Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 11:24
Static task
static1
Behavioral task
behavioral1
Sample
61c6858c5ecd6f8c83bc8d318d9f9c5f.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
61c6858c5ecd6f8c83bc8d318d9f9c5f.exe
Resource
win10v20201028
General
-
Target
61c6858c5ecd6f8c83bc8d318d9f9c5f.exe
-
Size
349KB
-
MD5
0983cb6fb6ca713e547893ef1c90c09d
-
SHA1
766807324427b5a4ecc82c75d15be09d1695795d
-
SHA256
7eb160d254641cd57c9abbae458370718b989d6096f17c6888318a8ebb253853
-
SHA512
73e9bb86649eb4df330e4e12c0adbf1e03f03d55b37dba192e3081902f6f6143b38283610c7137124998aeeaadfa66c94fec992802a0ea37f5970e599043776b
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
61c6858c5ecd6f8c83bc8d318d9f9c5f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\windows\\msdcsc.exe" 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3640 msdcsc.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe upx C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
61c6858c5ecd6f8c83bc8d318d9f9c5f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 5048 notepad.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
61c6858c5ecd6f8c83bc8d318d9f9c5f.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows\\msdcsc.exe" 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
61c6858c5ecd6f8c83bc8d318d9f9c5f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
61c6858c5ecd6f8c83bc8d318d9f9c5f.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeSecurityPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeTakeOwnershipPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeLoadDriverPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeSystemProfilePrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeSystemtimePrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeProfSingleProcessPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeIncBasePriorityPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeCreatePagefilePrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeBackupPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeRestorePrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeShutdownPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeDebugPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeSystemEnvironmentPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeChangeNotifyPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeRemoteShutdownPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeUndockPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeManageVolumePrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeImpersonatePrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeCreateGlobalPrivilege 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: 33 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: 34 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: 35 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: 36 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe Token: SeIncreaseQuotaPrivilege 3640 msdcsc.exe Token: SeSecurityPrivilege 3640 msdcsc.exe Token: SeTakeOwnershipPrivilege 3640 msdcsc.exe Token: SeLoadDriverPrivilege 3640 msdcsc.exe Token: SeSystemProfilePrivilege 3640 msdcsc.exe Token: SeSystemtimePrivilege 3640 msdcsc.exe Token: SeProfSingleProcessPrivilege 3640 msdcsc.exe Token: SeIncBasePriorityPrivilege 3640 msdcsc.exe Token: SeCreatePagefilePrivilege 3640 msdcsc.exe Token: SeBackupPrivilege 3640 msdcsc.exe Token: SeRestorePrivilege 3640 msdcsc.exe Token: SeShutdownPrivilege 3640 msdcsc.exe Token: SeDebugPrivilege 3640 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3640 msdcsc.exe Token: SeChangeNotifyPrivilege 3640 msdcsc.exe Token: SeRemoteShutdownPrivilege 3640 msdcsc.exe Token: SeUndockPrivilege 3640 msdcsc.exe Token: SeManageVolumePrivilege 3640 msdcsc.exe Token: SeImpersonatePrivilege 3640 msdcsc.exe Token: SeCreateGlobalPrivilege 3640 msdcsc.exe Token: 33 3640 msdcsc.exe Token: 34 3640 msdcsc.exe Token: 35 3640 msdcsc.exe Token: 36 3640 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 3640 msdcsc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
61c6858c5ecd6f8c83bc8d318d9f9c5f.exedescription pid process target process PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 5048 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe notepad.exe PID 4700 wrote to memory of 3640 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe msdcsc.exe PID 4700 wrote to memory of 3640 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe msdcsc.exe PID 4700 wrote to memory of 3640 4700 61c6858c5ecd6f8c83bc8d318d9f9c5f.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61c6858c5ecd6f8c83bc8d318d9f9c5f.exe"C:\Users\Admin\AppData\Local\Temp\61c6858c5ecd6f8c83bc8d318d9f9c5f.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exeMD5
0983cb6fb6ca713e547893ef1c90c09d
SHA1766807324427b5a4ecc82c75d15be09d1695795d
SHA2567eb160d254641cd57c9abbae458370718b989d6096f17c6888318a8ebb253853
SHA51273e9bb86649eb4df330e4e12c0adbf1e03f03d55b37dba192e3081902f6f6143b38283610c7137124998aeeaadfa66c94fec992802a0ea37f5970e599043776b
-
C:\Users\Admin\AppData\Local\Temp\windows\msdcsc.exeMD5
0983cb6fb6ca713e547893ef1c90c09d
SHA1766807324427b5a4ecc82c75d15be09d1695795d
SHA2567eb160d254641cd57c9abbae458370718b989d6096f17c6888318a8ebb253853
SHA51273e9bb86649eb4df330e4e12c0adbf1e03f03d55b37dba192e3081902f6f6143b38283610c7137124998aeeaadfa66c94fec992802a0ea37f5970e599043776b
-
memory/3640-3-0x0000000000000000-mapping.dmp
-
memory/5048-0-0x0000000000000000-mapping.dmp
-
memory/5048-1-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/5048-2-0x0000000000000000-mapping.dmp