82159051dac9a2382c3a9f1ca0408a5e0db9b2f934715f66b7e530cff4272cfc

Analysis

max time kernel
65s
max time network
67s
platform
windows10_x64
resource
win10v200430
submitted
29-05-2020 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DWRCS.EXE
Size

220KB
MD5

32f228a0e4956acd461f651d8d8c6e8a
SHA1

d24a38f5a86c302c48c8443e0435688235769334
SHA256

82159051dac9a2382c3a9f1ca0408a5e0db9b2f934715f66b7e530cff4272cfc
SHA512

133a7c62bb06e0f40cbc8efee2e79e4cd7488c439bff0005f46d132a1c805af1bb9d48a198b174bc6c6722ce502da0e199ae376cf3a55d92543d51fe9e07af14

Score

5^/10

persistence

Malware Config

Signatures

Modifies service 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

DWRCS.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\DWMRCS\TypesSupported = "31"	DWRCS.EXE
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\DWMRCS	DWRCS.EXE
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\DWMRCS\EventMessageFile = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DWRCS.EXE"	DWRCS.EXE

Drops file in System32 directory 2 IoCs

Processes:

DWRCS.EXE

description ioc process

File created C:\Windows\SysWOW64\DWRCS.exe DWRCS.EXE
File opened for modification C:\Windows\SysWOW64\DWRCS.exe DWRCS.EXE

description	ioc	process
File created	C:\Windows\SysWOW64\DWRCS.exe	DWRCS.EXE
File opened for modification	C:\Windows\SysWOW64\DWRCS.exe	DWRCS.EXE

C:\Users\Admin\AppData\Local\Temp\DWRCS.EXE
"C:\Users\Admin\AppData\Local\Temp\DWRCS.EXE"
1⤵
- Modifies service
- Drops file in System32 directory
PID:2564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads