Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:57
Static task
static1
Behavioral task
behavioral1
Sample
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe
Resource
win10v20201028
General
-
Target
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe
-
Size
318KB
-
MD5
c43368f068d979fcbbd9743b0bf4a437
-
SHA1
e2fb960a64aae3ee04a6f1afea112b200b278ba5
-
SHA256
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705
-
SHA512
05d04ec65a4bd9eec461ac77be10e0fe222b182cfe3711f9472e03ced12ca3f046a1db8dce28dd1678c52230d0f57a1390612e10736f1ec0c5ba9ac270d00ce6
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe" 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe" 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exedescription pid process Token: SeIncreaseQuotaPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeSecurityPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeTakeOwnershipPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeLoadDriverPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeSystemProfilePrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeSystemtimePrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeProfSingleProcessPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeIncBasePriorityPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeCreatePagefilePrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeBackupPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeRestorePrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeShutdownPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeDebugPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeSystemEnvironmentPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeChangeNotifyPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeRemoteShutdownPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeUndockPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeManageVolumePrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeImpersonatePrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeCreateGlobalPrivilege 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: 33 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: 34 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: 35 1704 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe"C:\Users\Admin\AppData\Local\Temp\7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken