Analysis
- max time kernel
150s - max time network
117s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe
- Size 3.1MB
- Sample200624-e2tb6ewgvj
- SHA256 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e
- MD5 48333dea99d9a2a7efe07b871e9e5467
- SHA1 85138443ba28a0932305454832e1f809585471ab
- SHA512 a7806de37c27afea682b4054c3caf1aafb94f858d7a7467efcf9e795484041391dd17941376e05118b4be726fc06beddedddc3f6fc6d5ab4b31c039fadf44ff0
- MD5 SHA1 SHA512
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Executes dropped EXE 2 IoCs
pid Process 2560 MAIN.EXE 2300 msdcsc.exe -
resource yara_rule behavioral2/files/0x000200000001ad89-5.dat vmprotect behavioral2/files/0x000200000001ad89-6.dat vmprotect - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion msdcsc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion msdcsc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\International\Geo\Nation 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Wine msdcsc.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Wine 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 2300 msdcsc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 2300 msdcsc.exe 2300 msdcsc.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeSecurityPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeTakeOwnershipPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeLoadDriverPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeSystemProfilePrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeSystemtimePrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeProfSingleProcessPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeIncBasePriorityPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeCreatePagefilePrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeBackupPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeRestorePrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeShutdownPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeDebugPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeSystemEnvironmentPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeChangeNotifyPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeRemoteShutdownPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeUndockPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeManageVolumePrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeImpersonatePrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeCreateGlobalPrivilege 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: 33 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: 34 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: 35 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: 36 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe Token: SeIncreaseQuotaPrivilege 2300 msdcsc.exe Token: SeSecurityPrivilege 2300 msdcsc.exe Token: SeTakeOwnershipPrivilege 2300 msdcsc.exe Token: SeLoadDriverPrivilege 2300 msdcsc.exe Token: SeSystemProfilePrivilege 2300 msdcsc.exe Token: SeSystemtimePrivilege 2300 msdcsc.exe Token: SeProfSingleProcessPrivilege 2300 msdcsc.exe Token: SeIncBasePriorityPrivilege 2300 msdcsc.exe Token: SeCreatePagefilePrivilege 2300 msdcsc.exe Token: SeBackupPrivilege 2300 msdcsc.exe Token: SeRestorePrivilege 2300 msdcsc.exe Token: SeShutdownPrivilege 2300 msdcsc.exe Token: SeDebugPrivilege 2300 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2300 msdcsc.exe Token: SeChangeNotifyPrivilege 2300 msdcsc.exe Token: SeRemoteShutdownPrivilege 2300 msdcsc.exe Token: SeUndockPrivilege 2300 msdcsc.exe Token: SeManageVolumePrivilege 2300 msdcsc.exe Token: SeImpersonatePrivilege 2300 msdcsc.exe Token: SeCreateGlobalPrivilege 2300 msdcsc.exe Token: 33 2300 msdcsc.exe Token: 34 2300 msdcsc.exe Token: 35 2300 msdcsc.exe Token: 36 2300 msdcsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2300 msdcsc.exe - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 344 wrote to memory of 3496 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 67 PID 344 wrote to memory of 3496 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 67 PID 344 wrote to memory of 3496 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 67 PID 344 wrote to memory of 3616 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 68 PID 344 wrote to memory of 3616 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 68 PID 344 wrote to memory of 3616 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 68 PID 344 wrote to memory of 2560 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 71 PID 344 wrote to memory of 2560 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 71 PID 344 wrote to memory of 2560 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 71 PID 3496 wrote to memory of 760 3496 cmd.exe 72 PID 3496 wrote to memory of 760 3496 cmd.exe 72 PID 3496 wrote to memory of 760 3496 cmd.exe 72 PID 3616 wrote to memory of 2552 3616 cmd.exe 73 PID 3616 wrote to memory of 2552 3616 cmd.exe 73 PID 3616 wrote to memory of 2552 3616 cmd.exe 73 PID 344 wrote to memory of 2300 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 74 PID 344 wrote to memory of 2300 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 74 PID 344 wrote to memory of 2300 344 2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe 74 PID 2300 wrote to memory of 3828 2300 msdcsc.exe 75 PID 2300 wrote to memory of 3828 2300 msdcsc.exe 75 PID 2300 wrote to memory of 3828 2300 msdcsc.exe 75 PID 2300 wrote to memory of 3768 2300 msdcsc.exe 76 PID 2300 wrote to memory of 3768 2300 msdcsc.exe 76 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 PID 2300 wrote to memory of 820 2300 msdcsc.exe 77 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2552 attrib.exe 760 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe"C:\Users\Admin\AppData\Local\Temp\2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e.exe" +s +h3⤵
- Views/modifies file attributes
PID:760
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
PID:2552
-
-
-
C:\Users\Admin\AppData\Local\Temp\MAIN.EXE"C:\Users\Admin\AppData\Local\Temp\MAIN.EXE"2⤵
- Executes dropped EXE
PID:2560
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:3828
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:3768
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:820
-
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
2Virtualization/Sandbox Evasion
2