Analysis

  • max time kernel
    73s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 10:36

General

  • Target

    a0f04b992dcadb4e8571c802446cbe7777ff87ab6e79c001692f60bcac51b5e2.exe

  • Size

    1012KB

  • MD5

    4392868eae63fdf1dfc26373a400a410

  • SHA1

    f9e2ecdfcc819f6dab31f98330176434980bbf10

  • SHA256

    a0f04b992dcadb4e8571c802446cbe7777ff87ab6e79c001692f60bcac51b5e2

  • SHA512

    2060a3b5afc482556db09cca49e40e1b46dc33f245b86ad94d91c66e4ee6c24e629ca3b4fd679baa8fa36188895b5445d9cdec9f45517476059d850ff2b4bf3e

  • SSDEEP

    24576:MX8N9kVFwN+aLrKWHOBrTIf7PohburU656MYIlUKS9:cuk0LrO10f7gorh55JW

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0f04b992dcadb4e8571c802446cbe7777ff87ab6e79c001692f60bcac51b5e2.exe
    "C:\Users\Admin\AppData\Local\Temp\a0f04b992dcadb4e8571c802446cbe7777ff87ab6e79c001692f60bcac51b5e2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3112
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1396
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4592
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4308
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4780
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4424
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4432
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4556
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4552
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 432 -p 2644 -ip 2644
    1⤵
      PID:4036
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2644 -s 2824
      1⤵
      • Program crash
      PID:1808

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\defender.exe

            Filesize

            889KB

            MD5

            0e0fd720aeab8f1293c63b5ac853000c

            SHA1

            f3cdcce8bec406c45dd9240b43f1711a9e2d2a89

            SHA256

            d421ef2668903624ec09848a20c8d0a6d5d93e574cee8763a1b9672b33ccecf9

            SHA512

            cb5519bc5651de997a31b3853c5801eb860f2aab059b8fa3b8eb995eeb5e21a2992e225d874590f8b137185ccada89081d6c99f6642a49b7c6a9759f5fbe37e4

          • C:\ProgramData\defender.exe

            Filesize

            889KB

            MD5

            0e0fd720aeab8f1293c63b5ac853000c

            SHA1

            f3cdcce8bec406c45dd9240b43f1711a9e2d2a89

            SHA256

            d421ef2668903624ec09848a20c8d0a6d5d93e574cee8763a1b9672b33ccecf9

            SHA512

            cb5519bc5651de997a31b3853c5801eb860f2aab059b8fa3b8eb995eeb5e21a2992e225d874590f8b137185ccada89081d6c99f6642a49b7c6a9759f5fbe37e4

          • memory/3112-138-0x0000000000400000-0x0000000000A2E000-memory.dmp

            Filesize

            6.2MB

          • memory/3112-140-0x0000000000C14000-0x0000000000C17000-memory.dmp

            Filesize

            12KB

          • memory/3112-141-0x0000000000400000-0x0000000000A2E000-memory.dmp

            Filesize

            6.2MB

          • memory/3112-144-0x0000000000400000-0x0000000000A2E000-memory.dmp

            Filesize

            6.2MB

          • memory/3112-145-0x0000000000C14000-0x0000000000C17000-memory.dmp

            Filesize

            12KB

          • memory/3112-146-0x0000000000400000-0x0000000000A2E000-memory.dmp

            Filesize

            6.2MB

          • memory/3260-134-0x00000000008C4000-0x00000000008C7000-memory.dmp

            Filesize

            12KB

          • memory/3260-133-0x0000000000400000-0x0000000000711000-memory.dmp

            Filesize

            3.1MB

          • memory/3260-132-0x0000000000400000-0x0000000000711000-memory.dmp

            Filesize

            3.1MB

          • memory/3260-142-0x0000000000400000-0x0000000000711000-memory.dmp

            Filesize

            3.1MB

          • memory/3260-143-0x00000000008C4000-0x00000000008C7000-memory.dmp

            Filesize

            12KB