\E:	bsprotection.exe
File opened (read-only)	\??\F:	bsprotection.exe
File opened (read-only)	\??\H:	bsprotection.exe
File opened (read-only)	\??\J:	bsprotection.exe
File opened (read-only)	\??\K:	bsprotection.exe
File opened (read-only)	\??\R:	bsprotection.exe
File opened (read-only)	\??\T:	bsprotection.exe
File opened (read-only)	\??\X:	bsprotection.exe
File opened (read-only)	\??\G:	bsprotection.exe
File opened (read-only)	\??\M:	bsprotection.exe
File opened (read-only)	\??\O:	bsprotection.exe
File opened (read-only)	\??\P:	bsprotection.exe
File opened (read-only)	\??\W:	bsprotection.exe
File opened (read-only)	\??\Y:	bsprotection.exe
File opened (read-only)	\??\I:	bsprotection.exe
File opened (read-only)	\??\L:	bsprotection.exe
File opened (read-only)	\??\N:	bsprotection.exe
File opened (read-only)	\??\Q:	bsprotection.exe
File opened (read-only)	\??\S:	bsprotection.exe
File opened (read-only)	\??\U:	bsprotection.exe
File opened (read-only)	\??\Z:	bsprotection.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bsprotection.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3992	5080	WerFault.exe	81
4992	5080	WerFault.exe	81
2420	5080	WerFault.exe	81
1768	5080	WerFault.exe	81
2124	5080	WerFault.exe	81
2532	5080	WerFault.exe	81
2536	5080	WerFault.exe	81
4328	5080	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3564	4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe
3564	4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe
5080	bsprotection.exe
5080	bsprotection.exe
5080	bsprotection.exe
5080	bsprotection.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3564	4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5080	bsprotection.exe
5080	bsprotection.exe
5080	bsprotection.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5080	bsprotection.exe
5080	bsprotection.exe
5080	bsprotection.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5080	bsprotection.exe
5080	bsprotection.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5080	3564	4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe	81
PID 3564 wrote to memory of 5080	3564	4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe	81
PID 3564 wrote to memory of 5080	3564	4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe	81

C:\Users\Admin\AppData\Local\Temp\4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe
"C:\Users\Admin\AppData\Local\Temp\4dd2e1457151f0fd690d3710cf1f5fd932cf87e7141ded39f4e8aad72f02aecb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3564
- C:\ProgramData\bsprotection.exe
  C:\ProgramData\bsprotection.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 744
    3⤵
    - Program crash
    PID:3992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1120
    3⤵
    - Program crash
    PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1168
    3⤵
    - Program crash
    PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1260
    3⤵
    - Program crash
    PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1296
    3⤵
    - Program crash
    PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1304
    3⤵
    - Program crash
    PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1324
    3⤵
    - Program crash
    PID:2536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1372
    3⤵
    - Program crash
    PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5080 -ip 5080
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5080 -ip 5080
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5080 -ip 5080
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5080 -ip 5080
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5080 -ip 5080
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5080 -ip 5080
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5080 -ip 5080
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5080 -ip 5080
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5080 -ip 5080
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\bsprotection.exe

Filesize
824KB

MD5
25349911e45206c38fb3c4c39dae3a3a

SHA1
c6a1ed701f3328cc33f63b2848a88f283833941e

SHA256
8e42dd6df5de1042e0b5c6ef203699c86b9f3b5d373e9db5d7e2fb7bf786c43c

SHA512
747bc15dd5525744bb4c840ff1fa58ac56e7c4b22669eb4d47086a9dd4c7a24772d9d0a58c5f69753f711401ab465d8e27108970ee90bb9ef17ccc4fe258262f

Download Submit
C:\ProgramData\bsprotection.exe

Filesize
824KB

MD5
25349911e45206c38fb3c4c39dae3a3a

SHA1
c6a1ed701f3328cc33f63b2848a88f283833941e

SHA256
8e42dd6df5de1042e0b5c6ef203699c86b9f3b5d373e9db5d7e2fb7bf786c43c

SHA512
747bc15dd5525744bb4c840ff1fa58ac56e7c4b22669eb4d47086a9dd4c7a24772d9d0a58c5f69753f711401ab465d8e27108970ee90bb9ef17ccc4fe258262f

Download Submit
memory/3564-132-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/3564-133-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/3564-134-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/5080-138-0x0000000000400000-0x0000000000A1C000-memory.dmp

Filesize
6.1MB

Download
memory/5080-139-0x0000000000400000-0x0000000000A1C000-memory.dmp

Filesize
6.1MB

Download
memory/5080-141-0x0000000000400000-0x0000000000A1C000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing