Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15-05-2021 14:12
Static task
static1
Behavioral task
behavioral1
Sample
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe
Resource
win7v20210410
General
-
Target
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe
-
Size
284KB
-
MD5
90a641405523f561b9dbf3c27304d22f
-
SHA1
b72390e962498c5256ee22f1392d73f47d198829
-
SHA256
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057
-
SHA512
f799f4438ddefe3d48f815d53935d24e81bfa56a0c130236b8387de68dcd07344d227461ad64a3a0ac7dd28917bfc7795755e88231bbc996b61bd4a9a36ab8a7
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1924 msdcsc.exe -
Processes:
resource yara_rule \Users\Admin\Documents\MSDCSC\msdcsc.exe upx \Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx -
Loads dropped DLL 2 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exepid process 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1924 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeSecurityPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeTakeOwnershipPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeLoadDriverPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeSystemProfilePrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeSystemtimePrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeProfSingleProcessPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeIncBasePriorityPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeCreatePagefilePrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeBackupPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeRestorePrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeShutdownPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeDebugPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeSystemEnvironmentPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeChangeNotifyPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeRemoteShutdownPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeUndockPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeManageVolumePrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeImpersonatePrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeCreateGlobalPrivilege 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: 33 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: 34 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: 35 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeIncreaseQuotaPrivilege 1924 msdcsc.exe Token: SeSecurityPrivilege 1924 msdcsc.exe Token: SeTakeOwnershipPrivilege 1924 msdcsc.exe Token: SeLoadDriverPrivilege 1924 msdcsc.exe Token: SeSystemProfilePrivilege 1924 msdcsc.exe Token: SeSystemtimePrivilege 1924 msdcsc.exe Token: SeProfSingleProcessPrivilege 1924 msdcsc.exe Token: SeIncBasePriorityPrivilege 1924 msdcsc.exe Token: SeCreatePagefilePrivilege 1924 msdcsc.exe Token: SeBackupPrivilege 1924 msdcsc.exe Token: SeRestorePrivilege 1924 msdcsc.exe Token: SeShutdownPrivilege 1924 msdcsc.exe Token: SeDebugPrivilege 1924 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1924 msdcsc.exe Token: SeChangeNotifyPrivilege 1924 msdcsc.exe Token: SeRemoteShutdownPrivilege 1924 msdcsc.exe Token: SeUndockPrivilege 1924 msdcsc.exe Token: SeManageVolumePrivilege 1924 msdcsc.exe Token: SeImpersonatePrivilege 1924 msdcsc.exe Token: SeCreateGlobalPrivilege 1924 msdcsc.exe Token: 33 1924 msdcsc.exe Token: 34 1924 msdcsc.exe Token: 35 1924 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1924 msdcsc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.execmd.execmd.exemsdcsc.exedescription pid process target process PID 368 wrote to memory of 2032 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 368 wrote to memory of 2032 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 368 wrote to memory of 2032 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 368 wrote to memory of 2032 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 368 wrote to memory of 1172 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 368 wrote to memory of 1172 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 368 wrote to memory of 1172 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 368 wrote to memory of 1172 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 368 wrote to memory of 1924 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe msdcsc.exe PID 368 wrote to memory of 1924 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe msdcsc.exe PID 368 wrote to memory of 1924 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe msdcsc.exe PID 368 wrote to memory of 1924 368 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe msdcsc.exe PID 2032 wrote to memory of 1104 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 1104 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 1104 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 1104 2032 cmd.exe attrib.exe PID 1172 wrote to memory of 1728 1172 cmd.exe attrib.exe PID 1172 wrote to memory of 1728 1172 cmd.exe attrib.exe PID 1172 wrote to memory of 1728 1172 cmd.exe attrib.exe PID 1172 wrote to memory of 1728 1172 cmd.exe attrib.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe PID 1924 wrote to memory of 1720 1924 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1104 attrib.exe 1728 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe"C:\Users\Admin\AppData\Local\Temp\bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
90a641405523f561b9dbf3c27304d22f
SHA1b72390e962498c5256ee22f1392d73f47d198829
SHA256bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057
SHA512f799f4438ddefe3d48f815d53935d24e81bfa56a0c130236b8387de68dcd07344d227461ad64a3a0ac7dd28917bfc7795755e88231bbc996b61bd4a9a36ab8a7
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
90a641405523f561b9dbf3c27304d22f
SHA1b72390e962498c5256ee22f1392d73f47d198829
SHA256bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057
SHA512f799f4438ddefe3d48f815d53935d24e81bfa56a0c130236b8387de68dcd07344d227461ad64a3a0ac7dd28917bfc7795755e88231bbc996b61bd4a9a36ab8a7
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
90a641405523f561b9dbf3c27304d22f
SHA1b72390e962498c5256ee22f1392d73f47d198829
SHA256bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057
SHA512f799f4438ddefe3d48f815d53935d24e81bfa56a0c130236b8387de68dcd07344d227461ad64a3a0ac7dd28917bfc7795755e88231bbc996b61bd4a9a36ab8a7
-
memory/368-69-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/368-59-0x0000000076661000-0x0000000076663000-memory.dmpFilesize
8KB
-
memory/1104-65-0x0000000000000000-mapping.dmp
-
memory/1172-61-0x0000000000000000-mapping.dmp
-
memory/1720-71-0x0000000000000000-mapping.dmp
-
memory/1720-73-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1728-66-0x0000000000000000-mapping.dmp
-
memory/1924-64-0x0000000000000000-mapping.dmp
-
memory/1924-70-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2032-60-0x0000000000000000-mapping.dmp