Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-11-2020 23:14
Static task
static1
Behavioral task
behavioral1
Sample
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe
Resource
win10v20201028
General
-
Target
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe
-
Size
252KB
-
MD5
3e734884cff7885e868bd18a37d626b2
-
SHA1
e76e6ee891dbfc141218b5fe4378f9a851664224
-
SHA256
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b
-
SHA512
30df6493053c37eb1b494009557672f30d1d67c71145950aea0e2112c64d905f071b0d543b1da73965b823ef03bc1b43ff6d37dab5f0b27b876291fe3c271701
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1984 msdcsc.exe -
Processes:
resource yara_rule \Users\Admin\Documents\MSDCSC\msdcsc.exe upx \Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1444 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exepid process 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1984 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeSecurityPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeTakeOwnershipPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeLoadDriverPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeSystemProfilePrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeSystemtimePrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeProfSingleProcessPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeIncBasePriorityPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeCreatePagefilePrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeBackupPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeRestorePrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeShutdownPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeDebugPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeSystemEnvironmentPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeChangeNotifyPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeRemoteShutdownPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeUndockPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeManageVolumePrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeImpersonatePrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeCreateGlobalPrivilege 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: 33 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: 34 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: 35 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe Token: SeIncreaseQuotaPrivilege 1984 msdcsc.exe Token: SeSecurityPrivilege 1984 msdcsc.exe Token: SeTakeOwnershipPrivilege 1984 msdcsc.exe Token: SeLoadDriverPrivilege 1984 msdcsc.exe Token: SeSystemProfilePrivilege 1984 msdcsc.exe Token: SeSystemtimePrivilege 1984 msdcsc.exe Token: SeProfSingleProcessPrivilege 1984 msdcsc.exe Token: SeIncBasePriorityPrivilege 1984 msdcsc.exe Token: SeCreatePagefilePrivilege 1984 msdcsc.exe Token: SeBackupPrivilege 1984 msdcsc.exe Token: SeRestorePrivilege 1984 msdcsc.exe Token: SeShutdownPrivilege 1984 msdcsc.exe Token: SeDebugPrivilege 1984 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1984 msdcsc.exe Token: SeChangeNotifyPrivilege 1984 msdcsc.exe Token: SeRemoteShutdownPrivilege 1984 msdcsc.exe Token: SeUndockPrivilege 1984 msdcsc.exe Token: SeManageVolumePrivilege 1984 msdcsc.exe Token: SeImpersonatePrivilege 1984 msdcsc.exe Token: SeCreateGlobalPrivilege 1984 msdcsc.exe Token: 33 1984 msdcsc.exe Token: 34 1984 msdcsc.exe Token: 35 1984 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1984 msdcsc.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exemsdcsc.exedescription pid process target process PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1444 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe notepad.exe PID 2028 wrote to memory of 1984 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe msdcsc.exe PID 2028 wrote to memory of 1984 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe msdcsc.exe PID 2028 wrote to memory of 1984 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe msdcsc.exe PID 2028 wrote to memory of 1984 2028 a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe msdcsc.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe PID 1984 wrote to memory of 1748 1984 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe"C:\Users\Admin\AppData\Local\Temp\a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
3e734884cff7885e868bd18a37d626b2
SHA1e76e6ee891dbfc141218b5fe4378f9a851664224
SHA256a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b
SHA51230df6493053c37eb1b494009557672f30d1d67c71145950aea0e2112c64d905f071b0d543b1da73965b823ef03bc1b43ff6d37dab5f0b27b876291fe3c271701
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
3e734884cff7885e868bd18a37d626b2
SHA1e76e6ee891dbfc141218b5fe4378f9a851664224
SHA256a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b
SHA51230df6493053c37eb1b494009557672f30d1d67c71145950aea0e2112c64d905f071b0d543b1da73965b823ef03bc1b43ff6d37dab5f0b27b876291fe3c271701
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
3e734884cff7885e868bd18a37d626b2
SHA1e76e6ee891dbfc141218b5fe4378f9a851664224
SHA256a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b
SHA51230df6493053c37eb1b494009557672f30d1d67c71145950aea0e2112c64d905f071b0d543b1da73965b823ef03bc1b43ff6d37dab5f0b27b876291fe3c271701
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
3e734884cff7885e868bd18a37d626b2
SHA1e76e6ee891dbfc141218b5fe4378f9a851664224
SHA256a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b
SHA51230df6493053c37eb1b494009557672f30d1d67c71145950aea0e2112c64d905f071b0d543b1da73965b823ef03bc1b43ff6d37dab5f0b27b876291fe3c271701
-
memory/1444-0-0x0000000000000000-mapping.dmp
-
memory/1444-2-0x0000000000000000-mapping.dmp
-
memory/1444-1-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1748-9-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1748-10-0x0000000000000000-mapping.dmp
-
memory/1748-8-0x0000000000000000-mapping.dmp
-
memory/1984-5-0x0000000000000000-mapping.dmp