Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-05-2021 12:45
Static task
static1
Behavioral task
behavioral1
Sample
AntiVM.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
AntiVM.exe
Resource
win10v20210408
General
-
Target
AntiVM.exe
-
Size
837KB
-
MD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
-
SHA1
df93956e25c6f799f5976d9e633c5646a2a20638
-
SHA256
3249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
-
SHA512
1859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
AntiVM.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" AntiVM.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2832 msdcsc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ANTIVM.EXEmsdcsc.exeAntiVM.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" ANTIVM.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" AntiVM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AntiVM.exeANTIVM.EXEmsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 656 AntiVM.exe Token: SeSecurityPrivilege 656 AntiVM.exe Token: SeTakeOwnershipPrivilege 656 AntiVM.exe Token: SeLoadDriverPrivilege 656 AntiVM.exe Token: SeSystemProfilePrivilege 656 AntiVM.exe Token: SeSystemtimePrivilege 656 AntiVM.exe Token: SeProfSingleProcessPrivilege 656 AntiVM.exe Token: SeIncBasePriorityPrivilege 656 AntiVM.exe Token: SeCreatePagefilePrivilege 656 AntiVM.exe Token: SeBackupPrivilege 656 AntiVM.exe Token: SeRestorePrivilege 656 AntiVM.exe Token: SeShutdownPrivilege 656 AntiVM.exe Token: SeDebugPrivilege 656 AntiVM.exe Token: SeSystemEnvironmentPrivilege 656 AntiVM.exe Token: SeChangeNotifyPrivilege 656 AntiVM.exe Token: SeRemoteShutdownPrivilege 656 AntiVM.exe Token: SeUndockPrivilege 656 AntiVM.exe Token: SeManageVolumePrivilege 656 AntiVM.exe Token: SeImpersonatePrivilege 656 AntiVM.exe Token: SeCreateGlobalPrivilege 656 AntiVM.exe Token: 33 656 AntiVM.exe Token: 34 656 AntiVM.exe Token: 35 656 AntiVM.exe Token: 36 656 AntiVM.exe Token: SeIncreaseQuotaPrivilege 3132 ANTIVM.EXE Token: SeSecurityPrivilege 3132 ANTIVM.EXE Token: SeTakeOwnershipPrivilege 3132 ANTIVM.EXE Token: SeLoadDriverPrivilege 3132 ANTIVM.EXE Token: SeSystemProfilePrivilege 3132 ANTIVM.EXE Token: SeSystemtimePrivilege 3132 ANTIVM.EXE Token: SeProfSingleProcessPrivilege 3132 ANTIVM.EXE Token: SeIncBasePriorityPrivilege 3132 ANTIVM.EXE Token: SeCreatePagefilePrivilege 3132 ANTIVM.EXE Token: SeBackupPrivilege 3132 ANTIVM.EXE Token: SeRestorePrivilege 3132 ANTIVM.EXE Token: SeShutdownPrivilege 3132 ANTIVM.EXE Token: SeDebugPrivilege 3132 ANTIVM.EXE Token: SeSystemEnvironmentPrivilege 3132 ANTIVM.EXE Token: SeChangeNotifyPrivilege 3132 ANTIVM.EXE Token: SeRemoteShutdownPrivilege 3132 ANTIVM.EXE Token: SeUndockPrivilege 3132 ANTIVM.EXE Token: SeManageVolumePrivilege 3132 ANTIVM.EXE Token: SeImpersonatePrivilege 3132 ANTIVM.EXE Token: SeCreateGlobalPrivilege 3132 ANTIVM.EXE Token: 33 3132 ANTIVM.EXE Token: 34 3132 ANTIVM.EXE Token: 35 3132 ANTIVM.EXE Token: 36 3132 ANTIVM.EXE Token: SeIncreaseQuotaPrivilege 2832 msdcsc.exe Token: SeSecurityPrivilege 2832 msdcsc.exe Token: SeTakeOwnershipPrivilege 2832 msdcsc.exe Token: SeLoadDriverPrivilege 2832 msdcsc.exe Token: SeSystemProfilePrivilege 2832 msdcsc.exe Token: SeSystemtimePrivilege 2832 msdcsc.exe Token: SeProfSingleProcessPrivilege 2832 msdcsc.exe Token: SeIncBasePriorityPrivilege 2832 msdcsc.exe Token: SeCreatePagefilePrivilege 2832 msdcsc.exe Token: SeBackupPrivilege 2832 msdcsc.exe Token: SeRestorePrivilege 2832 msdcsc.exe Token: SeShutdownPrivilege 2832 msdcsc.exe Token: SeDebugPrivilege 2832 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2832 msdcsc.exe Token: SeChangeNotifyPrivilege 2832 msdcsc.exe Token: SeRemoteShutdownPrivilege 2832 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ANTIVM.EXEpid process 3132 ANTIVM.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
AntiVM.exedescription pid process target process PID 656 wrote to memory of 3132 656 AntiVM.exe ANTIVM.EXE PID 656 wrote to memory of 3132 656 AntiVM.exe ANTIVM.EXE PID 656 wrote to memory of 3132 656 AntiVM.exe ANTIVM.EXE PID 656 wrote to memory of 2832 656 AntiVM.exe msdcsc.exe PID 656 wrote to memory of 2832 656 AntiVM.exe msdcsc.exe PID 656 wrote to memory of 2832 656 AntiVM.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AntiVM.exe"C:\Users\Admin\AppData\Local\Temp\AntiVM.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\ANTIVM.EXE"C:\Users\Admin\AppData\Local\Temp\ANTIVM.EXE"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3132 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2832
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
SHA1df93956e25c6f799f5976d9e633c5646a2a20638
SHA2563249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
SHA5121859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f
-
MD5
003b08b0ce8bb863e5a9bcfa7a20a2a3
SHA1df93956e25c6f799f5976d9e633c5646a2a20638
SHA2563249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3
SHA5121859bebcbc7f0fa212e36acc7326c5a24d8d2c625a35a9b9c3e6b6f72a2132fc62d7403fa90e8f4e48baf8fc96e32697f37c83fd6fb3fd90dc60541e5bb4fc5f