Overview

overview

8

Static

static

b33ea549ce...c0.exe

windows7-x64

8

b33ea549ce...c0.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    196s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 02:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    b33ea549ce1c79cf050f7e1123a4cbb2b0505e493c009b2b5fd8bfd6545479c0.exe

  • Size

    852KB

  • MD5

    1bbfeb851446d81549555f7e8ab34d36

  • SHA1

    90b720636723f715b2f2bd61c7d9c69723a20d30

  • SHA256

    b33ea549ce1c79cf050f7e1123a4cbb2b0505e493c009b2b5fd8bfd6545479c0

  • SHA512

    8665ace476fd5b9aeeffd975ee4ea083f67eade51b685def578b9cfdaf4c417d01860305246408ee48903707af0dfd74d8a7ebf0387692d7ddb200dc9e0e9a79

  • SSDEEP

    12288:hor3aRH/Qh8yERtZA3ZQe48LUt1ecpmRPEfGGAS+tuLzqRF932mYk56yZVRU7amN:hlSh87ZAcvtQckEWS4uqp32J86yZU+S

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 13 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b33ea549ce1c79cf050f7e1123a4cbb2b0505e493c009b2b5fd8bfd6545479c0.exe
    "C:\Users\Admin\AppData\Local\Temp\b33ea549ce1c79cf050f7e1123a4cbb2b0505e493c009b2b5fd8bfd6545479c0.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 744
        3⤵
        • Program crash
        PID:1492
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 744
        3⤵
        • Program crash
        PID:260
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 752
        3⤵
        • Program crash
        PID:1684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1108
        3⤵
        • Program crash
        PID:3156
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1128
        3⤵
        • Program crash
        PID:3864
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1136
        3⤵
        • Program crash
        PID:820
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1284
        3⤵
        • Program crash
        PID:1096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1264
        3⤵
        • Program crash
        PID:3524
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1284
        3⤵
        • Program crash
        PID:3392
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1304
        3⤵
        • Program crash
        PID:4056
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1712
        3⤵
        • Program crash
        PID:4684
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 456 -ip 456
    1⤵
      PID:5112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 456 -ip 456
      1⤵
        PID:208
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 456 -ip 456
        1⤵
          PID:2088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 456 -ip 456
          1⤵
            PID:4472
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 456 -ip 456
            1⤵
              PID:5044
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 456 -ip 456
              1⤵
                PID:384
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 456 -ip 456
                1⤵
                  PID:4376
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 456 -ip 456
                  1⤵
                    PID:4252
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 456 -ip 456
                    1⤵
                      PID:1592
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 456 -ip 456
                      1⤵
                        PID:2180
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:1508
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Modifies Installed Components in the registry
                          • Enumerates connected drives
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:3360
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 3360 -s 3816
                            3⤵
                            • Program crash
                            PID:4600
                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                        1⤵
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:5000
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Modifies registry class
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:2828
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Modifies registry class
                          PID:1484
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 604 -p 3360 -ip 3360
                        1⤵
                          PID:676
                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                          1⤵
                          • Modifies data under HKEY_USERS
                          • Suspicious use of SetWindowsHookEx
                          PID:3968
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies Installed Components in the registry
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious behavior: AddClipboardFormatListener
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:4308
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 4308 -s 8008
                            2⤵
                            • Program crash
                            PID:1944
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                          1⤵
                            PID:3016
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4820
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              1⤵
                              • Suspicious use of FindShellTrayWindow
                              PID:4252
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -pss -s 572 -p 4308 -ip 4308
                              1⤵
                                PID:3964
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3612
                                • C:\Windows\explorer.exe
                                  explorer.exe /LOADSAVEDWINDOWS
                                  2⤵
                                  • Modifies Installed Components in the registry
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  • Suspicious use of SendNotifyMessage
                                  PID:1268
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:2808
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  1⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4016
                                  • C:\Windows\explorer.exe
                                    explorer.exe /LOADSAVEDWINDOWS
                                    2⤵
                                    • Modifies Installed Components in the registry
                                    • Enumerates connected drives
                                    • Checks SCSI registry key(s)
                                    • Modifies Internet Explorer settings
                                    • Modifies registry class
                                    • Suspicious behavior: AddClipboardFormatListener
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3808
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  1⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3792
                                  • C:\Windows\explorer.exe
                                    explorer.exe /LOADSAVEDWINDOWS
                                    2⤵
                                    • Modifies registry class
                                    PID:3400
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                  1⤵
                                    PID:1536
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 456 -ip 456
                                    1⤵
                                      PID:4208

                                    Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\ProgramData\isecurity.exe
                                            Filesize

                                            844KB

                                            MD5

                                            eb0b333e95e906d5778a447a7a38a117

                                            SHA1

                                            4d7a0c54586d5e16d7c10e779bdb3da4a71acd65

                                            SHA256

                                            652daab76f4b17b0238d70abe7ba7205a1fa423ddc8d24573ded042c167af952

                                            SHA512

                                            6528fc4bf58ecd176cc79e24b5cefce20ebff5206c86b29bdbd1476ab161b51cc0976214c031cec3a7bfb5ca9fdf25bde78605f1d5fb8a7091eb11a2bbb37f45

                                            Download Submit

                                          • C:\ProgramData\isecurity.exe
                                            Filesize

