Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 17:41
Static task
static1
Behavioral task
behavioral1
Sample
62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe
Resource
win7v20201028
General
-
Target
62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe
-
Size
283KB
-
MD5
250c1edca599ee5249e355479e43cbed
-
SHA1
3bf1484a1b5cbbee4b04f97c6c6922d9a5453d3c
-
SHA256
62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6
-
SHA512
c358655cb6244abae04634451ef2d8b2fa4d7b226d4473d92eed4b05a5bbaa5c42be67e00a98edc75bea50a7468ca62b0153696ce6c789223bcbcb70d025c774
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 800 msdcsc.exe -
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 800 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeSecurityPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeTakeOwnershipPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeLoadDriverPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeSystemProfilePrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeSystemtimePrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeProfSingleProcessPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeIncBasePriorityPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeCreatePagefilePrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeBackupPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeRestorePrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeShutdownPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeDebugPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeSystemEnvironmentPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeChangeNotifyPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeRemoteShutdownPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeUndockPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeManageVolumePrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeImpersonatePrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeCreateGlobalPrivilege 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: 33 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: 34 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: 35 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: 36 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe Token: SeIncreaseQuotaPrivilege 800 msdcsc.exe Token: SeSecurityPrivilege 800 msdcsc.exe Token: SeTakeOwnershipPrivilege 800 msdcsc.exe Token: SeLoadDriverPrivilege 800 msdcsc.exe Token: SeSystemProfilePrivilege 800 msdcsc.exe Token: SeSystemtimePrivilege 800 msdcsc.exe Token: SeProfSingleProcessPrivilege 800 msdcsc.exe Token: SeIncBasePriorityPrivilege 800 msdcsc.exe Token: SeCreatePagefilePrivilege 800 msdcsc.exe Token: SeBackupPrivilege 800 msdcsc.exe Token: SeRestorePrivilege 800 msdcsc.exe Token: SeShutdownPrivilege 800 msdcsc.exe Token: SeDebugPrivilege 800 msdcsc.exe Token: SeSystemEnvironmentPrivilege 800 msdcsc.exe Token: SeChangeNotifyPrivilege 800 msdcsc.exe Token: SeRemoteShutdownPrivilege 800 msdcsc.exe Token: SeUndockPrivilege 800 msdcsc.exe Token: SeManageVolumePrivilege 800 msdcsc.exe Token: SeImpersonatePrivilege 800 msdcsc.exe Token: SeCreateGlobalPrivilege 800 msdcsc.exe Token: 33 800 msdcsc.exe Token: 34 800 msdcsc.exe Token: 35 800 msdcsc.exe Token: 36 800 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 800 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exemsdcsc.execmd.execmd.exedescription pid process target process PID 944 wrote to memory of 3356 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe cmd.exe PID 944 wrote to memory of 3356 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe cmd.exe PID 944 wrote to memory of 3356 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe cmd.exe PID 944 wrote to memory of 2912 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe cmd.exe PID 944 wrote to memory of 2912 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe cmd.exe PID 944 wrote to memory of 2912 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe cmd.exe PID 944 wrote to memory of 800 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe msdcsc.exe PID 944 wrote to memory of 800 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe msdcsc.exe PID 944 wrote to memory of 800 944 62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe msdcsc.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 800 wrote to memory of 2380 800 msdcsc.exe notepad.exe PID 3356 wrote to memory of 3520 3356 cmd.exe attrib.exe PID 3356 wrote to memory of 3520 3356 cmd.exe attrib.exe PID 3356 wrote to memory of 3520 3356 cmd.exe attrib.exe PID 2912 wrote to memory of 3508 2912 cmd.exe attrib.exe PID 2912 wrote to memory of 3508 2912 cmd.exe attrib.exe PID 2912 wrote to memory of 3508 2912 cmd.exe attrib.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3520 attrib.exe 3508 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe"C:\Users\Admin\AppData\Local\Temp\62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\62a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
250c1edca599ee5249e355479e43cbed
SHA13bf1484a1b5cbbee4b04f97c6c6922d9a5453d3c
SHA25662a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6
SHA512c358655cb6244abae04634451ef2d8b2fa4d7b226d4473d92eed4b05a5bbaa5c42be67e00a98edc75bea50a7468ca62b0153696ce6c789223bcbcb70d025c774
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
250c1edca599ee5249e355479e43cbed
SHA13bf1484a1b5cbbee4b04f97c6c6922d9a5453d3c
SHA25662a1ff600ffae28164b1012e08717a87a2ab69fa49f165204092a449201b07c6
SHA512c358655cb6244abae04634451ef2d8b2fa4d7b226d4473d92eed4b05a5bbaa5c42be67e00a98edc75bea50a7468ca62b0153696ce6c789223bcbcb70d025c774
-
memory/800-2-0x0000000000000000-mapping.dmp
-
memory/2380-5-0x0000000000000000-mapping.dmp
-
memory/2380-6-0x0000000002E30000-0x0000000002E31000-memory.dmpFilesize
4KB
-
memory/2380-7-0x0000000000000000-mapping.dmp
-
memory/2912-1-0x0000000000000000-mapping.dmp
-
memory/3356-0-0x0000000000000000-mapping.dmp
-
memory/3508-9-0x0000000000000000-mapping.dmp
-
memory/3520-8-0x0000000000000000-mapping.dmp