Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-05-2021 12:47
Static task
static1
Behavioral task
behavioral1
Sample
AntiVM.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
AntiVM.exe
Resource
win10v20210408
General
-
Target
AntiVM.exe
-
Size
837KB
-
MD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
-
SHA1
df93956e25c6f799f5976d9e633c5646a2a20638
-
SHA256
3249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
-
SHA512
1859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
AntiVM.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" AntiVM.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2752 msdcsc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
AntiVM.exeANTIVM.EXEmsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" AntiVM.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" ANTIVM.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AntiVM.exeANTIVM.EXEmsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 620 AntiVM.exe Token: SeSecurityPrivilege 620 AntiVM.exe Token: SeTakeOwnershipPrivilege 620 AntiVM.exe Token: SeLoadDriverPrivilege 620 AntiVM.exe Token: SeSystemProfilePrivilege 620 AntiVM.exe Token: SeSystemtimePrivilege 620 AntiVM.exe Token: SeProfSingleProcessPrivilege 620 AntiVM.exe Token: SeIncBasePriorityPrivilege 620 AntiVM.exe Token: SeCreatePagefilePrivilege 620 AntiVM.exe Token: SeBackupPrivilege 620 AntiVM.exe Token: SeRestorePrivilege 620 AntiVM.exe Token: SeShutdownPrivilege 620 AntiVM.exe Token: SeDebugPrivilege 620 AntiVM.exe Token: SeSystemEnvironmentPrivilege 620 AntiVM.exe Token: SeChangeNotifyPrivilege 620 AntiVM.exe Token: SeRemoteShutdownPrivilege 620 AntiVM.exe Token: SeUndockPrivilege 620 AntiVM.exe Token: SeManageVolumePrivilege 620 AntiVM.exe Token: SeImpersonatePrivilege 620 AntiVM.exe Token: SeCreateGlobalPrivilege 620 AntiVM.exe Token: 33 620 AntiVM.exe Token: 34 620 AntiVM.exe Token: 35 620 AntiVM.exe Token: 36 620 AntiVM.exe Token: SeIncreaseQuotaPrivilege 3500 ANTIVM.EXE Token: SeSecurityPrivilege 3500 ANTIVM.EXE Token: SeTakeOwnershipPrivilege 3500 ANTIVM.EXE Token: SeLoadDriverPrivilege 3500 ANTIVM.EXE Token: SeSystemProfilePrivilege 3500 ANTIVM.EXE Token: SeSystemtimePrivilege 3500 ANTIVM.EXE Token: SeProfSingleProcessPrivilege 3500 ANTIVM.EXE Token: SeIncBasePriorityPrivilege 3500 ANTIVM.EXE Token: SeCreatePagefilePrivilege 3500 ANTIVM.EXE Token: SeBackupPrivilege 3500 ANTIVM.EXE Token: SeRestorePrivilege 3500 ANTIVM.EXE Token: SeShutdownPrivilege 3500 ANTIVM.EXE Token: SeDebugPrivilege 3500 ANTIVM.EXE Token: SeSystemEnvironmentPrivilege 3500 ANTIVM.EXE Token: SeChangeNotifyPrivilege 3500 ANTIVM.EXE Token: SeRemoteShutdownPrivilege 3500 ANTIVM.EXE Token: SeUndockPrivilege 3500 ANTIVM.EXE Token: SeManageVolumePrivilege 3500 ANTIVM.EXE Token: SeImpersonatePrivilege 3500 ANTIVM.EXE Token: SeCreateGlobalPrivilege 3500 ANTIVM.EXE Token: 33 3500 ANTIVM.EXE Token: 34 3500 ANTIVM.EXE Token: 35 3500 ANTIVM.EXE Token: 36 3500 ANTIVM.EXE Token: SeIncreaseQuotaPrivilege 2752 msdcsc.exe Token: SeSecurityPrivilege 2752 msdcsc.exe Token: SeTakeOwnershipPrivilege 2752 msdcsc.exe Token: SeLoadDriverPrivilege 2752 msdcsc.exe Token: SeSystemProfilePrivilege 2752 msdcsc.exe Token: SeSystemtimePrivilege 2752 msdcsc.exe Token: SeProfSingleProcessPrivilege 2752 msdcsc.exe Token: SeIncBasePriorityPrivilege 2752 msdcsc.exe Token: SeCreatePagefilePrivilege 2752 msdcsc.exe Token: SeBackupPrivilege 2752 msdcsc.exe Token: SeRestorePrivilege 2752 msdcsc.exe Token: SeShutdownPrivilege 2752 msdcsc.exe Token: SeDebugPrivilege 2752 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2752 msdcsc.exe Token: SeChangeNotifyPrivilege 2752 msdcsc.exe Token: SeRemoteShutdownPrivilege 2752 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ANTIVM.EXEpid process 3500 ANTIVM.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
AntiVM.exedescription pid process target process PID 620 wrote to memory of 3500 620 AntiVM.exe ANTIVM.EXE PID 620 wrote to memory of 3500 620 AntiVM.exe ANTIVM.EXE PID 620 wrote to memory of 3500 620 AntiVM.exe ANTIVM.EXE PID 620 wrote to memory of 2752 620 AntiVM.exe msdcsc.exe PID 620 wrote to memory of 2752 620 AntiVM.exe msdcsc.exe PID 620 wrote to memory of 2752 620 AntiVM.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AntiVM.exe"C:\Users\Admin\AppData\Local\Temp\AntiVM.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ANTIVM.EXE"C:\Users\Admin\AppData\Local\Temp\ANTIVM.EXE"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
SHA1df93956e25c6f799f5976d9e633c5646a2a20638
SHA2563249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
SHA5121859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
SHA1df93956e25c6f799f5976d9e633c5646a2a20638
SHA2563249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
SHA5121859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f
-
memory/620-114-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/2752-117-0x0000000000000000-mapping.dmp
-
memory/2752-120-0x00000000007B0000-0x00000000008FA000-memory.dmpFilesize
1.3MB
-
memory/3500-115-0x0000000000000000-mapping.dmp
-
memory/3500-119-0x00000000023C0000-0x00000000023C1000-memory.dmpFilesize
4KB