Analysis

  • max time kernel
    57s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 12:36

General

  • Target

    b76a616ed9cf00389762b18798660574.exe

  • Size

    945KB

  • MD5

    b76a616ed9cf00389762b18798660574

  • SHA1

    22f98626bfaf427513f6dc9fc500637baec64544

  • SHA256

    2a514adb2304c99dc83541c167b3a3af3dc0f0e9615ed6c0726634f6bcd8280a

  • SHA512

    6f4b43d62838f01e528afc7a054e406a464fc157da00b47f3466af9d76fa21c4fb861dbece14c544c7c888ced3505e16f0f0408e3954fdd1b344bc76e2cc83ab

  • SSDEEP

    24576:l+r0o5VtMwpcxlst4C62X+EFKb51XbTk:lg0t4t4j2uiKbPnk

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 12 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b76a616ed9cf00389762b18798660574.exe
    "C:\Users\Admin\AppData\Local\Temp\b76a616ed9cf00389762b18798660574.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:508
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1188
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:544
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3692
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4352
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3504
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4476
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2308
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4100
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:756
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3320
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:4624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:1632
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:2800
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:1392
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:4224
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:1564
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:4192
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3536
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3764
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3552
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:3520
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1000
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4968
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2232
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3884
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:2616
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3556
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1996
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4872
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4060
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3472
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3608
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:1956
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1852
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1708
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3580
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:860
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:1072
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2296
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:2460
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3516
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:1796
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3972
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1012
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3052
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3896
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4648
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3368
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2572
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:4492
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:5100
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4288
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3560
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3216
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3068
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4092
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2084
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:1184

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\ProgramData\defender.exe

                                                                                              Filesize

                                                                                              863KB

                                                                                              MD5

                                                                                              9162e03de49e577ace655d03521082c1

                                                                                              SHA1

                                                                                              b22f0f0262bc5781743a6d815943d596ce9abc0d

                                                                                              SHA256

                                                                                              854b68869d1967f6bc0a7876f34ef109eb7fa239fb57f682ead0291ced5a0b38

                                                                                              SHA512

                                                                                              03c6c77ecd5c251b853b9c6ed35a12a12df84a72ab321cd6c707b11d42abb222b519b3a8c93f23d610710a51952d418638907ea982cd30c0f64f7af4cc25e9a5

                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                              Filesize

                                                                                              471B

                                                                                              MD5

                                                                                              072f978cb84c37b419213bcc52de75f9

                                                                                              SHA1

                                                                                              e262f22d9c7534f47cba0881d2998a2c38054af3

                                                                                              SHA256

                                                                                              ced78fa743965d60321bcf823fbd357bb6214c71bc927ec9e2ae58b31373994c

                                                                                              SHA512

                                                                                              00085b74bcd14dc8f81a58d55846954f307825b9509d2b7d3aba7b614974428e3dd80c6bed016c4fcf3d959b0c4be8810abe5822f92c639f33ac93b6091706a5

                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                              Filesize

                                                                                              412B

                                                                                              MD5

                                                                                              64c789b3907d9b300c4ae4fd0ef55b73

                                                                                              SHA1

                                                                                              c8aa9e2e89df41260f87b414b3e1833f098c22f7

                                                                                              SHA256

                                                                                              bd3580422c4faa3c6dd0f985a5a9a3aceebde95421ec628d292645d95e70f0bf

                                                                                              SHA512

                                                                                              966ef55c377a8eb9403c95b1183748f4c07b70d7a51108445bf4efbce00d056470089065af12fe1e856dce4f391de03f29dbb86361c18db33d337de849a7795b

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                                              Filesize

                                                                                              1022B

                                                                                              MD5

                                                                                              7b5058e4550fa36515c5abb454ba8a4b

                                                                                              SHA1

                                                                                              fb6f6d9acbe9dd98af89d4f52d305fc3b951201b

                                                                                              SHA256

                                                                                              031e1533a094b24157d505d6907a1ede907247faa8d7d4b8570d111fb3c1417f

                                                                                              SHA512

                                                                                              1fc9e878a24d4f73ca058daeb7962ff211017104752846336aadcc960df36b3d0fa169485205db41a13175153f844dfdff9c27106461c431b0ea9a70e5384c51

                                                                                            • C:\Users\Public\Desktop\Malware Protection.lnk

                                                                                              Filesize

                                                                                              679B

                                                                                              MD5

                                                                                              64fd95d6af00b7a29b145e52b4f45487

                                                                                              SHA1

                                                                                              1d8ea41d3fc5c65a76c1fd9458ec0db93df819f3

                                                                                              SHA256

                                                                                              ef8f82581ecd76357892c89f724909ca3ac30c6b14762006f8e2dff792f410d1

                                                                                              SHA512

                                                                                              c2f0718a0430c242e70340b8a991df0a3e30c9cce944cc1968a71f7df2aadf00ad505af96b118bf07830e912b8a4ef60c7f480721fec08ae57f55008628fa110

                                                                                            • memory/508-32-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-49-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-16-0x0000000001030000-0x0000000001040000-memory.dmp

                                                                                              Filesize

                                                                                              64KB

                                                                                            • memory/508-17-0x0000000001030000-0x0000000001040000-memory.dmp

                                                                                              Filesize

                                                                                              64KB

                                                                                            • memory/508-18-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-20-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-21-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-22-0x0000000001020000-0x0000000001021000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                            • memory/508-23-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-58-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-25-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-57-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-33-0x0000000001030000-0x0000000001040000-memory.dmp

                                                                                              Filesize

                                                                                              64KB

                                                                                            • memory/508-56-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-55-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-54-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-53-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-40-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-45-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-46-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-47-0x0000000001020000-0x0000000001021000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                            • memory/508-48-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-15-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-50-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-51-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/508-52-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                              Filesize

                                                                                              6.1MB

                                                                                            • memory/1812-1-0x0000000002550000-0x0000000002560000-memory.dmp

                                                                                              Filesize

                                                                                              64KB

                                                                                            • memory/1812-2-0x0000000002550000-0x0000000002560000-memory.dmp

                                                                                              Filesize

                                                                                              64KB

                                                                                            • memory/1812-3-0x0000000000400000-0x00000000006DE000-memory.dmp

                                                                                              Filesize

                                                                                              2.9MB

                                                                                            • memory/1812-0-0x0000000000400000-0x00000000006DE000-memory.dmp

                                                                                              Filesize

                                                                                              2.9MB

                                                                                            • memory/1812-8-0x0000000000400000-0x00000000006DE000-memory.dmp

                                                                                              Filesize

                                                                                              2.9MB

                                                                                            • memory/3692-31-0x0000000004030000-0x0000000004031000-memory.dmp

                                                                                              Filesize

                                                                                              4KB