2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49

Resubmissions

15-11-2022 10:35

221115-mmn1esce3t 10

15-03-2021 11:09

210315-zqyylb62la 8

Analysis

max time kernel
150s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
15-03-2021 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
Size

362KB
MD5

f1f48360f95e1b43e9fba0fec5a2afb8
SHA1

70ceb467db7b0161d22e4545479f747417b9705a
SHA256

2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49
SHA512

88d945c7a064882681670d9402fb8d07cd0653f5d6e7801d95b0a4a840be2a362ccb11baa6911b47538681705a76d633d8fad374a6f541dd3ed651f3b63ae3b8

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

mcvsmap.exemcvsmap.exe

pid process

2588 mcvsmap.exe
424 mcvsmap.exe
Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

184 svchost.exe
Loads dropped DLL 2 IoCs

Processes:

mcvsmap.exemcvsmap.exe

pid process

2588 mcvsmap.exe
424 mcvsmap.exe

pid	process
2588	mcvsmap.exe
424	mcvsmap.exe

pid	process
2588	mcvsmap.exe
424	mcvsmap.exe

Drops file in System32 directory 5 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 33004300380044003200330041003200460041003400380035004300330033000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exemsiexec.exe

pid	process
184	svchost.exe
184	svchost.exe
184	svchost.exe
184	svchost.exe
184	svchost.exe
184	svchost.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
184	svchost.exe
184	svchost.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
184	svchost.exe
184	svchost.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
184	svchost.exe
184	svchost.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
184	svchost.exe
184	svchost.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe
3816	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exemsiexec.exe

pid process

184 svchost.exe
3816 msiexec.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

mcvsmap.exemcvsmap.exesvchost.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2588	mcvsmap.exe
Token: SeTcbPrivilege	2588	mcvsmap.exe
Token: SeDebugPrivilege	424	mcvsmap.exe
Token: SeTcbPrivilege	424	mcvsmap.exe
Token: SeDebugPrivilege	184	svchost.exe
Token: SeTcbPrivilege	184	svchost.exe
Token: SeDebugPrivilege	3816	msiexec.exe
Token: SeTcbPrivilege	3816	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exemcvsmap.exesvchost.exe

description	pid	process	target process
PID 652 wrote to memory of 2588	652	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	mcvsmap.exe
PID 652 wrote to memory of 2588	652	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	mcvsmap.exe
PID 652 wrote to memory of 2588	652	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	mcvsmap.exe
PID 424 wrote to memory of 184	424	mcvsmap.exe	svchost.exe
PID 424 wrote to memory of 184	424	mcvsmap.exe	svchost.exe
PID 424 wrote to memory of 184	424	mcvsmap.exe	svchost.exe
PID 424 wrote to memory of 184	424	mcvsmap.exe	svchost.exe
PID 424 wrote to memory of 184	424	mcvsmap.exe	svchost.exe
PID 424 wrote to memory of 184	424	mcvsmap.exe	svchost.exe
PID 424 wrote to memory of 184	424	mcvsmap.exe	svchost.exe
PID 424 wrote to memory of 184	424	mcvsmap.exe	svchost.exe
PID 184 wrote to memory of 3816	184	svchost.exe	msiexec.exe
PID 184 wrote to memory of 3816	184	svchost.exe	msiexec.exe
PID 184 wrote to memory of 3816	184	svchost.exe	msiexec.exe
PID 184 wrote to memory of 3816	184	svchost.exe	msiexec.exe
PID 184 wrote to memory of 3816	184	svchost.exe	msiexec.exe
PID 184 wrote to memory of 3816	184	svchost.exe	msiexec.exe
PID 184 wrote to memory of 3816	184	svchost.exe	msiexec.exe
PID 184 wrote to memory of 3816	184	svchost.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
"C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\ProgramData\VirusMap\mcvsmap.exe
C:\ProgramData\VirusMap\mcvsmap.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe 201 0
2⤵
- Deletes itself
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:184

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe 209 184
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\bug.log
MD5
05bf76fd4e07e255d3f412b24565658f

SHA1
348f86676c1a2743bb4fedb6a736d35054404508

SHA256
29ab71c842ae7ed19b7800f40adb5a054a8c6c47d1deccffb0c24814f459d5b7

SHA512
2432922391521e9409ecaf59e8e1cab5eecd6472066083f55407bda94c4e3caa29094bb7eae534e7e09aba5491100d601da41e4b00cb6c950ad5b5a050234067

Download Submit
C:\ProgramData\SxS\bug.log
MD5
77d209e601b2860cf2e96ca20a2b9595

SHA1
cfbaf49de6807ceb32c1c948a6c40d1d7fc00429

SHA256
c1facdfca3f06d3fd18a49846399791510a093c943cb958b6b070f56c67195b8

SHA512
ac97331f8b44e42c068eee7f917388c1e391c28c08878cbfab6f6d7920e4c547886cf4b33bd23de9874e001f069d2f43bd84fb122aab37430316d6ec983d8e6f

Download Submit
C:\ProgramData\VirusMap\McUtil.dll
MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
C:\ProgramData\VirusMap\McUtil.dll.PPT
MD5
545bb4365a9b7cdb6d22844ebeedda93

SHA1
a267f1183b4ff843d68a63264846abf78cc71d1f

SHA256
d4fe890a08d4dd44b58a3b85b2a7e89536338099c1c42a9b7e85f4007b0a37b7

SHA512
b9c066f0166e8acbad1e822df8af6d69c7e23da33ff8b8bde9986222193e2be3d269866ec02a784e61d9cd160a8c5c299e04f9ab0981222521d4bb38f29b8e16

Download Submit
C:\ProgramData\VirusMap\mcvsmap.exe
MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
C:\ProgramData\VirusMap\mcvsmap.exe
MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll
MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll.PPT
MD5
545bb4365a9b7cdb6d22844ebeedda93

SHA1
a267f1183b4ff843d68a63264846abf78cc71d1f

SHA256
d4fe890a08d4dd44b58a3b85b2a7e89536338099c1c42a9b7e85f4007b0a37b7

SHA512
b9c066f0166e8acbad1e822df8af6d69c7e23da33ff8b8bde9986222193e2be3d269866ec02a784e61d9cd160a8c5c299e04f9ab0981222521d4bb38f29b8e16

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\ProgramData\VirusMap\McUtil.DLL
MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.DLL
MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
memory/184-17-0x0000000000000000-mapping.dmp

Download
memory/184-23-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

Filesize
4KB

Download
memory/184-24-0x0000000003650000-0x0000000003681000-memory.dmp

Filesize
196KB

Download
memory/424-22-0x0000000000DB0000-0x0000000000DE1000-memory.dmp

Filesize
196KB

Download
memory/2588-7-0x00000000745A0000-0x0000000074633000-memory.dmp

Filesize
588KB

Download
memory/2588-4-0x0000000000000000-mapping.dmp

Download
memory/2588-11-0x00000000020C0000-0x00000000021C0000-memory.dmp

Filesize
1024KB

Download
memory/2588-20-0x00000000021C0000-0x00000000021F1000-memory.dmp

Filesize
196KB

Download
memory/3816-25-0x0000000000000000-mapping.dmp

Download
memory/3816-27-0x0000000000E20000-0x0000000000E51000-memory.dmp

Filesize
196KB

Download
memory/3816-26-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download