Overview

overview

8

Static

static

3

2911627228...17.exe

windows7-x64

7

2911627228...17.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2023 04:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    29116272281ad7f8b672112fe47d1a17.exe

  • Size

    847KB

  • MD5

    29116272281ad7f8b672112fe47d1a17

  • SHA1

    7fe297ff7b1b88f41a80e1c71327bed4e12a49c6

  • SHA256

    b143c1b25096ec1fc28a227a74d1ff0d2decafcd41b02317d3ed0002f329f043

  • SHA512

    abcb1e965679be5aef5bc025ec1d679394c2c27341ec7a63a67d9fd94142b9f803b77f9ce2fd73aa6a1dbb43b55e40dbdf45a9dd633c42201a831119f0f7b57d

  • SSDEEP

    24576:y3+BG6BhAVGbqQ4sW8xYBrMBJyPVrk8hACSM/:VT6EUz8fqGCS

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\29116272281ad7f8b672112fe47d1a17.exe
    "C:\Users\Admin\AppData\Local\Temp\29116272281ad7f8b672112fe47d1a17.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4868
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 744
        3⤵
        • Program crash
        PID:1724
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 772
        3⤵
        • Program crash
        PID:1196
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 792
        3⤵
        • Program crash
        PID:1412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1108
        3⤵
        • Program crash
        PID:1704
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1164
        3⤵
        • Program crash
        PID:1484
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1268
        3⤵
        • Program crash
        PID:2384
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1308
        3⤵
        • Program crash
        PID:5076
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1328
        3⤵
        • Program crash
        PID:4088
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1344
        3⤵
        • Program crash
        PID:4672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1348
        3⤵
        • Program crash
        PID:4004
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1748
        3⤵
        • Program crash
        PID:3412
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 4868
    1⤵
      PID:832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4868 -ip 4868
      1⤵
        PID:4960
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4868 -ip 4868
        1⤵
          PID:2364
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4868 -ip 4868
          1⤵
            PID:4368
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4868 -ip 4868
            1⤵
              PID:220
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4868 -ip 4868
              1⤵
                PID:1156
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4868 -ip 4868
                1⤵
                  PID:1824
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4868 -ip 4868
                  1⤵
                    PID:2924
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4868 -ip 4868
                    1⤵
                      PID:3748
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4868 -ip 4868
                      1⤵
                        PID:3368
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:1540
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Modifies Installed Components in the registry
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:4044
                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                        1⤵
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:4328
                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                        1⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:216
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:2160
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:2560
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:4168
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:4248
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:4484
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4868 -ip 4868
                        1⤵
                          PID:4276

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Public\Desktop\Internet Security.lnk
                          Filesize

                          682B

                          MD5

                          ad00aeb11009ed2c59934bd978bf01e7

                          SHA1

                          b2514f19beaaa5b7ef444ccfba7ede8a93fca586

                          SHA256

                          7c07dbd2115af3a3ae5fc0dd89f14f4750e38359b6a76f8b26ade7bd3774978f

                          SHA512

                          86834e72cb7e7e834d521476e6cd6be6ecabc40cbdda6c451afd475febda0b1bbe0b0828de19d616086a1d6dba091cf49c1899d8e1a0e2d3aa3346bd731c26fd

                          Download Submit

                        • memory/4044-32-0x00000000027A0000-0x00000000027A1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4868-24-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-37-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-15-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-14-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-17-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-19-0x00000000026E0000-0x00000000026E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4868-18-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-21-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-41-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-40-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-29-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-39-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-33-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-34-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-35-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-36-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4868-38-0x0000000000400000-0x0000000000A3F000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4888-7-0x0000000000400000-0x0000000000500000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/4888-1-0x0000000002250000-0x0000000002251000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4888-0-0x0000000000400000-0x0000000000500000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/4888-2-0x0000000000400000-0x0000000000500000-memory.dmp

                          Filesize

                          1024KB

                          Download