Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-06-2021 08:03
Static task
static1
Behavioral task
behavioral1
Sample
opengl installer.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
opengl installer.exe
-
Size
252KB
-
MD5
ad987dd8602b2b78090a08f73212a7a0
-
SHA1
4cc227c83d1403a29c2f68ef0afe12725e0dc996
-
SHA256
5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
-
SHA512
248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\msdcsc.exe" opengl installer.exe -
Disables RegEdit via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1900 msdcsc.exe -
resource yara_rule behavioral2/files/0x000200000001ab41-116.dat upx behavioral2/files/0x000200000001ab41-117.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\msdcsc.exe" opengl installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 808 opengl installer.exe Token: SeSecurityPrivilege 808 opengl installer.exe Token: SeTakeOwnershipPrivilege 808 opengl installer.exe Token: SeLoadDriverPrivilege 808 opengl installer.exe Token: SeSystemProfilePrivilege 808 opengl installer.exe Token: SeSystemtimePrivilege 808 opengl installer.exe Token: SeProfSingleProcessPrivilege 808 opengl installer.exe Token: SeIncBasePriorityPrivilege 808 opengl installer.exe Token: SeCreatePagefilePrivilege 808 opengl installer.exe Token: SeBackupPrivilege 808 opengl installer.exe Token: SeRestorePrivilege 808 opengl installer.exe Token: SeShutdownPrivilege 808 opengl installer.exe Token: SeDebugPrivilege 808 opengl installer.exe Token: SeSystemEnvironmentPrivilege 808 opengl installer.exe Token: SeChangeNotifyPrivilege 808 opengl installer.exe Token: SeRemoteShutdownPrivilege 808 opengl installer.exe Token: SeUndockPrivilege 808 opengl installer.exe Token: SeManageVolumePrivilege 808 opengl installer.exe Token: SeImpersonatePrivilege 808 opengl installer.exe Token: SeCreateGlobalPrivilege 808 opengl installer.exe Token: 33 808 opengl installer.exe Token: 34 808 opengl installer.exe Token: 35 808 opengl installer.exe Token: 36 808 opengl installer.exe Token: SeIncreaseQuotaPrivilege 1900 msdcsc.exe Token: SeSecurityPrivilege 1900 msdcsc.exe Token: SeTakeOwnershipPrivilege 1900 msdcsc.exe Token: SeLoadDriverPrivilege 1900 msdcsc.exe Token: SeSystemProfilePrivilege 1900 msdcsc.exe Token: SeSystemtimePrivilege 1900 msdcsc.exe Token: SeProfSingleProcessPrivilege 1900 msdcsc.exe Token: SeIncBasePriorityPrivilege 1900 msdcsc.exe Token: SeCreatePagefilePrivilege 1900 msdcsc.exe Token: SeBackupPrivilege 1900 msdcsc.exe Token: SeRestorePrivilege 1900 msdcsc.exe Token: SeShutdownPrivilege 1900 msdcsc.exe Token: SeDebugPrivilege 1900 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1900 msdcsc.exe Token: SeChangeNotifyPrivilege 1900 msdcsc.exe Token: SeRemoteShutdownPrivilege 1900 msdcsc.exe Token: SeUndockPrivilege 1900 msdcsc.exe Token: SeManageVolumePrivilege 1900 msdcsc.exe Token: SeImpersonatePrivilege 1900 msdcsc.exe Token: SeCreateGlobalPrivilege 1900 msdcsc.exe Token: 33 1900 msdcsc.exe Token: 34 1900 msdcsc.exe Token: 35 1900 msdcsc.exe Token: 36 1900 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1900 msdcsc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 808 wrote to memory of 1900 808 opengl installer.exe 75 PID 808 wrote to memory of 1900 808 opengl installer.exe 75 PID 808 wrote to memory of 1900 808 opengl installer.exe 75 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76 PID 1900 wrote to memory of 3956 1900 msdcsc.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\opengl installer.exe"C:\Users\Admin\AppData\Local\Temp\opengl installer.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:3956
-
-