Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-11-2020 17:49
Static task
static1
Behavioral task
behavioral1
Sample
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe
Resource
win10v20201028
General
-
Target
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe
-
Size
232KB
-
MD5
0d6a427091daa2586927f20761f4d620
-
SHA1
816a5c6adf8d9fa6bed7ec862d7082cdcb1c2133
-
SHA256
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6
-
SHA512
050597152b50836d465a81dfbf3dd6ab2bcf1d8657ecea425d9888da7304b8f632ab3c8220435538108da7bbab31e71cc9ab3530ab4c073d4b515cdbf84a51de
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe -
Executes dropped EXE 1 IoCs
Processes:
IMDCSC.exepid process 1412 IMDCSC.exe -
Processes:
resource yara_rule \Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx \Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx -
Loads dropped DLL 2 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exepid process 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\SS = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exeIMDCSC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeSecurityPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeTakeOwnershipPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeLoadDriverPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeSystemProfilePrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeSystemtimePrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeProfSingleProcessPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeIncBasePriorityPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeCreatePagefilePrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeBackupPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeRestorePrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeShutdownPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeDebugPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeSystemEnvironmentPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeChangeNotifyPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeRemoteShutdownPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeUndockPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeManageVolumePrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeImpersonatePrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeCreateGlobalPrivilege 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: 33 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: 34 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: 35 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeIncreaseQuotaPrivilege 1412 IMDCSC.exe Token: SeSecurityPrivilege 1412 IMDCSC.exe Token: SeTakeOwnershipPrivilege 1412 IMDCSC.exe Token: SeLoadDriverPrivilege 1412 IMDCSC.exe Token: SeSystemProfilePrivilege 1412 IMDCSC.exe Token: SeSystemtimePrivilege 1412 IMDCSC.exe Token: SeProfSingleProcessPrivilege 1412 IMDCSC.exe Token: SeIncBasePriorityPrivilege 1412 IMDCSC.exe Token: SeCreatePagefilePrivilege 1412 IMDCSC.exe Token: SeBackupPrivilege 1412 IMDCSC.exe Token: SeRestorePrivilege 1412 IMDCSC.exe Token: SeShutdownPrivilege 1412 IMDCSC.exe Token: SeDebugPrivilege 1412 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 1412 IMDCSC.exe Token: SeChangeNotifyPrivilege 1412 IMDCSC.exe Token: SeRemoteShutdownPrivilege 1412 IMDCSC.exe Token: SeUndockPrivilege 1412 IMDCSC.exe Token: SeManageVolumePrivilege 1412 IMDCSC.exe Token: SeImpersonatePrivilege 1412 IMDCSC.exe Token: SeCreateGlobalPrivilege 1412 IMDCSC.exe Token: 33 1412 IMDCSC.exe Token: 34 1412 IMDCSC.exe Token: 35 1412 IMDCSC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
IMDCSC.exepid process 1412 IMDCSC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exedescription pid process target process PID 1980 wrote to memory of 1412 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe IMDCSC.exe PID 1980 wrote to memory of 1412 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe IMDCSC.exe PID 1980 wrote to memory of 1412 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe IMDCSC.exe PID 1980 wrote to memory of 1412 1980 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe IMDCSC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe"C:\Users\Admin\AppData\Local\Temp\7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
0d6a427091daa2586927f20761f4d620
SHA1816a5c6adf8d9fa6bed7ec862d7082cdcb1c2133
SHA2567395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6
SHA512050597152b50836d465a81dfbf3dd6ab2bcf1d8657ecea425d9888da7304b8f632ab3c8220435538108da7bbab31e71cc9ab3530ab4c073d4b515cdbf84a51de
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
0d6a427091daa2586927f20761f4d620
SHA1816a5c6adf8d9fa6bed7ec862d7082cdcb1c2133
SHA2567395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6
SHA512050597152b50836d465a81dfbf3dd6ab2bcf1d8657ecea425d9888da7304b8f632ab3c8220435538108da7bbab31e71cc9ab3530ab4c073d4b515cdbf84a51de
-
\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
0d6a427091daa2586927f20761f4d620
SHA1816a5c6adf8d9fa6bed7ec862d7082cdcb1c2133
SHA2567395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6
SHA512050597152b50836d465a81dfbf3dd6ab2bcf1d8657ecea425d9888da7304b8f632ab3c8220435538108da7bbab31e71cc9ab3530ab4c073d4b515cdbf84a51de
-
\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
0d6a427091daa2586927f20761f4d620
SHA1816a5c6adf8d9fa6bed7ec862d7082cdcb1c2133
SHA2567395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6
SHA512050597152b50836d465a81dfbf3dd6ab2bcf1d8657ecea425d9888da7304b8f632ab3c8220435538108da7bbab31e71cc9ab3530ab4c073d4b515cdbf84a51de
-
memory/1412-2-0x0000000000000000-mapping.dmp