Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-11-2020 11:11
Static task
static1
Behavioral task
behavioral1
Sample
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe
Resource
win7v20201028
General
-
Target
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe
-
Size
252KB
-
MD5
9d1f92ac5af5eff6e517e587e1e8278b
-
SHA1
732ca21d250323be7b2ef24c3c335005e839b196
-
SHA256
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608
-
SHA512
715a7cdb9f2270c447aae9df60be3a2ace48fa276da2ef09161b558b255434e74f5fb3c423b82813c1574bd37e2645ea1cea3375bb613c2b6c7064ed95478063
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1364 msdcsc.exe -
Processes:
resource yara_rule \Users\Admin\Documents\MSDCSC\msdcsc.exe upx \Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1224 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exepid process 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1364 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeSecurityPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeTakeOwnershipPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeLoadDriverPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeSystemProfilePrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeSystemtimePrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeProfSingleProcessPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeIncBasePriorityPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeCreatePagefilePrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeBackupPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeRestorePrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeShutdownPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeDebugPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeSystemEnvironmentPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeChangeNotifyPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeRemoteShutdownPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeUndockPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeManageVolumePrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeImpersonatePrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeCreateGlobalPrivilege 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: 33 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: 34 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: 35 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeIncreaseQuotaPrivilege 1364 msdcsc.exe Token: SeSecurityPrivilege 1364 msdcsc.exe Token: SeTakeOwnershipPrivilege 1364 msdcsc.exe Token: SeLoadDriverPrivilege 1364 msdcsc.exe Token: SeSystemProfilePrivilege 1364 msdcsc.exe Token: SeSystemtimePrivilege 1364 msdcsc.exe Token: SeProfSingleProcessPrivilege 1364 msdcsc.exe Token: SeIncBasePriorityPrivilege 1364 msdcsc.exe Token: SeCreatePagefilePrivilege 1364 msdcsc.exe Token: SeBackupPrivilege 1364 msdcsc.exe Token: SeRestorePrivilege 1364 msdcsc.exe Token: SeShutdownPrivilege 1364 msdcsc.exe Token: SeDebugPrivilege 1364 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1364 msdcsc.exe Token: SeChangeNotifyPrivilege 1364 msdcsc.exe Token: SeRemoteShutdownPrivilege 1364 msdcsc.exe Token: SeUndockPrivilege 1364 msdcsc.exe Token: SeManageVolumePrivilege 1364 msdcsc.exe Token: SeImpersonatePrivilege 1364 msdcsc.exe Token: SeCreateGlobalPrivilege 1364 msdcsc.exe Token: 33 1364 msdcsc.exe Token: 34 1364 msdcsc.exe Token: 35 1364 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1364 msdcsc.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exemsdcsc.exedescription pid process target process PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1224 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 1068 wrote to memory of 1364 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe msdcsc.exe PID 1068 wrote to memory of 1364 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe msdcsc.exe PID 1068 wrote to memory of 1364 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe msdcsc.exe PID 1068 wrote to memory of 1364 1068 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe msdcsc.exe PID 1364 wrote to memory of 1408 1364 msdcsc.exe iexplore.exe PID 1364 wrote to memory of 1408 1364 msdcsc.exe iexplore.exe PID 1364 wrote to memory of 1408 1364 msdcsc.exe iexplore.exe PID 1364 wrote to memory of 1408 1364 msdcsc.exe iexplore.exe PID 1364 wrote to memory of 1784 1364 msdcsc.exe explorer.exe PID 1364 wrote to memory of 1784 1364 msdcsc.exe explorer.exe PID 1364 wrote to memory of 1784 1364 msdcsc.exe explorer.exe PID 1364 wrote to memory of 1784 1364 msdcsc.exe explorer.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe PID 1364 wrote to memory of 1744 1364 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe"C:\Users\Admin\AppData\Local\Temp\c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
9d1f92ac5af5eff6e517e587e1e8278b
SHA1732ca21d250323be7b2ef24c3c335005e839b196
SHA256c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608
SHA512715a7cdb9f2270c447aae9df60be3a2ace48fa276da2ef09161b558b255434e74f5fb3c423b82813c1574bd37e2645ea1cea3375bb613c2b6c7064ed95478063
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
9d1f92ac5af5eff6e517e587e1e8278b
SHA1732ca21d250323be7b2ef24c3c335005e839b196
SHA256c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608
SHA512715a7cdb9f2270c447aae9df60be3a2ace48fa276da2ef09161b558b255434e74f5fb3c423b82813c1574bd37e2645ea1cea3375bb613c2b6c7064ed95478063
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
9d1f92ac5af5eff6e517e587e1e8278b
SHA1732ca21d250323be7b2ef24c3c335005e839b196
SHA256c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608
SHA512715a7cdb9f2270c447aae9df60be3a2ace48fa276da2ef09161b558b255434e74f5fb3c423b82813c1574bd37e2645ea1cea3375bb613c2b6c7064ed95478063
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
9d1f92ac5af5eff6e517e587e1e8278b
SHA1732ca21d250323be7b2ef24c3c335005e839b196
SHA256c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608
SHA512715a7cdb9f2270c447aae9df60be3a2ace48fa276da2ef09161b558b255434e74f5fb3c423b82813c1574bd37e2645ea1cea3375bb613c2b6c7064ed95478063
-
memory/1224-0-0x0000000000000000-mapping.dmp
-
memory/1224-1-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1224-2-0x0000000000000000-mapping.dmp
-
memory/1364-5-0x0000000000000000-mapping.dmp
-
memory/1744-8-0x0000000000000000-mapping.dmp
-
memory/1744-9-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1744-10-0x0000000000000000-mapping.dmp