Analysis
-
max time kernel
104s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-05-2021 13:02
Static task
static1
Behavioral task
behavioral1
Sample
AntiVM.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
AntiVM.exe
Resource
win10v20210410
General
-
Target
AntiVM.exe
-
Size
837KB
-
MD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
-
SHA1
df93956e25c6f799f5976d9e633c5646a2a20638
-
SHA256
3249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
-
SHA512
1859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
AntiVM.exeANTIVM.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" AntiVM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" ANTIVM.EXE -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
ANTIVM.EXEdescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile ANTIVM.EXE Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" ANTIVM.EXE Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ANTIVM.EXE -
Modifies security service 2 TTPs 1 IoCs
Processes:
ANTIVM.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "1" ANTIVM.EXE -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2460 msdcsc.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 3960 notepad.exe -
Processes:
ANTIVM.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "0" ANTIVM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "0" ANTIVM.EXE -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
AntiVM.exeANTIVM.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" AntiVM.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" ANTIVM.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ANTIVM.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ANTIVM.EXEpid process 1568 ANTIVM.EXE 1568 ANTIVM.EXE 1568 ANTIVM.EXE 1568 ANTIVM.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AntiVM.exeANTIVM.EXEmsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1736 AntiVM.exe Token: SeSecurityPrivilege 1736 AntiVM.exe Token: SeTakeOwnershipPrivilege 1736 AntiVM.exe Token: SeLoadDriverPrivilege 1736 AntiVM.exe Token: SeSystemProfilePrivilege 1736 AntiVM.exe Token: SeSystemtimePrivilege 1736 AntiVM.exe Token: SeProfSingleProcessPrivilege 1736 AntiVM.exe Token: SeIncBasePriorityPrivilege 1736 AntiVM.exe Token: SeCreatePagefilePrivilege 1736 AntiVM.exe Token: SeBackupPrivilege 1736 AntiVM.exe Token: SeRestorePrivilege 1736 AntiVM.exe Token: SeShutdownPrivilege 1736 AntiVM.exe Token: SeDebugPrivilege 1736 AntiVM.exe Token: SeSystemEnvironmentPrivilege 1736 AntiVM.exe Token: SeChangeNotifyPrivilege 1736 AntiVM.exe Token: SeRemoteShutdownPrivilege 1736 AntiVM.exe Token: SeUndockPrivilege 1736 AntiVM.exe Token: SeManageVolumePrivilege 1736 AntiVM.exe Token: SeImpersonatePrivilege 1736 AntiVM.exe Token: SeCreateGlobalPrivilege 1736 AntiVM.exe Token: 33 1736 AntiVM.exe Token: 34 1736 AntiVM.exe Token: 35 1736 AntiVM.exe Token: 36 1736 AntiVM.exe Token: SeIncreaseQuotaPrivilege 1568 ANTIVM.EXE Token: SeSecurityPrivilege 1568 ANTIVM.EXE Token: SeTakeOwnershipPrivilege 1568 ANTIVM.EXE Token: SeLoadDriverPrivilege 1568 ANTIVM.EXE Token: SeSystemProfilePrivilege 1568 ANTIVM.EXE Token: SeSystemtimePrivilege 1568 ANTIVM.EXE Token: SeProfSingleProcessPrivilege 1568 ANTIVM.EXE Token: SeIncBasePriorityPrivilege 1568 ANTIVM.EXE Token: SeCreatePagefilePrivilege 1568 ANTIVM.EXE Token: SeBackupPrivilege 1568 ANTIVM.EXE Token: SeRestorePrivilege 1568 ANTIVM.EXE Token: SeShutdownPrivilege 1568 ANTIVM.EXE Token: SeDebugPrivilege 1568 ANTIVM.EXE Token: SeSystemEnvironmentPrivilege 1568 ANTIVM.EXE Token: SeChangeNotifyPrivilege 1568 ANTIVM.EXE Token: SeRemoteShutdownPrivilege 1568 ANTIVM.EXE Token: SeUndockPrivilege 1568 ANTIVM.EXE Token: SeManageVolumePrivilege 1568 ANTIVM.EXE Token: SeImpersonatePrivilege 1568 ANTIVM.EXE Token: SeCreateGlobalPrivilege 1568 ANTIVM.EXE Token: 33 1568 ANTIVM.EXE Token: 34 1568 ANTIVM.EXE Token: 35 1568 ANTIVM.EXE Token: 36 1568 ANTIVM.EXE Token: SeIncreaseQuotaPrivilege 2460 msdcsc.exe Token: SeSecurityPrivilege 2460 msdcsc.exe Token: SeTakeOwnershipPrivilege 2460 msdcsc.exe Token: SeLoadDriverPrivilege 2460 msdcsc.exe Token: SeSystemProfilePrivilege 2460 msdcsc.exe Token: SeSystemtimePrivilege 2460 msdcsc.exe Token: SeProfSingleProcessPrivilege 2460 msdcsc.exe Token: SeIncBasePriorityPrivilege 2460 msdcsc.exe Token: SeCreatePagefilePrivilege 2460 msdcsc.exe Token: SeBackupPrivilege 2460 msdcsc.exe Token: SeRestorePrivilege 2460 msdcsc.exe Token: SeShutdownPrivilege 2460 msdcsc.exe Token: SeDebugPrivilege 2460 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2460 msdcsc.exe Token: SeChangeNotifyPrivilege 2460 msdcsc.exe Token: SeRemoteShutdownPrivilege 2460 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ANTIVM.EXEpid process 1568 ANTIVM.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
AntiVM.exeANTIVM.EXEdescription pid process target process PID 1736 wrote to memory of 1568 1736 AntiVM.exe ANTIVM.EXE PID 1736 wrote to memory of 1568 1736 AntiVM.exe ANTIVM.EXE PID 1736 wrote to memory of 1568 1736 AntiVM.exe ANTIVM.EXE PID 1736 wrote to memory of 2460 1736 AntiVM.exe msdcsc.exe PID 1736 wrote to memory of 2460 1736 AntiVM.exe msdcsc.exe PID 1736 wrote to memory of 2460 1736 AntiVM.exe msdcsc.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe PID 1568 wrote to memory of 3960 1568 ANTIVM.EXE notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ANTIVM.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion ANTIVM.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern ANTIVM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "0" ANTIVM.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\AntiVM.exe"C:\Users\Admin\AppData\Local\Temp\AntiVM.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ANTIVM.EXE"C:\Users\Admin\AppData\Local\Temp\ANTIVM.EXE"2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
SHA1df93956e25c6f799f5976d9e633c5646a2a20638
SHA2563249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
SHA5121859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
SHA1df93956e25c6f799f5976d9e633c5646a2a20638
SHA2563249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
SHA5121859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f
-
memory/1568-114-0x0000000000000000-mapping.dmp
-
memory/1568-119-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/1736-115-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/2460-117-0x0000000000000000-mapping.dmp
-
memory/2460-120-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3960-121-0x0000000000000000-mapping.dmp
-
memory/3960-122-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB