Analysis
-
max time kernel
13s -
max time network
67s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-11-2020 15:43
Static task
static1
Behavioral task
behavioral1
Sample
077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe
Resource
win10v20201028
General
-
Target
077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe
-
Size
318KB
-
MD5
1a18650786e0d1dd22683b8f55e9747a
-
SHA1
e9d1ebb4441b84b5789dbde03951014acae6ab35
-
SHA256
077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f
-
SHA512
1e749a2371d3d0f1c16374419bd84ce93e6e2cd0f158448dd1b600966659b96cd88c3977c9d33a78d1209cce3d460246941be0802742b82443370ab04833cb65
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe" 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe" 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exedescription pid process Token: SeIncreaseQuotaPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeSecurityPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeTakeOwnershipPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeLoadDriverPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeSystemProfilePrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeSystemtimePrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeProfSingleProcessPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeIncBasePriorityPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeCreatePagefilePrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeBackupPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeRestorePrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeShutdownPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeDebugPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeSystemEnvironmentPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeChangeNotifyPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeRemoteShutdownPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeUndockPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeManageVolumePrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeImpersonatePrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: SeCreateGlobalPrivilege 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: 33 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: 34 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: 35 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe Token: 36 884 077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe"C:\Users\Admin\AppData\Local\Temp\077a9062b87736ebfe68a2eaeb4f6ed0f800d3f5ae870a5ab5971960ea3d057f.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken