Analysis
- max time kernel
150s - max time network
140s - platform
windows7_x64 - resource
win7v20201028 - submitted
11/11/2020, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe
- Size 251KB
- Sample201111-dhrdwd18ba
- SHA256 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3
- MD5 0fb89311917a7c35fe6a9937df19c35d
- SHA1 09b8dfad8d91e6127795b6a143bf1802609d7900
- SHA512 f0e1c75a56d8b1b5cf33151ccdf7c6d7eaf5bc281e16c20b0f55a9dc847b2fa02a6ff6f990dff7bd534eac78b5957fe241254f40b4287df9bf676baf8de4805c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\msdcsc.exe" e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe - Executes dropped EXE 1 IoCs
pid Process 2020 msdcsc.exe -
resource yara_rule behavioral1/files/0x00040000000130e0-0.dat upx behavioral1/files/0x00040000000130e0-1.dat upx behavioral1/files/0x00040000000130e0-3.dat upx behavioral1/files/0x00040000000130e0-4.dat upx - Loads dropped DLL 2 IoCs
pid Process 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msdcsc.exe" e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeSecurityPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeTakeOwnershipPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeLoadDriverPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeSystemProfilePrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeSystemtimePrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeProfSingleProcessPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeIncBasePriorityPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeCreatePagefilePrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeBackupPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeRestorePrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeShutdownPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeDebugPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeSystemEnvironmentPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeChangeNotifyPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeRemoteShutdownPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeUndockPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeManageVolumePrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeImpersonatePrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeCreateGlobalPrivilege 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: 33 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: 34 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: 35 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeIncreaseQuotaPrivilege 2020 msdcsc.exe Token: SeSecurityPrivilege 2020 msdcsc.exe Token: SeTakeOwnershipPrivilege 2020 msdcsc.exe Token: SeLoadDriverPrivilege 2020 msdcsc.exe Token: SeSystemProfilePrivilege 2020 msdcsc.exe Token: SeSystemtimePrivilege 2020 msdcsc.exe Token: SeProfSingleProcessPrivilege 2020 msdcsc.exe Token: SeIncBasePriorityPrivilege 2020 msdcsc.exe Token: SeCreatePagefilePrivilege 2020 msdcsc.exe Token: SeBackupPrivilege 2020 msdcsc.exe Token: SeRestorePrivilege 2020 msdcsc.exe Token: SeShutdownPrivilege 2020 msdcsc.exe Token: SeDebugPrivilege 2020 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2020 msdcsc.exe Token: SeChangeNotifyPrivilege 2020 msdcsc.exe Token: SeRemoteShutdownPrivilege 2020 msdcsc.exe Token: SeUndockPrivilege 2020 msdcsc.exe Token: SeManageVolumePrivilege 2020 msdcsc.exe Token: SeImpersonatePrivilege 2020 msdcsc.exe Token: SeCreateGlobalPrivilege 2020 msdcsc.exe Token: 33 2020 msdcsc.exe Token: 34 2020 msdcsc.exe Token: 35 2020 msdcsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2020 msdcsc.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 292 wrote to memory of 2020 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe 26 PID 292 wrote to memory of 2020 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe 26 PID 292 wrote to memory of 2020 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe 26 PID 292 wrote to memory of 2020 292 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe 26 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27 PID 2020 wrote to memory of 1980 2020 msdcsc.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe"C:\Users\Admin\AppData\Local\Temp\e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1980
-
-