Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-03-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
Resource
win10v20201028
General
-
Target
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
-
Size
362KB
-
MD5
f1f48360f95e1b43e9fba0fec5a2afb8
-
SHA1
70ceb467db7b0161d22e4545479f747417b9705a
-
SHA256
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49
-
SHA512
88d945c7a064882681670d9402fb8d07cd0653f5d6e7801d95b0a4a840be2a362ccb11baa6911b47538681705a76d633d8fad374a6f541dd3ed651f3b63ae3b8
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
mcvsmap.exemcvsmap.exepid process 2004 mcvsmap.exe 1536 mcvsmap.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1864 svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exemcvsmap.exemcvsmap.exepid process 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 2004 mcvsmap.exe 1536 mcvsmap.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 41004500300043003100310031003100360043003700300034003800380041000000 svchost.exe Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exemsiexec.exepid process 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1220 msiexec.exe 1864 svchost.exe 1864 svchost.exe 1220 msiexec.exe 1220 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svchost.exemsiexec.exepid process 1864 svchost.exe 1220 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
mcvsmap.exemcvsmap.exesvchost.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2004 mcvsmap.exe Token: SeTcbPrivilege 2004 mcvsmap.exe Token: SeDebugPrivilege 1536 mcvsmap.exe Token: SeTcbPrivilege 1536 mcvsmap.exe Token: SeDebugPrivilege 1864 svchost.exe Token: SeTcbPrivilege 1864 svchost.exe Token: SeDebugPrivilege 1220 msiexec.exe Token: SeTcbPrivilege 1220 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exemcvsmap.exesvchost.exedescription pid process target process PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe mcvsmap.exe PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe mcvsmap.exe PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe mcvsmap.exe PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe mcvsmap.exe PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe mcvsmap.exe PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe mcvsmap.exe PID 1904 wrote to memory of 2004 1904 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe mcvsmap.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1536 wrote to memory of 1864 1536 mcvsmap.exe svchost.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe PID 1864 wrote to memory of 1220 1864 svchost.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\VirusMap\mcvsmap.exeC:\ProgramData\VirusMap\mcvsmap.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Deletes itself
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 18643⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\SxS\bug.logMD5
44e5d1960da50dd3d134f84772cd1372
SHA12ec9741fc9072c79ab016af5455112b43615d0d2
SHA25637b3533bdca4b2b99bde2fd089f89f8e5755deaa8dab678f58e45a4503cc6144
SHA51257fa7896cfffd6a6547132c40deb877871732597cf326f747caf1001a7aab573aac5bd4342b720ac8eacc4bd56455505df51e3c8a0ce0b9dc30d55adf078d2ee
-
C:\ProgramData\SxS\bug.logMD5
f69fbd7296a0be733d363cde2162fcfd
SHA18228ba462bad81cfd4fa2c3cd4b2099d03022846
SHA256fc964e17f05359c4caecbb435184b1778cc287fed310512836831a6138f36ca3
SHA51271245c1015b83329bb33075c799db61bb331a9c69f4bf250550741276b12c1f79063af63c3c7974200611475e414eb660dff9111650c70cd52e1528414a445bd
-
C:\ProgramData\VirusMap\McUtil.dllMD5
ad4a646b38a482cc07d5b09b4fffd3b3
SHA1ae0f9bf2740d00c5d485827eb32aca33feaa3a90
SHA2560a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48
SHA5120a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1
-
C:\ProgramData\VirusMap\McUtil.dll.PPTMD5
545bb4365a9b7cdb6d22844ebeedda93
SHA1a267f1183b4ff843d68a63264846abf78cc71d1f
SHA256d4fe890a08d4dd44b58a3b85b2a7e89536338099c1c42a9b7e85f4007b0a37b7
SHA512b9c066f0166e8acbad1e822df8af6d69c7e23da33ff8b8bde9986222193e2be3d269866ec02a784e61d9cd160a8c5c299e04f9ab0981222521d4bb38f29b8e16
-
C:\ProgramData\VirusMap\mcvsmap.exeMD5
4e1e0b8b0673937415599bf2f24c44ad
SHA19224de3af2a246011c6294f64f27206d165317ba
SHA256ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096
SHA51287f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dllMD5
ad4a646b38a482cc07d5b09b4fffd3b3
SHA1ae0f9bf2740d00c5d485827eb32aca33feaa3a90
SHA2560a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48
SHA5120a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll.PPTMD5
545bb4365a9b7cdb6d22844ebeedda93
SHA1a267f1183b4ff843d68a63264846abf78cc71d1f
SHA256d4fe890a08d4dd44b58a3b85b2a7e89536338099c1c42a9b7e85f4007b0a37b7
SHA512b9c066f0166e8acbad1e822df8af6d69c7e23da33ff8b8bde9986222193e2be3d269866ec02a784e61d9cd160a8c5c299e04f9ab0981222521d4bb38f29b8e16
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exeMD5
4e1e0b8b0673937415599bf2f24c44ad
SHA19224de3af2a246011c6294f64f27206d165317ba
SHA256ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096
SHA51287f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exeMD5
4e1e0b8b0673937415599bf2f24c44ad
SHA19224de3af2a246011c6294f64f27206d165317ba
SHA256ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096
SHA51287f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d
-
\ProgramData\VirusMap\McUtil.DLLMD5
ad4a646b38a482cc07d5b09b4fffd3b3
SHA1ae0f9bf2740d00c5d485827eb32aca33feaa3a90
SHA2560a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48
SHA5120a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1
-
\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.DLLMD5
ad4a646b38a482cc07d5b09b4fffd3b3
SHA1ae0f9bf2740d00c5d485827eb32aca33feaa3a90
SHA2560a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48
SHA5120a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1
-
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exeMD5
4e1e0b8b0673937415599bf2f24c44ad
SHA19224de3af2a246011c6294f64f27206d165317ba
SHA256ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096
SHA51287f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d
-
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exeMD5
4e1e0b8b0673937415599bf2f24c44ad
SHA19224de3af2a246011c6294f64f27206d165317ba
SHA256ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096
SHA51287f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d
-
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exeMD5
4e1e0b8b0673937415599bf2f24c44ad
SHA19224de3af2a246011c6294f64f27206d165317ba
SHA256ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096
SHA51287f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d
-
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exeMD5
4e1e0b8b0673937415599bf2f24c44ad
SHA19224de3af2a246011c6294f64f27206d165317ba
SHA256ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096
SHA51287f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d
-
memory/1220-31-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/1220-32-0x0000000000470000-0x00000000004A1000-memory.dmpFilesize
196KB
-
memory/1220-29-0x0000000000000000-mapping.dmp
-
memory/1536-25-0x00000000003C0000-0x00000000003F1000-memory.dmpFilesize
196KB
-
memory/1864-27-0x0000000000280000-0x00000000002B1000-memory.dmpFilesize
196KB
-
memory/1864-26-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1864-19-0x0000000000000000-mapping.dmp
-
memory/1904-2-0x00000000766F1000-0x00000000766F3000-memory.dmpFilesize
8KB
-
memory/2004-23-0x0000000000480000-0x00000000004B1000-memory.dmpFilesize
196KB
-
memory/2004-22-0x0000000001D30000-0x0000000001E30000-memory.dmpFilesize
1024KB
-
memory/2004-7-0x0000000000000000-mapping.dmp