Analysis
- max time kernel
150s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe
- Size 251KB
- Sample201111-dhrdwd18ba
- SHA256 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3
- MD5 0fb89311917a7c35fe6a9937df19c35d
- SHA1 09b8dfad8d91e6127795b6a143bf1802609d7900
- SHA512 f0e1c75a56d8b1b5cf33151ccdf7c6d7eaf5bc281e16c20b0f55a9dc847b2fa02a6ff6f990dff7bd534eac78b5957fe241254f40b4287df9bf676baf8de4805c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\msdcsc.exe" e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe - Executes dropped EXE 1 IoCs
pid Process 1720 msdcsc.exe -
resource yara_rule behavioral2/files/0x000800000000068f-1.dat upx behavioral2/files/0x000800000000068f-2.dat upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msdcsc.exe" e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeSecurityPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeTakeOwnershipPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeLoadDriverPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeSystemProfilePrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeSystemtimePrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeProfSingleProcessPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeIncBasePriorityPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeCreatePagefilePrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeBackupPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeRestorePrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeShutdownPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeDebugPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeSystemEnvironmentPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeChangeNotifyPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeRemoteShutdownPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeUndockPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeManageVolumePrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeImpersonatePrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeCreateGlobalPrivilege 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: 33 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: 34 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: 35 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: 36 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe Token: SeIncreaseQuotaPrivilege 1720 msdcsc.exe Token: SeSecurityPrivilege 1720 msdcsc.exe Token: SeTakeOwnershipPrivilege 1720 msdcsc.exe Token: SeLoadDriverPrivilege 1720 msdcsc.exe Token: SeSystemProfilePrivilege 1720 msdcsc.exe Token: SeSystemtimePrivilege 1720 msdcsc.exe Token: SeProfSingleProcessPrivilege 1720 msdcsc.exe Token: SeIncBasePriorityPrivilege 1720 msdcsc.exe Token: SeCreatePagefilePrivilege 1720 msdcsc.exe Token: SeBackupPrivilege 1720 msdcsc.exe Token: SeRestorePrivilege 1720 msdcsc.exe Token: SeShutdownPrivilege 1720 msdcsc.exe Token: SeDebugPrivilege 1720 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1720 msdcsc.exe Token: SeChangeNotifyPrivilege 1720 msdcsc.exe Token: SeRemoteShutdownPrivilege 1720 msdcsc.exe Token: SeUndockPrivilege 1720 msdcsc.exe Token: SeManageVolumePrivilege 1720 msdcsc.exe Token: SeImpersonatePrivilege 1720 msdcsc.exe Token: SeCreateGlobalPrivilege 1720 msdcsc.exe Token: 33 1720 msdcsc.exe Token: 34 1720 msdcsc.exe Token: 35 1720 msdcsc.exe Token: 36 1720 msdcsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1720 msdcsc.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3160 wrote to memory of 1720 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe 74 PID 3160 wrote to memory of 1720 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe 74 PID 3160 wrote to memory of 1720 3160 e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe 74 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75 PID 1720 wrote to memory of 1968 1720 msdcsc.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe"C:\Users\Admin\AppData\Local\Temp\e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1968
-
-