soc-104---malware-detected tags:

letsdefend-alert
letsdefend
letsdefend-write-up-eventid-36---soc-104---malware-detected title: ‘LetsDefend Write up EventID 36 SOC 104 Malware Detected’

LetsDefend - EventID 36 - SOC 104 - Malware Detected#

Created: 10/01/2024 13:58 Last Updated: 05/03/2024 10:57

EventID : 36 Event Time : Dec, 01, 2020, 10:23 AM Rule : SOC104 - Malware Detected Level : Security Analyst Source Address : 10.15.15.18 Source Hostname : AdamPRD File Name : Invoice.exe File Hash : f83fb9ce6a83da58b20685c1d7e1e546 File Size : 473.00 KB Device Action : Allowed File (Password) : Download

Start Playbook!#

Define Threat Indicator#

1
Other

Check if the malware is quarantined/cleaned#

Look at the alert details, it clearly says Device Action is allowed so it still there on the endpoint even if I didn’t see any process running

1
Not Quarantined

Analyze Malware#

Let’s start by searching with hash in VirusTotal

61 vendors flagged this file as malicious Popular threat label: ransomware.maze/deepscan

Now this is a hugh red flag right here, most of security vendors flagged this file as malware and it’s kind of ransomware called Maze ransomware and by knowing what kind of malware it is, it make an investigation a lot easier

In Behavior tab, we can see how this ransomware doing it jobs with MITRE ATT&CK Tactics and Techniques

We can see that this ransomware can

Checks if any antivirus program is installed.
Enumerates the file system.
Encrypt data.
Stores files to the Windows startup directory.
Tries to harvest and steal browser information.
Creates a DirectInput object. (often for capturing ketstrokes)
Opens, set and deletes some registry keys.
Queries a list of all running processes.
Queries the cryptographic machine GUID.
Posts data to webserver.
Download files.
Write ransom notes to many directories.

And there are a bunch of HTTP POST requests it tries to communicate to probably C2 servers

Now let’s investigate with hybrid analysis and compare the result to VirusTotal so after that we can form a conclusion.

This file also flagged with Malicious with Threat Score 100:100 but labeled as Trojan.Generic

In the Incident Response section, We can see additional information that we missed from VirusTotal result

This file also deletes volumn snapshots, read active computer name and broadcast ARP request so it can spread to other system as well.

So this is indeed

1
Malicious

Check If Someone Requested the C2#

In Log Management, We found that there is a communication between host and C2 server so i answered this question as

1
Accessed

Containment#

Add Artifacts#

1
10.15.15.18 : Host Address
2
http://92.63.8.47/ : C2 Address
3
http://92.63.8.47/ : C2 URL Address
4
f83fb9ce6a83da58b20685c1d7e1e546 : MD5 hash of ransomware

Analyst Note#

1
Hosted was infected by a Maze ransomware, C2 address was detected and confirmed that host has already reached that server with HTTP POST request.
2
This ransomware has many capabilities including network (ARP) detection and can also lead to spread to other systems within the same network.
3
Host Containment is confirmed upon this investigation.

Newsletter