Overview

overview

8

Static

static

07038fdbef...60.exe

windows7-x64

6

07038fdbef...60.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 16:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    07038fdbefef7eae8b2f2f11bc151c9f0981c51ed3a2ce132fe978f219c08060.exe

  • Size

    829KB

  • MD5

    455a685d226293eba3cccfd763897910

  • SHA1

    32afa6cbdc16ce965b42ff62bda0939abe782f6c

  • SHA256

    07038fdbefef7eae8b2f2f11bc151c9f0981c51ed3a2ce132fe978f219c08060

  • SHA512

    9f58c6e1155fe66a50521d644258c0b3ddcea48554f5d96d78fd86c9302423a6557403aa0c0437c60cbd3a62afbe480e50256151d0b3a554548b970bb94b3c2a

  • SSDEEP

    12288:ILdf2+WG5OYnqCnTslv0LWMVvIiZOjFFprdehR03jXIsAbRJ5K/huO3g5XYti4oP:IL12+DFqCnYlOVv+jFLheczXAbjyEXV

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 52 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07038fdbefef7eae8b2f2f11bc151c9f0981c51ed3a2ce132fe978f219c08060.exe
    "C:\Users\Admin\AppData\Local\Temp\07038fdbefef7eae8b2f2f11bc151c9f0981c51ed3a2ce132fe978f219c08060.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2128
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:208
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2500
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2488
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4768
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3540
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 3540 -s 1236
        3⤵
        • Program crash
        PID:4628
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:1736
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1736 -s 2708
        3⤵
        • Program crash
        PID:2240
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 444 -p 3540 -ip 3540
    1⤵
      PID:844
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:4120
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 516 -p 1736 -ip 1736
        1⤵
          PID:3952
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2520
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Modifies registry class
            PID:3604
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
          1⤵
            PID:3496

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                  Filesize

                  1KB

                  MD5

                  a6cf000324d07a54b970719e44e48f12

                  SHA1

                  0a9f185bcd6c4a129779e4b98de0fbc3a00e09d3

                  SHA256

                  dc75badae6a50ed42a504bc90a06086da8af9eb57989846562bce5d5231a9578

                  SHA512

                  8b23a209b4574536539a8ea09554cab4e8cdb70dc7520dc6e5d8fa4bc5b42948bdf3560c0f7ccce57a6330e8ebc1605263fdb6acba9bee82a3816bb5421ba8cb

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                  Filesize

                  434B

                  MD5

                  3d75b29d06bacb02ec3f03f7fb275593

                  SHA1

                  1f02e465e5b5cc2b4fa90160f4559f11c3b56329

                  SHA256

                  fe6836d72437518d37773667036cf73bec178414ddf6af2f81feae54fa83faae

                  SHA512

                  5bbb7a1c6a1d428a93a91081d1f6a5a69502c7b33b269781401513886cccc7a7ff8b2cb09f1377b614855238b643d68577ae804386a916afea18a40d848df7bb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                  Filesize

                  1016B

                  MD5

                  0e4048ae343932ec4deecd5c28d41120

                  SHA1

                  d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                  SHA256

                  d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                  SHA512

                  bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                  Filesize

                  1016B

                  MD5

                  0e4048ae343932ec4deecd5c28d41120

                  SHA1

                  d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                  SHA256

                  d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                  SHA512

                  bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                  Download Submit

                • memory/2128-137-0x0000000000400000-0x0000000000A14000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/2128-139-0x0000000000400000-0x0000000000A14000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/2128-132-0x0000000000400000-0x0000000000A14000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/2128-136-0x0000000000400000-0x0000000000A14000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/2128-135-0x0000000000400000-0x0000000000A14000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/2128-133-0x0000000000400000-0x0000000000A14000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/2128-148-0x0000000000400000-0x0000000000A14000-memory.dmp

                  Filesize

                  6.1MB

                  Download