Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-03-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
-
Size
362KB
-
MD5
f1f48360f95e1b43e9fba0fec5a2afb8
-
SHA1
70ceb467db7b0161d22e4545479f747417b9705a
-
SHA256
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49
-
SHA512
88d945c7a064882681670d9402fb8d07cd0653f5d6e7801d95b0a4a840be2a362ccb11baa6911b47538681705a76d633d8fad374a6f541dd3ed651f3b63ae3b8
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2004 mcvsmap.exe 1536 mcvsmap.exe -
Deletes itself 1 IoCs
pid Process 1864 svchost.exe -
Loads dropped DLL 6 IoCs
pid Process 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 2004 mcvsmap.exe 1536 mcvsmap.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 41004500300043003100310031003100360043003700300034003800380041000000 svchost.exe Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1864 svchost.exe 1220 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2004 mcvsmap.exe Token: SeTcbPrivilege 2004 mcvsmap.exe Token: SeDebugPrivilege 1536 mcvsmap.exe Token: SeTcbPrivilege 1536 mcvsmap.exe Token: SeDebugPrivilege 1864 svchost.exe Token: SeTcbPrivilege 1864 svchost.exe Token: SeDebugPrivilege 1220 msiexec.exe Token: SeTcbPrivilege 1220 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 26 PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 26 PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 26 PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 26 PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 26 PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 26 PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 26 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1536 wrote to memory of 1864 1536 mcvsmap.exe 28 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33 PID 1864 wrote to memory of 1220 1864 svchost.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\ProgramData\VirusMap\mcvsmap.exeC:\ProgramData\VirusMap\mcvsmap.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Deletes itself
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 18643⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-