Analysis
-
max time kernel
16s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:57
Static task
static1
Behavioral task
behavioral1
Sample
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe
Resource
win10v20201028
General
-
Target
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe
-
Size
318KB
-
MD5
c43368f068d979fcbbd9743b0bf4a437
-
SHA1
e2fb960a64aae3ee04a6f1afea112b200b278ba5
-
SHA256
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705
-
SHA512
05d04ec65a4bd9eec461ac77be10e0fe222b182cfe3711f9472e03ced12ca3f046a1db8dce28dd1678c52230d0f57a1390612e10736f1ec0c5ba9ac270d00ce6
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe" 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe" 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exedescription pid process Token: SeIncreaseQuotaPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeSecurityPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeTakeOwnershipPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeLoadDriverPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeSystemProfilePrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeSystemtimePrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeProfSingleProcessPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeIncBasePriorityPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeCreatePagefilePrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeBackupPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeRestorePrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeShutdownPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeDebugPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeSystemEnvironmentPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeChangeNotifyPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeRemoteShutdownPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeUndockPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeManageVolumePrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeImpersonatePrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: SeCreateGlobalPrivilege 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: 33 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: 34 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: 35 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe Token: 36 656 7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe"C:\Users\Admin\AppData\Local\Temp\7a1ca101230d4fa5aea914f6a5ac79b7fe3ccb327a616dfd3bb373579a023705.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken