Overview

overview

8

Static

static

c3c4b87a6f...74.exe

windows7-x64

8

c3c4b87a6f...74.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    170s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-12-2022 06:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c3c4b87a6ffb4ca6be623f0c3c8af2b4f8779443e07f4d87a5d4431fdeea2f74.exe

  • Size

    844KB

  • MD5

    c06ec00914836f74acb11a22b5ebe82c

  • SHA1

    a941b3241d79245b35a092059a398cac11f5aa5f

  • SHA256

    c3c4b87a6ffb4ca6be623f0c3c8af2b4f8779443e07f4d87a5d4431fdeea2f74

  • SHA512

    e4f6c1c4f36439058f7e86c262b2c383cffda0a2443f5c9cb7a23232b790cf30b508a22337bb1215f279aac3eaf383a44605b46048f004b7978e5a4d7219c003

  • SSDEEP

    12288:sqejXb3FnOyyoeNJ2S98aR+G0TqEdaNahcbbfcRrRtzPyY7Eu+uEsQs8aXe6fWM:sqejooeHgTqEINwCXY7Eu+bsQs84eY

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3c4b87a6ffb4ca6be623f0c3c8af2b4f8779443e07f4d87a5d4431fdeea2f74.exe
    "C:\Users\Admin\AppData\Local\Temp\c3c4b87a6ffb4ca6be623f0c3c8af2b4f8779443e07f4d87a5d4431fdeea2f74.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 856
        3⤵
        • Program crash
        PID:1028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 936
        3⤵
        • Program crash
        PID:1264
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 856
        3⤵
        • Program crash
        PID:2952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1152
        3⤵
        • Program crash
        PID:3292
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1172
        3⤵
        • Program crash
        PID:4288
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1284
        3⤵
        • Program crash
        PID:3756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1296
        3⤵
        • Program crash
        PID:3476
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1284
        3⤵
        • Program crash
        PID:1920
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1180
        3⤵
        • Program crash
        PID:384
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1352
        3⤵
        • Program crash
        PID:1224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1176
        3⤵
        • Program crash
        PID:3492
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2496 -ip 2496
    1⤵
      PID:2144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2496 -ip 2496
      1⤵
        PID:1824
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2496 -ip 2496
        1⤵
          PID:1220
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2496 -ip 2496
          1⤵
            PID:1092
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2496 -ip 2496
            1⤵
              PID:116
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2496 -ip 2496
              1⤵
                PID:4828
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2496 -ip 2496
                1⤵
                  PID:3444
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2496 -ip 2496
                  1⤵
                    PID:3488
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2496 -ip 2496
                    1⤵
                      PID:816
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2496 -ip 2496
                      1⤵
                        PID:4472
                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                        1⤵
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:1832
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:4624
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3772
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Modifies Installed Components in the registry
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2844
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 2844 -s 3204
                            3⤵
                            • Program crash
                            PID:552
                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                        1⤵
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:2776
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:1540
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Modifies Installed Components in the registry
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:3944
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 688 -p 2844 -ip 2844
                        1⤵
                          PID:1492
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:4812
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:3888
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:3760
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2496 -ip 2496
                          1⤵
                            PID:3672

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Initial Access

                          Execution

                          Persistence

                          Registry Run Keys / Startup Folder

                          2
                          T1060

                          Bootkit

                          1
                          T1067

                          Privilege Escalation

                          Defense Evasion

                          Modify Registry

                          2
                          T1112

                          Credential Access

                          Discovery

                          Query Registry

                          2
                          T1012

                          Peripheral Device Discovery

                          2
                          T1120

                          System Information Discovery

                          3
                          T1082

                          Lateral Movement

                          Collection

                          Exfiltration

                          Command and Control

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\isecurity.exe
                            Filesize

                            838KB

                            MD5

                            d4ce7134dd124172149a8bbfc93786e8

                            SHA1

                            5e52177f5f7e71467bafad2b48aef2e57729f017

                            SHA256

                            4cb03bc097d55ec09fe97a287e03a8f0ba186a301e7875ff48f7a50dd46f4d36

                            SHA512

                            01b07c541ccc0ad16b32e6e09e17f20be2f8c24f1c5d4d9d7037cdbb5cc8dc123b53748a58fd2f10cd7dd4f0f3f13454edd12eca4ef5dee9ee67222433fab903

                            Download Submit
                          • C:\ProgramData\isecurity.exe
                            Filesize

                            838KB

                            MD5

                            d4ce7134dd124172149a8bbfc93786e8

                            SHA1

                            5e52177f5f7e71467bafad2b48aef2e57729f017

                            SHA256

                            4cb03bc097d55ec09fe97a287e03a8f0ba186a301e7875ff48f7a50dd46f4d36

                            SHA512

                            01b07c541ccc0ad16b32e6e09e17f20be2f8c24f1c5d4d9d7037cdbb5cc8dc123b53748a58fd2f10cd7dd4f0f3f13454edd12eca4ef5dee9ee67222433fab903

                            Download Submit
                          • C:\Users\Public\Desktop\Internet Security.lnk
                            Filesize

                            682B

                            MD5

                            42b813cc440e67cd624dd2548c747759

                            SHA1

                            5c470f7eeafa9861c5f7a2ea59580862e7a8772e

                            SHA256

                            cedec60521cbe6bd24d4a9f8fa55761d3fd67ad15c14d3ad124b681733a9c60d

                            SHA512

                            7da0cf61308f2dd6aa11c4f38440c7ee6869adf49d9c5906a388c19948ab1e44a20f9e232e74ef81c08ef8ce6e77d2ae9e9aa73f6407db3d71f8e7d82621995d

                            Download Submit
                          • memory/2496-133-0x0000000000000000-mapping.dmp
                            Download
                          • memory/2496-136-0x0000000000400000-0x0000000000A3B000-memory.dmp
                            Filesize

                            6.2MB

                            Download
                          • memory/2496-138-0x0000000000400000-0x0000000000A3B000-memory.dmp
                            Filesize

                            6.2MB

                            Download
                          • memory/2496-139-0x0000000000400000-0x0000000000A3B000-memory.dmp
                            Filesize

                            6.2MB

                            Download
                          • memory/2496-140-0x0000000000400000-0x0000000000A3B000-memory.dmp
                            Filesize

                            6.2MB

                            Download
                          • memory/2844-141-0x0000000000000000-mapping.dmp
                            Download
                          • memory/3944-142-0x0000000000000000-mapping.dmp
                            Download
                          • memory/4088-132-0x0000000000400000-0x0000000000504000-memory.dmp
                            Filesize

                            1.0MB

                            Download