Analysis
-
max time kernel
150s -
max time network
174s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 08:04
Static task
static1
Behavioral task
behavioral1
Sample
6c6a951636ae4dee7a842c6af1d43236.exe
Resource
win7v20210410
General
-
Target
6c6a951636ae4dee7a842c6af1d43236.exe
-
Size
1.2MB
-
MD5
6c6a951636ae4dee7a842c6af1d43236
-
SHA1
387e2f026ca3ec2a291b09fa76f88fe40ae7007c
-
SHA256
2ebc7cf945c4eba60eb0f25f6b58eb8d7d0558f6b5622530b2b3808987173952
-
SHA512
3324a70e328be9cdbbe60f47da1254208032b73e6b48cbfea9d070b50378a1ed0f6df32b62c3b16712b78ddcaa0b696ee196f8e9448c3b0f025a9f1d36857311
Malware Config
Extracted
darkcomet
ADSAW
secret92.ddns.net:82
DC_MUTEX-TAUBLES
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
4ltiP4nFeytX
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
darknj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" darknj.exe -
Executes dropped EXE 5 IoCs
Processes:
R-Launcher.exedarknj.exeNJ.EXEmsdcsc.exeWindowsServices.exepid process 1980 R-Launcher.exe 1948 darknj.exe 1168 NJ.EXE 752 msdcsc.exe 1860 WindowsServices.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
WindowsServices.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf6e0aafbf214c3565426c44740c8dce.exe WindowsServices.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf6e0aafbf214c3565426c44740c8dce.exe WindowsServices.exe -
Loads dropped DLL 8 IoCs
Processes:
6c6a951636ae4dee7a842c6af1d43236.exedarknj.exeNJ.EXEpid process 1820 6c6a951636ae4dee7a842c6af1d43236.exe 1820 6c6a951636ae4dee7a842c6af1d43236.exe 1820 6c6a951636ae4dee7a842c6af1d43236.exe 1820 6c6a951636ae4dee7a842c6af1d43236.exe 1948 darknj.exe 1948 darknj.exe 1948 darknj.exe 1168 NJ.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
darknj.exemsdcsc.exeWindowsServices.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" darknj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\cf6e0aafbf214c3565426c44740c8dce = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .." WindowsServices.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cf6e0aafbf214c3565426c44740c8dce = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .." WindowsServices.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "122" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "209" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "276" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "333" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064e463d9293d4143bd14e3345f65ac8600000000020000000000106600000001000020000000c997c4386f40ff93550657245277d60eea5b37903dd0dbcf85f7560522caf520000000000e800000000200002000000069d2acd76f26318ba944d6eed6103b706e0aca998955fd08391da2cdced1014a200100007e644b94a4eb41e0a454ac5c018685b5b5047a2904852b5069b66f77ace50b52a61c21d8f909a2a90b85473f1b2cdc33b0e55176105538e996803562a04572bad5204d767b7166225ab995f0c248ce406d185dbaaefe395f5b6c0ba76f05e0afb08b564f1268be8f09af1589efab6317667bae7d87bfdb6559115c2f733d3e0613ac9d0a8c38e036b2aee03be290f23effe81b638a7d77aef5f93f64705c42de2f9e8ec8d4708eb3779da354b49067b496b0a4f8a0ee9435a76f85e3cdba685cc08f86853a6aeb5a6e44d60b33abfcf5a8610f984669e70ec5ea78d8458f310ad81ce1f40d56a93214b43d87b494e5fe60dced2e3cca15f70e1f3a606195f1d04523be75979b8ff074a30d67c96edc1c90d1e39c209d4b6e6e94d4634279df0540000000a774037caab474875cbeef2cad4706ef83168de071d27fce6d6c6fb26b88e211e9711c15c07ba7c9e79ccc812d3b68692f098e17596cf81c1af55a4c95f00b93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "333" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "333" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "209" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "276" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "333706268" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "276" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064