Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-05-2021 14:12
Static task
static1
Behavioral task
behavioral1
Sample
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe
Resource
win7v20210410
General
-
Target
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe
-
Size
284KB
-
MD5
90a641405523f561b9dbf3c27304d22f
-
SHA1
b72390e962498c5256ee22f1392d73f47d198829
-
SHA256
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057
-
SHA512
f799f4438ddefe3d48f815d53935d24e81bfa56a0c130236b8387de68dcd07344d227461ad64a3a0ac7dd28917bfc7795755e88231bbc996b61bd4a9a36ab8a7
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 416 msdcsc.exe -
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 416 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeSecurityPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeTakeOwnershipPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeLoadDriverPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeSystemProfilePrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeSystemtimePrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeProfSingleProcessPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeIncBasePriorityPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeCreatePagefilePrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeBackupPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeRestorePrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeShutdownPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeDebugPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeSystemEnvironmentPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeChangeNotifyPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeRemoteShutdownPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeUndockPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeManageVolumePrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeImpersonatePrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeCreateGlobalPrivilege 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: 33 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: 34 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: 35 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: 36 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe Token: SeIncreaseQuotaPrivilege 416 msdcsc.exe Token: SeSecurityPrivilege 416 msdcsc.exe Token: SeTakeOwnershipPrivilege 416 msdcsc.exe Token: SeLoadDriverPrivilege 416 msdcsc.exe Token: SeSystemProfilePrivilege 416 msdcsc.exe Token: SeSystemtimePrivilege 416 msdcsc.exe Token: SeProfSingleProcessPrivilege 416 msdcsc.exe Token: SeIncBasePriorityPrivilege 416 msdcsc.exe Token: SeCreatePagefilePrivilege 416 msdcsc.exe Token: SeBackupPrivilege 416 msdcsc.exe Token: SeRestorePrivilege 416 msdcsc.exe Token: SeShutdownPrivilege 416 msdcsc.exe Token: SeDebugPrivilege 416 msdcsc.exe Token: SeSystemEnvironmentPrivilege 416 msdcsc.exe Token: SeChangeNotifyPrivilege 416 msdcsc.exe Token: SeRemoteShutdownPrivilege 416 msdcsc.exe Token: SeUndockPrivilege 416 msdcsc.exe Token: SeManageVolumePrivilege 416 msdcsc.exe Token: SeImpersonatePrivilege 416 msdcsc.exe Token: SeCreateGlobalPrivilege 416 msdcsc.exe Token: 33 416 msdcsc.exe Token: 34 416 msdcsc.exe Token: 35 416 msdcsc.exe Token: 36 416 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 416 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exemsdcsc.execmd.execmd.exedescription pid process target process PID 764 wrote to memory of 3772 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 764 wrote to memory of 3772 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 764 wrote to memory of 3772 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 764 wrote to memory of 3744 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 764 wrote to memory of 3744 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 764 wrote to memory of 3744 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe cmd.exe PID 764 wrote to memory of 416 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe msdcsc.exe PID 764 wrote to memory of 416 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe msdcsc.exe PID 764 wrote to memory of 416 764 bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe msdcsc.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 416 wrote to memory of 2792 416 msdcsc.exe notepad.exe PID 3744 wrote to memory of 2788 3744 cmd.exe attrib.exe PID 3744 wrote to memory of 2788 3744 cmd.exe attrib.exe PID 3744 wrote to memory of 2788 3744 cmd.exe attrib.exe PID 3772 wrote to memory of 208 3772 cmd.exe attrib.exe PID 3772 wrote to memory of 208 3772 cmd.exe attrib.exe PID 3772 wrote to memory of 208 3772 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2788 attrib.exe 208 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe"C:\Users\Admin\AppData\Local\Temp\bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
90a641405523f561b9dbf3c27304d22f
SHA1b72390e962498c5256ee22f1392d73f47d198829
SHA256bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057
SHA512f799f4438ddefe3d48f815d53935d24e81bfa56a0c130236b8387de68dcd07344d227461ad64a3a0ac7dd28917bfc7795755e88231bbc996b61bd4a9a36ab8a7
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
90a641405523f561b9dbf3c27304d22f
SHA1b72390e962498c5256ee22f1392d73f47d198829
SHA256bfa21515e932d430a1c7415d5f6554a499075f2f40f913de56d918eff6693057
SHA512f799f4438ddefe3d48f815d53935d24e81bfa56a0c130236b8387de68dcd07344d227461ad64a3a0ac7dd28917bfc7795755e88231bbc996b61bd4a9a36ab8a7
-
memory/208-122-0x0000000000000000-mapping.dmp
-
memory/416-117-0x0000000000000000-mapping.dmp
-
memory/416-123-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/764-114-0x0000000000A90000-0x0000000000CC8000-memory.dmpFilesize
2.2MB
-
memory/2788-121-0x0000000000000000-mapping.dmp
-
memory/2792-120-0x0000000000000000-mapping.dmp
-
memory/2792-124-0x0000000000770000-0x000000000081E000-memory.dmpFilesize
696KB
-
memory/3744-116-0x0000000000000000-mapping.dmp
-
memory/3772-115-0x0000000000000000-mapping.dmp