Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-11-2020 17:47
Static task
static1
Behavioral task
behavioral1
Sample
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe
Resource
win10v20201028
General
-
Target
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe
-
Size
266KB
-
MD5
ffc54622e9daa09c0726b5694167c61b
-
SHA1
000b2b6115dc37258f2dc55106c57fbf298644af
-
SHA256
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514
-
SHA512
64f6218a73c173481a828c81e98c85818934db85f408330ae70207f16359a9f0ea40adc2d3a53a22174e9da6f864727ae01db1225e6816e70910ba595e7a5cff
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2016 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exepid process 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeSecurityPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeTakeOwnershipPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeLoadDriverPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeSystemProfilePrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeSystemtimePrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeProfSingleProcessPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeIncBasePriorityPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeCreatePagefilePrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeBackupPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeRestorePrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeShutdownPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeDebugPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeSystemEnvironmentPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeChangeNotifyPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeRemoteShutdownPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeUndockPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeManageVolumePrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeImpersonatePrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeCreateGlobalPrivilege 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: 33 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: 34 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: 35 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe Token: SeIncreaseQuotaPrivilege 2016 msdcsc.exe Token: SeSecurityPrivilege 2016 msdcsc.exe Token: SeTakeOwnershipPrivilege 2016 msdcsc.exe Token: SeLoadDriverPrivilege 2016 msdcsc.exe Token: SeSystemProfilePrivilege 2016 msdcsc.exe Token: SeSystemtimePrivilege 2016 msdcsc.exe Token: SeProfSingleProcessPrivilege 2016 msdcsc.exe Token: SeIncBasePriorityPrivilege 2016 msdcsc.exe Token: SeCreatePagefilePrivilege 2016 msdcsc.exe Token: SeBackupPrivilege 2016 msdcsc.exe Token: SeRestorePrivilege 2016 msdcsc.exe Token: SeShutdownPrivilege 2016 msdcsc.exe Token: SeDebugPrivilege 2016 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2016 msdcsc.exe Token: SeChangeNotifyPrivilege 2016 msdcsc.exe Token: SeRemoteShutdownPrivilege 2016 msdcsc.exe Token: SeUndockPrivilege 2016 msdcsc.exe Token: SeManageVolumePrivilege 2016 msdcsc.exe Token: SeImpersonatePrivilege 2016 msdcsc.exe Token: SeCreateGlobalPrivilege 2016 msdcsc.exe Token: 33 2016 msdcsc.exe Token: 34 2016 msdcsc.exe Token: 35 2016 msdcsc.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.execmd.exemsdcsc.exedescription pid process target process PID 336 wrote to memory of 1840 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe cmd.exe PID 336 wrote to memory of 1840 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe cmd.exe PID 336 wrote to memory of 1840 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe cmd.exe PID 336 wrote to memory of 1840 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe cmd.exe PID 1840 wrote to memory of 1996 1840 cmd.exe attrib.exe PID 1840 wrote to memory of 1996 1840 cmd.exe attrib.exe PID 1840 wrote to memory of 1996 1840 cmd.exe attrib.exe PID 1840 wrote to memory of 1996 1840 cmd.exe attrib.exe PID 336 wrote to memory of 2016 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe msdcsc.exe PID 336 wrote to memory of 2016 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe msdcsc.exe PID 336 wrote to memory of 2016 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe msdcsc.exe PID 336 wrote to memory of 2016 336 f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe msdcsc.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe PID 2016 wrote to memory of 1960 2016 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe"C:\Users\Admin\AppData\Local\Temp\f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
ffc54622e9daa09c0726b5694167c61b
SHA1000b2b6115dc37258f2dc55106c57fbf298644af
SHA256f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514
SHA51264f6218a73c173481a828c81e98c85818934db85f408330ae70207f16359a9f0ea40adc2d3a53a22174e9da6f864727ae01db1225e6816e70910ba595e7a5cff
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
ffc54622e9daa09c0726b5694167c61b
SHA1000b2b6115dc37258f2dc55106c57fbf298644af
SHA256f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514
SHA51264f6218a73c173481a828c81e98c85818934db85f408330ae70207f16359a9f0ea40adc2d3a53a22174e9da6f864727ae01db1225e6816e70910ba595e7a5cff
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
ffc54622e9daa09c0726b5694167c61b
SHA1000b2b6115dc37258f2dc55106c57fbf298644af
SHA256f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514
SHA51264f6218a73c173481a828c81e98c85818934db85f408330ae70207f16359a9f0ea40adc2d3a53a22174e9da6f864727ae01db1225e6816e70910ba595e7a5cff
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
ffc54622e9daa09c0726b5694167c61b
SHA1000b2b6115dc37258f2dc55106c57fbf298644af
SHA256f59392bc9a917137068cdc81dc75a2a749b081ea0ecdc1ce8103b57fa0328514
SHA51264f6218a73c173481a828c81e98c85818934db85f408330ae70207f16359a9f0ea40adc2d3a53a22174e9da6f864727ae01db1225e6816e70910ba595e7a5cff
-
memory/1840-0-0x0000000000000000-mapping.dmp
-
memory/1960-7-0x0000000000000000-mapping.dmp
-
memory/1960-9-0x0000000000000000-mapping.dmp
-
memory/1960-8-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/1996-1-0x0000000000000000-mapping.dmp
-
memory/2016-4-0x0000000000000000-mapping.dmp