Overview

overview

8

Static

static

3

77b69d2391...45.exe

windows7-x64

7

77b69d2391...45.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 15:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    77b69d23918f11226aaf1eaf63172e45.exe

  • Size

    828KB

  • MD5

    77b69d23918f11226aaf1eaf63172e45

  • SHA1

    3ef0656776b72bedb09af57427261b678019fb6b

  • SHA256

    42e9a549719e7af5faf1d27f61104526a471699907bc936f100e7404858f09c6

  • SHA512

    32c986928670a88f5296e10e4aa9748d668d64f387917872d9bc251c62e8e2b53d90d3ad5f16a8439de8d129bd5f2e0b6513e0dc5afe7c65a2cfbd99aef5523b

  • SSDEEP

    24576:+RBQjLjxdfxa1fEbVHbM3LKhOvB3qQZskIofrgBl+:+gjTg1fEbVAuhoaQ1IofrgBl

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\77b69d23918f11226aaf1eaf63172e45.exe
    "C:\Users\Admin\AppData\Local\Temp\77b69d23918f11226aaf1eaf63172e45.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1240
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 792
        3⤵
        • Program crash
        PID:208
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 784
        3⤵
        • Program crash
        PID:3212
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1096
        3⤵
        • Program crash
        PID:560
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1104
        3⤵
        • Program crash
        PID:4068
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1128
        3⤵
        • Program crash
        PID:4556
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1192
        3⤵
        • Program crash
        PID:4588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1272
        3⤵
        • Program crash
        PID:3120
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1324
        3⤵
        • Program crash
        PID:224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1324
        3⤵
        • Program crash
        PID:2096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1736
        3⤵
        • Program crash
        PID:3052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1340
        3⤵
        • Program crash
        PID:3752
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1240 -ip 1240
    1⤵
      PID:3860
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1240 -ip 1240
      1⤵
        PID:2796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1240 -ip 1240
        1⤵
          PID:1764
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1240 -ip 1240
          1⤵
            PID:2300
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1240 -ip 1240
            1⤵
              PID:4216
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1240 -ip 1240
              1⤵
                PID:3800
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1240 -ip 1240
                1⤵
                  PID:1132
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1240 -ip 1240
                  1⤵
                    PID:3308
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1240 -ip 1240
                    1⤵
                      PID:2016
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:3104
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4504
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:2276
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4152
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:4628
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:792
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:4456
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:4640
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies registry class
                        PID:116
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:3064
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                      1⤵
                        PID:4044
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:3836
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                        1⤵
                          PID:4008
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1240 -ip 1240
                          1⤵
                            PID:2228
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1240 -ip 1240
                            1⤵
                              PID:2376

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\ProgramData\isecurity.exe
                                    Filesize

                                    823KB

                                    MD5

                                    6d6d23ec2d991bccd17291576fd95c6c

                                    SHA1

                                    fca3a128db85fa87ec820e41ab68122b3fb50267

                                    SHA256

                                    3c11e7f655bc770201dac450dc4dba917b122db65107d8afae7c9baf52775003

                                    SHA512

                                    0303acfea980d264c00e5863cf97b6dd17fe551164d713d115bf74814e6baa6120c53dd06cea6222cf697e4bacfe6e4c28ef88969d3008cc3dd83aa892e16928

                                    Download Submit

                                  • C:\Users\Public\Desktop\Internet Security.lnk
                                    Filesize

                                    682B

                                    MD5

                                    8c279b3f43d554fdf2468cd350462066

                                    SHA1

                                    f4285c2ffc6ff134050a7b21b267928e8af13e07

                                    SHA256

                                    c4fdcf0710349dab8a5e55d694b45a01f52f23724741d38985b09e7846115e65

                                    SHA512

                                    ed493f66e7306b2ad6b848cf4c35c03a8084b1694bc5377c5b54b96ec4baf5778b66af36ee6187b0e09103c58f08db9beb58f61c2fe673d2333ab70a38dca38c

                                    Download Submit

                                  • memory/1240-27-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-43-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-46-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-14-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-15-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-17-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-18-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-19-0x00000000027D0000-0x00000000027D1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/1240-23-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-24-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-25-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-26-0x00000000027D0000-0x00000000027D1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/1240-45-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-44-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-39-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-28-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-37-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-38-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-42-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-40-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1240-41-0x0000000000400000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/3064-35-0x00000000046E0000-0x00000000046E1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4524-1-0x0000000000690000-0x0000000000691000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4524-0-0x0000000000400000-0x00000000004FD000-memory.dmp

                                    Filesize

                                    1012KB

                                    Download

                                  • memory/4524-7-0x0000000000400000-0x00000000004FD000-memory.dmp

                                    Filesize

                                    1012KB

                                    Download

                                  • memory/4524-2-0x0000000000400000-0x00000000004FD000-memory.dmp

                                    Filesize

                                    1012KB

                                    Download