e463d9293d4143bd14e3345f65ac8600000000020000000000106600000001000020000000e419290e9c934eafc812517151000341dcd462a927c068a5ec19608c0be6985c000000000e8000000002000020000000333a08088de63b4e94f612dda907e1a30f0f90653af8333fbac54597338a4c44200000006d3e64d1ede7ed75629ba2973851c0d034b70f1e61e9d127978db549ea7f3ba6400000006fd53790b4cde96c56c71a21a01fa6af00e8483f3f02c56595aa8953305a152892eaf80a309f7ce7cf5f82966cf1a4d8bc3f64c5101b3ddd239e80ece02d52f3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "209" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "229" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\trustarc.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "22" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "229" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "229" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F66AD391-EAC3-11EB-849A-C2EBB310CB62} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "22" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\trustarc.com IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02cf8cdd07ed701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "122" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
NJ.EXEpid process 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE 1168 NJ.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 752 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
darknj.exeNJ.EXEmsdcsc.exeWindowsServices.exedescription pid process Token: SeIncreaseQuotaPrivilege 1948 darknj.exe Token: SeSecurityPrivilege 1948 darknj.exe Token: SeTakeOwnershipPrivilege 1948 darknj.exe Token: SeLoadDriverPrivilege 1948 darknj.exe Token: SeSystemProfilePrivilege 1948 darknj.exe Token: SeSystemtimePrivilege 1948 darknj.exe Token: SeProfSingleProcessPrivilege 1948 darknj.exe Token: SeIncBasePriorityPrivilege 1948 darknj.exe Token: SeCreatePagefilePrivilege 1948 darknj.exe Token: SeBackupPrivilege 1948 darknj.exe Token: SeRestorePrivilege 1948 darknj.exe Token: SeShutdownPrivilege 1948 darknj.exe Token: SeDebugPrivilege 1948 darknj.exe Token: SeSystemEnvironmentPrivilege 1948 darknj.exe Token: SeChangeNotifyPrivilege 1948 darknj.exe Token: SeRemoteShutdownPrivilege 1948 darknj.exe Token: SeUndockPrivilege 1948 darknj.exe Token: SeManageVolumePrivilege 1948 darknj.exe Token: SeImpersonatePrivilege 1948 darknj.exe Token: SeCreateGlobalPrivilege 1948 darknj.exe Token: 33 1948 darknj.exe Token: 34 1948 darknj.exe Token: 35 1948 darknj.exe Token: SeDebugPrivilege 1168 NJ.EXE Token: SeIncreaseQuotaPrivilege 752 msdcsc.exe Token: SeSecurityPrivilege 752 msdcsc.exe Token: SeTakeOwnershipPrivilege 752 msdcsc.exe Token: SeLoadDriverPrivilege 752 msdcsc.exe Token: SeSystemProfilePrivilege 752 msdcsc.exe Token: SeSystemtimePrivilege 752 msdcsc.exe Token: SeProfSingleProcessPrivilege 752 msdcsc.exe Token: SeIncBasePriorityPrivilege 752 msdcsc.exe Token: SeCreatePagefilePrivilege 752 msdcsc.exe Token: SeBackupPrivilege 752 msdcsc.exe Token: SeRestorePrivilege 752 msdcsc.exe Token: SeShutdownPrivilege 752 msdcsc.exe Token: SeDebugPrivilege 752 msdcsc.exe Token: SeSystemEnvironmentPrivilege 752 msdcsc.exe Token: SeChangeNotifyPrivilege 752 msdcsc.exe Token: SeRemoteShutdownPrivilege 752 msdcsc.exe Token: SeUndockPrivilege 752 msdcsc.exe Token: SeManageVolumePrivilege 752 msdcsc.exe Token: SeImpersonatePrivilege 752 msdcsc.exe Token: SeCreateGlobalPrivilege 752 msdcsc.exe Token: 33 752 msdcsc.exe Token: 34 752 msdcsc.exe Token: 35 752 msdcsc.exe Token: SeDebugPrivilege 1860 WindowsServices.exe Token: 33 1860 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1860 WindowsServices.exe Token: 33 1860 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1860 WindowsServices.exe Token: 33 1860 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1860 WindowsServices.exe Token: 33 1860 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1860 WindowsServices.exe Token: 33 1860 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1860 WindowsServices.exe Token: 33 1860 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1860 WindowsServices.exe Token: 33 1860 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1860 WindowsServices.exe Token: 33 1860 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1860 WindowsServices.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
