Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-03-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
-
Size
362KB
-
MD5
f1f48360f95e1b43e9fba0fec5a2afb8
-
SHA1
70ceb467db7b0161d22e4545479f747417b9705a
-
SHA256
2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49
-
SHA512
88d945c7a064882681670d9402fb8d07cd0653f5d6e7801d95b0a4a840be2a362ccb11baa6911b47538681705a76d633d8fad374a6f541dd3ed651f3b63ae3b8
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2588 mcvsmap.exe 424 mcvsmap.exe -
Deletes itself 1 IoCs
pid Process 184 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2588 mcvsmap.exe 424 mcvsmap.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 33004300380044003200330041003200460041003400380035004300330033000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 184 svchost.exe 184 svchost.exe 184 svchost.exe 184 svchost.exe 184 svchost.exe 184 svchost.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 184 svchost.exe 184 svchost.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 184 svchost.exe 184 svchost.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 184 svchost.exe 184 svchost.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 184 svchost.exe 184 svchost.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe 3816 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 184 svchost.exe 3816 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2588 mcvsmap.exe Token: SeTcbPrivilege 2588 mcvsmap.exe Token: SeDebugPrivilege 424 mcvsmap.exe Token: SeTcbPrivilege 424 mcvsmap.exe Token: SeDebugPrivilege 184 svchost.exe Token: SeTcbPrivilege 184 svchost.exe Token: SeDebugPrivilege 3816 msiexec.exe Token: SeTcbPrivilege 3816 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 652 wrote to memory of 2588 652 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 75 PID 652 wrote to memory of 2588 652 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 75 PID 652 wrote to memory of 2588 652 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe 75 PID 424 wrote to memory of 184 424 mcvsmap.exe 78 PID 424 wrote to memory of 184 424 mcvsmap.exe 78 PID 424 wrote to memory of 184 424 mcvsmap.exe 78 PID 424 wrote to memory of 184 424 mcvsmap.exe 78 PID 424 wrote to memory of 184 424 mcvsmap.exe 78 PID 424 wrote to memory of 184 424 mcvsmap.exe 78 PID 424 wrote to memory of 184 424 mcvsmap.exe 78 PID 424 wrote to memory of 184 424 mcvsmap.exe 78 PID 184 wrote to memory of 3816 184 svchost.exe 81 PID 184 wrote to memory of 3816 184 svchost.exe 81 PID 184 wrote to memory of 3816 184 svchost.exe 81 PID 184 wrote to memory of 3816 184 svchost.exe 81 PID 184 wrote to memory of 3816 184 svchost.exe 81 PID 184 wrote to memory of 3816 184 svchost.exe 81 PID 184 wrote to memory of 3816 184 svchost.exe 81 PID 184 wrote to memory of 3816 184 svchost.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\ProgramData\VirusMap\mcvsmap.exeC:\ProgramData\VirusMap\mcvsmap.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Deletes itself
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 1843⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-