Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 11:34
Static task
static1
Behavioral task
behavioral1
Sample
9b89fb51be345ff9564807566ff45444.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9b89fb51be345ff9564807566ff45444.exe
Resource
win10v20201028
General
-
Target
9b89fb51be345ff9564807566ff45444.exe
-
Size
252KB
-
MD5
1ae87b63858a496bd9473e57fb4d8f31
-
SHA1
30593034cc80261649a334cde198d6c2dc3a866c
-
SHA256
113936749f6b08da52458f7536043df7dc3da181b084db8240d441ddc3d7c02d
-
SHA512
d02eb94c60c5361138942a2af0758c8b97e72fa898f31fbb75f4055cfb2eac6a5549407b57155b8c3ee2250b64e1849f662620f2a9d69a0da6057ca440bbe37c
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
9b89fb51be345ff9564807566ff45444.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 9b89fb51be345ff9564807566ff45444.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3304 msdcsc.exe -
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9b89fb51be345ff9564807566ff45444.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation 9b89fb51be345ff9564807566ff45444.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 4028 notepad.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9b89fb51be345ff9564807566ff45444.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 9b89fb51be345ff9564807566ff45444.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
9b89fb51be345ff9564807566ff45444.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 9b89fb51be345ff9564807566ff45444.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 3304 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
9b89fb51be345ff9564807566ff45444.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeSecurityPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeTakeOwnershipPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeLoadDriverPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeSystemProfilePrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeSystemtimePrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeProfSingleProcessPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeIncBasePriorityPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeCreatePagefilePrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeBackupPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeRestorePrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeShutdownPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeDebugPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeSystemEnvironmentPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeChangeNotifyPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeRemoteShutdownPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeUndockPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeManageVolumePrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeImpersonatePrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: SeCreateGlobalPrivilege 648 9b89fb51be345ff9564807566ff45444.exe Token: 33 648 9b89fb51be345ff9564807566ff45444.exe Token: 34 648 9b89fb51be345ff9564807566ff45444.exe Token: 35 648 9b89fb51be345ff9564807566ff45444.exe Token: 36 648 9b89fb51be345ff9564807566ff45444.exe Token: SeIncreaseQuotaPrivilege 3304 msdcsc.exe Token: SeSecurityPrivilege 3304 msdcsc.exe Token: SeTakeOwnershipPrivilege 3304 msdcsc.exe Token: SeLoadDriverPrivilege 3304 msdcsc.exe Token: SeSystemProfilePrivilege 3304 msdcsc.exe Token: SeSystemtimePrivilege 3304 msdcsc.exe Token: SeProfSingleProcessPrivilege 3304 msdcsc.exe Token: SeIncBasePriorityPrivilege 3304 msdcsc.exe Token: SeCreatePagefilePrivilege 3304 msdcsc.exe Token: SeBackupPrivilege 3304 msdcsc.exe Token: SeRestorePrivilege 3304 msdcsc.exe Token: SeShutdownPrivilege 3304 msdcsc.exe Token: SeDebugPrivilege 3304 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3304 msdcsc.exe Token: SeChangeNotifyPrivilege 3304 msdcsc.exe Token: SeRemoteShutdownPrivilege 3304 msdcsc.exe Token: SeUndockPrivilege 3304 msdcsc.exe Token: SeManageVolumePrivilege 3304 msdcsc.exe Token: SeImpersonatePrivilege 3304 msdcsc.exe Token: SeCreateGlobalPrivilege 3304 msdcsc.exe Token: 33 3304 msdcsc.exe Token: 34 3304 msdcsc.exe Token: 35 3304 msdcsc.exe Token: 36 3304 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 3304 msdcsc.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
9b89fb51be345ff9564807566ff45444.exemsdcsc.exedescription pid process target process PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 4028 648 9b89fb51be345ff9564807566ff45444.exe notepad.exe PID 648 wrote to memory of 3304 648 9b89fb51be345ff9564807566ff45444.exe msdcsc.exe PID 648 wrote to memory of 3304 648 9b89fb51be345ff9564807566ff45444.exe msdcsc.exe PID 648 wrote to memory of 3304 648 9b89fb51be345ff9564807566ff45444.exe msdcsc.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe PID 3304 wrote to memory of 3176 3304 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b89fb51be345ff9564807566ff45444.exe"C:\Users\Admin\AppData\Local\Temp\9b89fb51be345ff9564807566ff45444.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
1ae87b63858a496bd9473e57fb4d8f31
SHA130593034cc80261649a334cde198d6c2dc3a866c
SHA256113936749f6b08da52458f7536043df7dc3da181b084db8240d441ddc3d7c02d
SHA512d02eb94c60c5361138942a2af0758c8b97e72fa898f31fbb75f4055cfb2eac6a5549407b57155b8c3ee2250b64e1849f662620f2a9d69a0da6057ca440bbe37c
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
1ae87b63858a496bd9473e57fb4d8f31
SHA130593034cc80261649a334cde198d6c2dc3a866c
SHA256113936749f6b08da52458f7536043df7dc3da181b084db8240d441ddc3d7c02d
SHA512d02eb94c60c5361138942a2af0758c8b97e72fa898f31fbb75f4055cfb2eac6a5549407b57155b8c3ee2250b64e1849f662620f2a9d69a0da6057ca440bbe37c
-
memory/3176-6-0x0000000000000000-mapping.dmp
-
memory/3176-7-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/3176-8-0x0000000000000000-mapping.dmp
-
memory/3304-3-0x0000000000000000-mapping.dmp
-
memory/4028-0-0x0000000000000000-mapping.dmp
-
memory/4028-1-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/4028-2-0x0000000000000000-mapping.dmp