4eaeeda72c1352264f13d2ceea4d43306d5f175f0d3c37979f9fb0fd60c553ee

Analysis

max time kernel
451s
max time network
1175s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
12/05/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MalwareRepository-main/Deathy.exe
Size 5.2MB
Sample240512-jtkd2aag78
SHA256 9dfe8b68cc53019040dfccd870b7147365e651b3ff30e378afcc961b6ba800d7
MD5 9d4e2c467fa1a33d2c95e53935dbdbdc
SHA1 966da6cc8c86a736dffd53571dbad44092c0588e
SHA512 5d833c0e2c6c93ab19f569bdede2d71a3b64c87c46f279534387dce0da4fda3795ae99e251ef0b2316975edf11841ca12f88f443102cfeb0d34704ee0d22cfe1
SSDEEP 98304:8bIzbys7/Coyxnl5tTOT/SOiZbBOgWxkXzT5oXFvx1xq7RB3:85s7/C9nl54/SjcgWxkjT5+FEtB3
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2332	updater.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\deathy\\updater.exe"	updater.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	updater.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\deathy\\Wallpaper.png"	reg.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\deathy\updater.exe	Deathy.exe
File created	C:\Windows\deathy\b.vbs	Deathy.exe
File created	C:\Windows\deathy\c.vbs	Deathy.exe
File opened for modification	C:\Windows\deathy\c.vbs	Deathy.exe
File created	C:\Windows\deathy\Wallpaper.png	Deathy.exe
File created	C:\Windows\deathy\core.bat	Deathy.exe
File opened for modification	C:\Windows\deathy\a.vbs	Deathy.exe
File opened for modification	C:\Windows\deathy	Deathy.exe
File created	C:\Windows\deathy\note.txt	Deathy.exe
File opened for modification	C:\Windows\deathy\note.txt	Deathy.exe
File opened for modification	C:\Windows\deathy\updater.exe	Deathy.exe
File opened for modification	C:\Windows\deathy\b.vbs	Deathy.exe
File opened for modification	C:\Windows\deathy\musik.mp3	Deathy.exe
File created	C:\Windows\deathy\__tmp_rar_sfx_access_check_240596203	Deathy.exe
File opened for modification	C:\Windows\deathy\core.bat	Deathy.exe
File created	C:\Windows\deathy\a.vbs	Deathy.exe
File created	C:\Windows\deathy\musik.mp3	Deathy.exe
File opened for modification	C:\Windows\deathy\Wallpaper.png	Deathy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4948	schtasks.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2988	notepad.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3312	3288	Deathy.exe	77
PID 3288 wrote to memory of 3312	3288	Deathy.exe	77
PID 3288 wrote to memory of 3312	3288	Deathy.exe	77
PID 3312 wrote to memory of 2332	3312	cmd.exe	81
PID 3312 wrote to memory of 2332	3312	cmd.exe	81
PID 3312 wrote to memory of 2332	3312	cmd.exe	81
PID 3312 wrote to memory of 1188	3312	cmd.exe	82
PID 3312 wrote to memory of 1188	3312	cmd.exe	82
PID 3312 wrote to memory of 1188	3312	cmd.exe	82
PID 2332 wrote to memory of 4948	2332	updater.exe	83
PID 2332 wrote to memory of 4948	2332	updater.exe	83
PID 2332 wrote to memory of 4948	2332	updater.exe	83
PID 3312 wrote to memory of 3952	3312	cmd.exe	85
PID 3312 wrote to memory of 3952	3312	cmd.exe	85
PID 3312 wrote to memory of 3952	3312	cmd.exe	85
PID 3312 wrote to memory of 2988	3312	cmd.exe	86
PID 3312 wrote to memory of 2988	3312	cmd.exe	86
PID 3312 wrote to memory of 2988	3312	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\Deathy.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\Deathy.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\deathy\core.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\deathy\updater.exe
    updater.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\deathy\updater.exe"
      4⤵
      Creates scheduled task(s)
      PID:4948
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Windows\deathy\Wallpaper.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:3952
- - C:\Windows\SysWOW64\notepad.exe
    notepad C:\Windows\deathy\note.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

core.bat

Path C:\Windows\deathy\core.bat
Size 551B
SHA256 cb1a556502896c4e6a6170b745c10feff90ba833e5ac57cb8298c92d2284da12
MD5 9af3d7425c9e416f2f9973ede3873925
SHA1 31ff1f0fc46704bd7397c9f19f36d5c1e3affee0
SHA512 8835c982445ecf5f20b324005f3f7cde8144b0db5af8abf15b58efecad0c094ca47aae5fddadc48466be7be4229064bd3245f429535bdffe00f63ce3f93bad1d
MD5 SHA1 SHA512

Submit Download

note.txt

Path C:\Windows\deathy\note.txt
Size 485B
SHA256 8fd81f82aab056deb1347e5cfce3a8d2ef0090cd97e01f8c9354255a515448e3
MD5 fa358c1b12b1d932387ac6b0e4a1f039
SHA1 45df86639e4190095939460689d8313a000c03be
SHA512 8fe7a256a7c9195b4b1fedc73ddc0decfa2993aaa946189580cdc8bc109ec8b7400b626ba880efee6f2ba47d7b41b5901b4d82d8e0b6e968d6776d9e1d6073b6
MD5 SHA1 SHA512

Submit Download

updater.exe

Path C:\Windows\deathy\updater.exe
Size 150KB
SHA256 59f4d7abefbe4eae5744464d960858a685723a37de9966ef5bc6eb713bb564f3
MD5 d597d455ca056740a1fe6d39518099e9
SHA1 9025bca9cde864464946b7d92bf3bbec4c93d2df
SHA512 cdf8c6f38653e9ab17b70f7e91d8b868c8d84c47902443f2157805b64bb1e6f39fcbd86a2972f27cd4a3acee29f99cba92526839e0c56e25cf6f6b2423bea99d
SSDEEP 3072:1JVD1zx0HrJvtuKm8wVKQ3+nBgBDUQID3RjfpiYyiTWNLkkk9:jWFvSH5UQ+hjfkYyuW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2332-22-0x0000000000400000-0x000000000043B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads