Analysis

  • max time kernel
    152s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2022 23:04

General

  • Target

    eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660.exe

  • Size

    904KB

  • MD5

    93799bad9a3ce0b1f3b41ab006d86d7c

  • SHA1

    8362b5a5523763b945746e34b44f33d247acae6d

  • SHA256

    eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660

  • SHA512

    9ebbba81b7636636f4426a516cbddf48f88796090d0e25296d234204b6e9befd306dd54a90612b7c1d5a88da68651b940c7cbb3c51368a480d3d33c2a27d9da6

  • SSDEEP

    24576:yb8NrhwLjVz0g8boR4Mfzlf7zPgi0BVY:yb8NrhQqba4Mfzlf7Lz0BV

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660.exe
    "C:\Users\Admin\AppData\Local\Temp\eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1164
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 872
        3⤵
        • Program crash
        PID:4216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 880
        3⤵
        • Program crash
        PID:3380
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 912
        3⤵
        • Program crash
        PID:2180
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 928
        3⤵
        • Program crash
        PID:3792
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 904
        3⤵
        • Program crash
        PID:3536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1224
        3⤵
        • Program crash
        PID:5116
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1232
        3⤵
        • Program crash
        PID:4336
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1360
        3⤵
        • Program crash
        PID:5048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1368
        3⤵
        • Program crash
        PID:372
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1368
        3⤵
        • Program crash
        PID:2928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1796
        3⤵
        • Program crash
        PID:1908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1164 -ip 1164
    1⤵
      PID:4804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1164 -ip 1164
      1⤵
        PID:4772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1164 -ip 1164
        1⤵
          PID:204
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1164 -ip 1164
          1⤵
            PID:4128
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1164 -ip 1164
            1⤵
              PID:3564
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1164 -ip 1164
              1⤵
                PID:4752
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1164 -ip 1164
                1⤵
                  PID:2448
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1164 -ip 1164
                  1⤵
                    PID:708
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1164 -ip 1164
                    1⤵
                      PID:3440
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1164 -ip 1164
                      1⤵
                        PID:4124
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:4528
                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                        1⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:1456
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:1508
                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                        1⤵
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:2196
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:2108
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:4264
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:4268
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:3172
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1164 -ip 1164
                        1⤵
                          PID:2564

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\defender.exe

                          Filesize

                          875KB

                          MD5

                          4e6427e648e9dc07a8070ad69304033c

                          SHA1

                          7d55c8ce411ecd2d7fdcb89ce4724b66c60de3a9

                          SHA256

                          c984bd1625ace9805329d62a811ec3b80a022af900c1c46d5f0d4a01e6506550

                          SHA512

                          3d637b94b395302423401340de5f61a02501782c95162ad1a7d211e90fd461f13c4719d3bc0653c22302c00db1a928d262f9b26ba8df898c09a26cb6e2a2ecbb

                        • C:\ProgramData\defender.exe

                          Filesize

                          875KB

                          MD5

                          4e6427e648e9dc07a8070ad69304033c

                          SHA1

                          7d55c8ce411ecd2d7fdcb89ce4724b66c60de3a9

                          SHA256

                          c984bd1625ace9805329d62a811ec3b80a022af900c1c46d5f0d4a01e6506550

                          SHA512

                          3d637b94b395302423401340de5f61a02501782c95162ad1a7d211e90fd461f13c4719d3bc0653c22302c00db1a928d262f9b26ba8df898c09a26cb6e2a2ecbb

                        • memory/532-132-0x0000000002890000-0x0000000002899000-memory.dmp

                          Filesize

                          36KB

                        • memory/532-133-0x0000000000400000-0x000000000057D000-memory.dmp

                          Filesize

                          1.5MB

                        • memory/1164-134-0x0000000000000000-mapping.dmp

                        • memory/1164-137-0x0000000002840000-0x0000000002848000-memory.dmp

                          Filesize

                          32KB

                        • memory/1164-138-0x0000000000400000-0x0000000000ABF000-memory.dmp

                          Filesize

                          6.7MB

                        • memory/1164-140-0x0000000000400000-0x0000000000ABF000-memory.dmp

                          Filesize

                          6.7MB