Overview

overview

10

Static

static

10

VirusShare...4a.exe

windows7-x64

VirusShare...4a.exe

windows10-2004-x64

Analysis

  • max time kernel
    2s
  • max time network
    4s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 13:05

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    VirusShare_368c01b181eda42d717feeff4291bb4a.exe

  • Size

    45KB

  • MD5

    368c01b181eda42d717feeff4291bb4a

  • SHA1

    d6a6df6a094b9d76a16c1c9d5ce16b9124ee50b1

  • SHA256

    1a123a6b7cd4740e829d2e5178c718549d7d17bc7bb348e60fa7be6e1c683d72

  • SHA512

    8c45f2bd544224de18c46e3ff90b6f75eca41d66be1636a3845e259df9618c33bab2120ee6f866edc4a490039729920c9708e5f600594e1b3a1ebacb17b904d3

  • SSDEEP

    768:it4VZ1p/ija+1ImUqJsbEYY2Ixs4RhYuX5tOH2AFOmDDRLoJQ7zqAU6FbMPwl:Y4VZPqibA26sMK2GncKmA5

Score
9/10
bootkitpersistenceransomware

Malware Config

Signatures

  • Detects ransomware indicator 2 IoCs
  • Renames multiple (97) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_368c01b181eda42d717feeff4291bb4a.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_368c01b181eda42d717feeff4291bb4a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Users\Admin\AppData\Local\Temp\321.exe
      "C:\Users\Admin\AppData\Local\Temp\321.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      PID:1104
    • C:\Users\Admin\AppData\Local\Temp\123.exe
      "C:\Users\Admin\AppData\Local\Temp\123.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of WriteProcessMemory
      PID:512
      • C:\Users\Admin\AppData\Local\Temp\sys3.exe
        C:\Users\Admin\AppData\Local\Temp\\sys3.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of AdjustPrivilegeToken
        PID:908
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa39a7855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\123.exe
    Filesize

    10KB

    MD5

    5a27e6376a793f2857cf5dac8a4305da

    SHA1

    fd4e4fed53f3f2f984a3d0e7984a1800f46d4cb4

    SHA256

    c9b9fd42eb7276c8589655b4bb529890ef2b807ed5c7535978ec6bf89f870a5f

    SHA512

    78bee85ad0983f14622724b07958af83bc32ec1332abacd4ed52cd2ccdacd9c5c2349e9e81dbfb60a6e5c1268a78efefcd70e555728a049b8fc0351ce856d3b7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\321.exe
    Filesize

    11KB

    MD5

    f2d39b84b4e112a1d0fa4d4fa6ffa6af

    SHA1

    8598cdcf63911f6181d3b3b8aa0a11b3c781a250

    SHA256

    48786527d3c37ad371cb79cd2aee7bb3a23ab04de2984398da691d5246a8f823

    SHA512

    a8b854cb7cc7d12464532cd7896ae55d39b252bb9db26e9b2247f14dea802b987614ed366d513742d8e54504f5616cdb8a46ca80be6e736f219b348986bc06ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\systm.txt
    Filesize

    41B

    MD5

    c16b7ee867494ffa79384d9b32bb1a6c

    SHA1

    ff8254cc19420e6a90f390acd3fa4404c658c1c4

    SHA256

    51494ed614b90e1c9544ed82954e36dfe8c3e8b2b8e051c8d72a3b2fce58564e

    SHA512

    5bb13b03d4cc8d4c9f6e4f255ddb4311d1b2d549200a9d4f6ac1db3b2e016f014c76b0304acf054f729efe960a72078bf323689b6e1c64389743ccb7f7d1833a

    Download Submit

  • memory/512-18-0x000000002AA00000-0x000000002AA05000-memory.dmp

    Filesize

    20KB

    Download

  • memory/512-106-0x000000002AA00000-0x000000002AA05000-memory.dmp

    Filesize

    20KB

    Download

  • memory/1516-44-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download