Overview

overview

8

Static

static

37992ee928...31.exe

windows7-x64

8

37992ee928...31.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2023, 02:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    37992ee9284d0caf1738f37f3a18cdcbe028c731.exe

  • Size

    852KB

  • MD5

    87b78ec2010a39347f141adeede01628

  • SHA1

    37992ee9284d0caf1738f37f3a18cdcbe028c731

  • SHA256

    684e04a45383188f82f8c000490673060c629c15f6d61c031edb13df953712b9

  • SHA512

    3a65517ef4d4cc5c3380dc8cfab946e8aeca12fc6a48f54fa4f2f42aa2aca41b9ac5fd76be29315de05c61095a703c53ae335fa6572c22aab42d8d0f54869a97

  • SSDEEP

    24576:HbfjXLtl29eZFiG6SKPEfFR8LTQpfILi0aW:n7tc90Fp64fX8vQqLi

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 14 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 59 IoCs
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37992ee9284d0caf1738f37f3a18cdcbe028c731.exe
    "C:\Users\Admin\AppData\Local\Temp\37992ee9284d0caf1738f37f3a18cdcbe028c731.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3284
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 832
        3⤵
        • Program crash
        PID:1332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 852
        3⤵
        • Program crash
        PID:3652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1116
        3⤵
        • Program crash
        PID:2656
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1128
        3⤵
        • Program crash
        PID:396
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1168
        3⤵
        • Program crash
        PID:3160
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1260
        3⤵
        • Program crash
        PID:4996
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1164
        3⤵
        • Program crash
        PID:4460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1260
        3⤵
        • Program crash
        PID:1820
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1312
        3⤵
        • Program crash
        PID:1860
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1648
        3⤵
        • Program crash
        PID:4652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1264
        3⤵
        • Program crash
        PID:4604
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3284 -ip 3284
    1⤵
      PID:4376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3284 -ip 3284
      1⤵
        PID:176
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3284 -ip 3284
        1⤵
          PID:2208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3284 -ip 3284
          1⤵
            PID:1916
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3284 -ip 3284
            1⤵
              PID:4528
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3284 -ip 3284
              1⤵
                PID:4184
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3284 -ip 3284
                1⤵
                  PID:5084
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3284 -ip 3284
                  1⤵
                    PID:3336
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3284 -ip 3284
                    1⤵
                      PID:4212
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:952
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:1624
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 1624 -s 2508
                          3⤵
                          • Program crash
                          PID:5032
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:1868
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3580
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies registry class
                        PID:4856
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4248
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 500 -p 1624 -ip 1624
                      1⤵
                        PID:4916
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:3528
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Modifies registry class
                          PID:3652
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:4024
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 4024 -s 2560
                          2⤵
                          • Program crash
                          PID:4908
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
                        1⤵
                        • Enumerates connected drives
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of SetWindowsHookEx
                        PID:4020
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:1584
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 564 -p 4024 -ip 4024
                          1⤵
                            PID:520
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                            1⤵
                              PID:3304
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:3932
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 3932 -s 2676
                                2⤵
                                • Program crash
                                PID:4968
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2152
                              • C:\Windows\explorer.exe
                                explorer.exe /LOADSAVEDWINDOWS
                                2⤵
                                • Modifies registry class
                                PID:4364
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -pss -s 528 -p 3932 -ip 3932
                              1⤵
                                PID:4996
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2728
                                • C:\Windows\explorer.exe
                                  explorer.exe /LOADSAVEDWINDOWS
                                  2⤵
                                  • Modifies registry class
                                  PID:2780
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies Installed Components in the registry
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:2384
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                1⤵
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of WriteProcessMemory
                                PID:772
                                • C:\Windows\explorer.exe
                                  explorer.exe /LOADSAVEDWINDOWS
                                  2⤵
                                  • Modifies Installed Components in the registry
                                  • Enumerates connected drives
                                  • Checks SCSI registry key(s)
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  PID:628
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3284 -ip 3284
                                1⤵
                                  PID:1648
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3284 -ip 3284
                                  1⤵
                                    PID:2724

                                  Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\ProgramData\isecurity.exe
                                          Filesize