                                            844KB

                                            MD5

                                            eb0b333e95e906d5778a447a7a38a117

                                            SHA1

                                            4d7a0c54586d5e16d7c10e779bdb3da4a71acd65

                                            SHA256

                                            652daab76f4b17b0238d70abe7ba7205a1fa423ddc8d24573ded042c167af952

                                            SHA512

                                            6528fc4bf58ecd176cc79e24b5cefce20ebff5206c86b29bdbd1476ab161b51cc0976214c031cec3a7bfb5ca9fdf25bde78605f1d5fb8a7091eb11a2bbb37f45

                                            Download Submit

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                            Filesize

                                            1KB

                                            MD5

                                            af5646f63baadc6019c51b5fc69842e7

                                            SHA1

                                            8d0e69e900550ce2af16c79003a5b479300e5af6

                                            SHA256

                                            8ae2f4b2c7e68134f60ad69ba217c6db939f3cdac96e60eea09bbdac2b78f1e2

                                            SHA512

                                            4876ae485caf73adc4b22f109552fe121e9cb628a494b43fd15bcd6a44307f36a04eb7bbd0f7dc0a80d8f03fff2800321d78dd0a724d08fa95a8323856628c97

                                            Download Submit

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                            Filesize

                                            404B

                                            MD5

                                            2aee3e5cc87aa8595915819d5350dbd5

                                            SHA1

                                            4c5d90924d1181c2ec66c4d69de438bb550d19ae

                                            SHA256

                                            d4c12e0c44a873fb7b7dfc4bce4d2b7d9fbbbc1ba00743b396b40dbca1685330

                                            SHA512

                                            613e49c6f2bc3f13beb99ead1d8ad9425e092f0511fdd5c7e8ced84aa0f045af208707b21aa14f2a1b340cbc01a38d31d2ee2d0b9368d73a358773662ea9acba

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\IconCache.db
                                            Filesize

                                            16KB

                                            MD5

                                            3ec94aa548ab2bd63af0208d0ffb8a78

                                            SHA1

                                            bbf018657be62351faef4ef8ddd88d837a14f708

                                            SHA256

                                            f8f0d685d3142b80db2540ba4b4927d64ee994ff025d19bb107bb479c5da65e0

                                            SHA512

                                            b666a1f0dd738f11c23927c9f67f5f39796e294f2abbc01590be7ed7ac3590869752335a6246a9d204b349c8a5a2522ffce069811d75392c687091a2215d462e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                            Filesize

                                            1022B

                                            MD5

                                            fef887ef25b166c4556b08e8658fe640

                                            SHA1

                                            5eece3c7574417577a5c062ed61d933313be1ead

                                            SHA256

                                            28acc8fc796133f63814d940128356328c7dcff693913b672f1c3ebe9989c90f

                                            SHA512

                                            a87a642359c3961ed0ecb2db378a6ca62da6bda412fdf3bc69f645fde4cf7d518ec29c3cb3f352526a227a5d04cbc077817f80e23ea3a5aa65b75e87e6fb52d4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                            Filesize

                                            1022B

                                            MD5

                                            fef887ef25b166c4556b08e8658fe640

                                            SHA1

                                            5eece3c7574417577a5c062ed61d933313be1ead

                                            SHA256

                                            28acc8fc796133f63814d940128356328c7dcff693913b672f1c3ebe9989c90f

                                            SHA512

                                            a87a642359c3961ed0ecb2db378a6ca62da6bda412fdf3bc69f645fde4cf7d518ec29c3cb3f352526a227a5d04cbc077817f80e23ea3a5aa65b75e87e6fb52d4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                            Filesize

                                            28KB

                                            MD5

                                            88d8392447b6b50b2462742fb6f84712

                                            SHA1

                                            f048ec5eeef20da576762ed38ce578a1c4434609

                                            SHA256

                                            e59b268f448a07249983d16f955e181a13c038ae12f26f09c3b20ec4cefc0774

                                            SHA512

                                            89ebe8ed499045cf04bdcd546530b0a2fb8246ffdcd85da2dbc9a62c9f18bff58472cc192dadd1ba77df9089238327a113f6aa0dde050fa7532340a523b4fe1e

                                            Download Submit

                                          • C:\Users\Public\Desktop\Internet Security.lnk
                                            Filesize

                                            682B

                                            MD5

                                            74e19dd941ae65f540fe7013b1ca1f2e

                                            SHA1

                                            e7bd381dcf6115f8c3f091d32de94c551e859f2c

                                            SHA256

                                            122ab66fffc095eb46469c62079cdfc3ae74d30afe3f0e3ddb66692377eee750

                                            SHA512

                                            8673511410b689bf9c679cdad8cf4c4a2b5a092a1543db6d4d60ef1f06ac9002c48a2ddf4b5b4e6ccff29a97cad6072bf30502ff085dcc7eddf0c28e3c7177cd

                                            Download Submit

                                          • memory/456-139-0x0000000000400000-0x0000000000A3D000-memory.dmp

                                            Filesize

                                            6.2MB

                                            Download

                                          • memory/456-138-0x0000000000400000-0x0000000000A3D000-memory.dmp

                                            Filesize

                                            6.2MB

                                            Download

                                          • memory/456-136-0x0000000000400000-0x0000000000A3D000-memory.dmp

                                            Filesize

                                            6.2MB

                                            Download

                                          • memory/4708-132-0x0000000000400000-0x0000000000508000-memory.dmp

                                            Filesize

                                            1.0MB

                                            Download