Analysis
-
max time kernel
151s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 17:49
Static task
static1
Behavioral task
behavioral1
Sample
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe
Resource
win10v20201028
General
-
Target
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe
-
Size
232KB
-
MD5
0d6a427091daa2586927f20761f4d620
-
SHA1
816a5c6adf8d9fa6bed7ec862d7082cdcb1c2133
-
SHA256
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6
-
SHA512
050597152b50836d465a81dfbf3dd6ab2bcf1d8657ecea425d9888da7304b8f632ab3c8220435538108da7bbab31e71cc9ab3530ab4c073d4b515cdbf84a51de
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe -
Executes dropped EXE 1 IoCs
Processes:
IMDCSC.exepid process 3584 IMDCSC.exe -
Processes:
resource yara_rule C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\SS = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exeIMDCSC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeSecurityPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeTakeOwnershipPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeLoadDriverPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeSystemProfilePrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeSystemtimePrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeProfSingleProcessPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeIncBasePriorityPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeCreatePagefilePrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeBackupPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeRestorePrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeShutdownPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeDebugPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeSystemEnvironmentPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeChangeNotifyPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeRemoteShutdownPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeUndockPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeManageVolumePrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeImpersonatePrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeCreateGlobalPrivilege 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: 33 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: 34 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: 35 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: 36 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe Token: SeIncreaseQuotaPrivilege 3584 IMDCSC.exe Token: SeSecurityPrivilege 3584 IMDCSC.exe Token: SeTakeOwnershipPrivilege 3584 IMDCSC.exe Token: SeLoadDriverPrivilege 3584 IMDCSC.exe Token: SeSystemProfilePrivilege 3584 IMDCSC.exe Token: SeSystemtimePrivilege 3584 IMDCSC.exe Token: SeProfSingleProcessPrivilege 3584 IMDCSC.exe Token: SeIncBasePriorityPrivilege 3584 IMDCSC.exe Token: SeCreatePagefilePrivilege 3584 IMDCSC.exe Token: SeBackupPrivilege 3584 IMDCSC.exe Token: SeRestorePrivilege 3584 IMDCSC.exe Token: SeShutdownPrivilege 3584 IMDCSC.exe Token: SeDebugPrivilege 3584 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 3584 IMDCSC.exe Token: SeChangeNotifyPrivilege 3584 IMDCSC.exe Token: SeRemoteShutdownPrivilege 3584 IMDCSC.exe Token: SeUndockPrivilege 3584 IMDCSC.exe Token: SeManageVolumePrivilege 3584 IMDCSC.exe Token: SeImpersonatePrivilege 3584 IMDCSC.exe Token: SeCreateGlobalPrivilege 3584 IMDCSC.exe Token: 33 3584 IMDCSC.exe Token: 34 3584 IMDCSC.exe Token: 35 3584 IMDCSC.exe Token: 36 3584 IMDCSC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
IMDCSC.exepid process 3584 IMDCSC.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exedescription pid process target process PID 3372 wrote to memory of 3584 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe IMDCSC.exe PID 3372 wrote to memory of 3584 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe IMDCSC.exe PID 3372 wrote to memory of 3584 3372 7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe IMDCSC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe"C:\Users\Admin\AppData\Local\Temp\7395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
0d6a427091daa2586927f20761f4d620
SHA1816a5c6adf8d9fa6bed7ec862d7082cdcb1c2133
SHA2567395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6
SHA512050597152b50836d465a81dfbf3dd6ab2bcf1d8657ecea425d9888da7304b8f632ab3c8220435538108da7bbab31e71cc9ab3530ab4c073d4b515cdbf84a51de
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
0d6a427091daa2586927f20761f4d620
SHA1816a5c6adf8d9fa6bed7ec862d7082cdcb1c2133
SHA2567395e621436ad8035110faa105be92fe3155804d9c3900591605c4937e8566e6
SHA512050597152b50836d465a81dfbf3dd6ab2bcf1d8657ecea425d9888da7304b8f632ab3c8220435538108da7bbab31e71cc9ab3530ab4c073d4b515cdbf84a51de
-
memory/3584-0-0x0000000000000000-mapping.dmp