Analysis
-
max time kernel
3s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-11-2020 15:48
Static task
static1
Behavioral task
behavioral1
Sample
3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe
-
Size
333KB
-
MD5
84cc9af6101f3cbf7fbad42c76ed5c57
-
SHA1
c531ee465a90a361bf50106314b18917cc228d30
-
SHA256
3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98
-
SHA512
a62ed7973cffc253084f18b6cb23de2164e13cb5c1ddc2d6c90d97ba0aee1eae5a494717502cf7c36ebdbecad0296f223aa3ffbd2cb6949dce6161c86561eee9
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exedescription pid process Token: SeIncreaseQuotaPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeSecurityPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeTakeOwnershipPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeLoadDriverPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeSystemProfilePrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeSystemtimePrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeProfSingleProcessPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeIncBasePriorityPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeCreatePagefilePrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeBackupPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeRestorePrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeShutdownPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeDebugPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeSystemEnvironmentPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeChangeNotifyPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeRemoteShutdownPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeUndockPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeManageVolumePrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeImpersonatePrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: SeCreateGlobalPrivilege 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: 33 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: 34 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe Token: 35 1912 3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe"C:\Users\Admin\AppData\Local\Temp\3a559b5d15021a1e6784979661dc33303aee9e310c5bdfbb36fbae1711641f98.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken