LetsDefend - EventID 36 - SOC 104 - Malware Detected

Created: 10/01/2024 13:58 Last Updated: 05/03/2024 10:57

EventID : 36 Event Time : Dec, 01, 2020, 10:23 AM Rule : SOC104 - Malware Detected Level : Security Analyst Source Address : 10.15.15.18 Source Hostname : AdamPRD File Name : Invoice.exe File Hash : f83fb9ce6a83da58b20685c1d7e1e546 File Size : 473.00 KB Device Action : Allowed File (Password:infected) : Download

Table of Contents

• Start Playbook!
  • Define Threat Indicator
  • Check if the malware is quarantined/cleaned
  • Analyze Malware
  • Check If Someone Requested the C2
  • Containment
  • Add Artifacts
  • Analyst Note
• Close Alert

Start Playbook!

Define Threat Indicator

Other

Check if the malware is quarantined/cleaned

Look at the alert details, it clearly says Device Action is allowed so it still there on the endpoint even if I didn't see any process running

Not Quarantined

Analyze Malware

Let's start by searching with hash in VirusTotal

Now this is a hugh red flag right here, most of security vendors flagged this file as malware and it's kind of ransomware called Maze ransomware and by knowing what kind of malware it is, it make an investigation a lot easier

In Behavior tab, we can see how this ransomware doing it jobs with MITRE ATT&CK Tactics and Techniques

We can see that this ransomware can 1. Checks if any antivirus program is installed. 2. Enumerates the file system. 3. Encrypt data. 4. Stores files to the Windows startup directory. 5. Tries to harvest and steal browser information. 6. Creates a DirectInput object. (often for capturing ketstrokes) 7. Opens, set and deletes some registry keys. 8. Queries a list of all running processes. 9. Queries the cryptographic machine GUID. 10. Posts data to webserver. 11. Download files. 12. Write ransom notes to many directories.

And there are a bunch of HTTP POST requests it tries to communicate to probably C2 servers

Now let's investigate with hybrid analysis and compare the result to VirusTotal so after that we can form a conclusion.

In the Incident Response section, We can see additional information that we missed from VirusTotal result

This file also deletes volumn snapshots, read active computer name and broadcast ARP request so it can spread to other system as well.

So this is indeed

Malicious

Check If Someone Requested the C2

In Log Management, We found that there is a communication between host and C2 server so i answered this question as

Accessed

Containment

Add Artifacts

10.15.15.18 : Host Address
http://92.63.8.47/ : C2 Address
http://92.63.8.47/ : C2 URL Address
f83fb9ce6a83da58b20685c1d7e1e546 : MD5 hash of ransomware

Analyst Note

Hosted was infected by a Maze ransomware, C2 address was detected and confirmed that host has already reached that server with HTTP POST request.
This ransomware has many capabilities including network (ARP) detection and can also lead to spread to other systems within the same network. 
Host Containment is confirmed upon this investigation.

Close Alert