                                          844KB

                                          MD5

                                          3c3c187ffc8ea535683ca2e0d65fa40a

                                          SHA1

                                          7c386811352dc5ce71927e70009cda5361595c5b

                                          SHA256

                                          7a23bb32f47126a01e9a8ca15d4de040bccf671ead03b6ce2a69ee1f3ea9dccf

                                          SHA512

                                          768ecdf333fbc0308dab9a20d1685446f6340e5e102aab901dfe2dccce2ef1604387225ba8b3b3c2685e9916c943297d9e57b28727334cb253e94f2aa0e5f3ea

                                          Download Submit

                                        • C:\ProgramData\isecurity.exe
                                          Filesize

                                          844KB

                                          MD5

                                          3c3c187ffc8ea535683ca2e0d65fa40a

                                          SHA1

                                          7c386811352dc5ce71927e70009cda5361595c5b

                                          SHA256

                                          7a23bb32f47126a01e9a8ca15d4de040bccf671ead03b6ce2a69ee1f3ea9dccf

                                          SHA512

                                          768ecdf333fbc0308dab9a20d1685446f6340e5e102aab901dfe2dccce2ef1604387225ba8b3b3c2685e9916c943297d9e57b28727334cb253e94f2aa0e5f3ea

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                          Filesize

                                          1KB

                                          MD5

                                          c7d412edc060f67ec819ade99e39743a

                                          SHA1

                                          3560ba200d6f031876b8fa400f41165d5cd77040

                                          SHA256

                                          05868627ccd433b978c1439d4d279430c9f3cb43903ee42e3c1761ac130ce76a

                                          SHA512

                                          b670d75849b751cd46a2d18eb1092ca2ec5485032b8db25ca681afea3d2f46ae0efee34f8d42ac543a99c72d071ef6363650d8751f298651e6c6afb5af175519

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                          Filesize

                                          404B

                                          MD5

                                          c1fdeb13e0851dc3bcab27f81cfd1718

                                          SHA1

                                          fc016eea265f35952bd5cf5288569e420790b4e3

                                          SHA256

                                          48b9e8735d3b461991ea25be2eff952d3b06dec927c4220d6fd5854b34e39fea

                                          SHA512

                                          6be70fa7cb3df9212927044a808d515dcaf602393aa8f12eaa9b505145a9207bfc91858fc53ba6ca77d8bb267dc58df49250b0ba3b65ee39dc390b59ac97f855

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                          Filesize

                                          1016B

                                          MD5

                                          0e4048ae343932ec4deecd5c28d41120

                                          SHA1

                                          d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724

                                          SHA256

                                          d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970

                                          SHA512

                                          bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                          Filesize

                                          28KB

                                          MD5

                                          6599532931efe4b490c805b745dfebfd

                                          SHA1

                                          c3ab543fbba65bf555d36056cf9dbff5d67e8462

                                          SHA256

                                          4b46151b5e21097875f845fca6e76845c4cd3cbc9999b8d6055aabeb0ddb1efa

                                          SHA512

                                          81efb74832b420e189520d85f965c4578c625986c40616c3c96c74a5039b9a5d8e92a96e991813224f6876deeef3305ebe6ab0e75251244002265f1d37a1b0d7

                                          Download Submit

                                        • C:\Users\Public\Desktop\Internet Security.lnk
                                          Filesize

                                          682B

                                          MD5

                                          1c0639071dbeb4c3e562382d771b8a5d

                                          SHA1

                                          1f2124fcdbda7fdea8eeb596502d72a4790ed8e0

                                          SHA256

                                          bd09daf5d4ee6a65b9beb7b24e75f7c1e68320566718063f170364d8cae76ac8

                                          SHA512

                                          9bc17785d10078ba39ed866d1716ab17b4bd43f460f199f8fec324522afae17ef7d666ec1b594de8f6f263e337d04e1c5496868bcfdae3a6e741d2a4abcc9617

                                          Download Submit

                                        • memory/3248-132-0x0000000000400000-0x000000000050D000-memory.dmp

                                          Filesize

                                          1.1MB

                                          Download

                                        • memory/3248-138-0x0000000000400000-0x000000000050D000-memory.dmp

                                          Filesize

                                          1.1MB

                                          Download

                                        • memory/3284-140-0x0000000000400000-0x0000000000A34000-memory.dmp

                                          Filesize

                                          6.2MB

                                          Download

                                        • memory/3284-139-0x0000000000400000-0x0000000000A34000-memory.dmp

                                          Filesize

                                          6.2MB

                                          Download

                                        • memory/3284-136-0x0000000000400000-0x0000000000A34000-memory.dmp

                                          Filesize

                                          6.2MB

                                          Download