msdcsc.exeiexplore.exeIEXPLORE.EXEpid process 752 msdcsc.exe 2028 iexplore.exe 2028 iexplore.exe 1432 IEXPLORE.EXE 1432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c6a951636ae4dee7a842c6af1d43236.exedarknj.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1820 wrote to memory of 1980 1820 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 1820 wrote to memory of 1980 1820 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 1820 wrote to memory of 1980 1820 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 1820 wrote to memory of 1980 1820 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 1820 wrote to memory of 1980 1820 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 1820 wrote to memory of 1980 1820 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 1820 wrote to memory of 1980 1820 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 1820 wrote to memory of 1948 1820 6c6a951636ae4dee7a842c6af1d43236.exe darknj.exe PID 1820 wrote to memory of 1948 1820 6c6a951636ae4dee7a842c6af1d43236.exe darknj.exe PID 1820 wrote to memory of 1948 1820 6c6a951636ae4dee7a842c6af1d43236.exe darknj.exe PID 1820 wrote to memory of 1948 1820 6c6a951636ae4dee7a842c6af1d43236.exe darknj.exe PID 1948 wrote to memory of 1788 1948 darknj.exe cmd.exe PID 1948 wrote to memory of 1788 1948 darknj.exe cmd.exe PID 1948 wrote to memory of 1788 1948 darknj.exe cmd.exe PID 1948 wrote to memory of 1788 1948 darknj.exe cmd.exe PID 1948 wrote to memory of 1724 1948 darknj.exe cmd.exe PID 1948 wrote to memory of 1724 1948 darknj.exe cmd.exe PID 1948 wrote to memory of 1724 1948 darknj.exe cmd.exe PID 1948 wrote to memory of 1724 1948 darknj.exe cmd.exe PID 1788 wrote to memory of 1364 1788 cmd.exe attrib.exe PID 1788 wrote to memory of 1364 1788 cmd.exe attrib.exe PID 1788 wrote to memory of 1364 1788 cmd.exe attrib.exe PID 1788 wrote to memory of 1364 1788 cmd.exe attrib.exe PID 1948 wrote to memory of 1168 1948 darknj.exe NJ.EXE PID 1948 wrote to memory of 1168 1948 darknj.exe NJ.EXE PID 1948 wrote to memory of 1168 1948 darknj.exe NJ.EXE PID 1948 wrote to memory of 1168 1948 darknj.exe NJ.EXE PID 1724 wrote to memory of 1240 1724 cmd.exe attrib.exe PID 1724 wrote to memory of 1240 1724 cmd.exe attrib.exe PID 1724 wrote to memory of 1240 1724 cmd.exe attrib.exe PID 1724 wrote to memory of 1240 1724 cmd.exe attrib.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 1252 1948 darknj.exe notepad.exe PID 1948 wrote to memory of 752 1948 darknj.exe msdcsc.exe PID 1948 wrote to memory of 752 1948 darknj.exe msdcsc.exe PID 1948 wrote to memory of 752 1948 darknj.exe msdcsc.exe PID 1948 wrote to memory of 752 1948 darknj.exe msdcsc.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe PID 752 wrote to memory of 1524 752 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1364 attrib.exe 1240 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c6a951636ae4dee7a842c6af1d43236.exe"C:\Users\Admin\AppData\Local\Temp\6c6a951636ae4dee7a842c6af1d43236.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\darknj.exe"C:\Users\Admin\AppData\Local\Temp\darknj.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXE"C:\Users\Admin\AppData\Local\Temp\NJ.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exe"C:\Users\Admin\AppData\Roaming\WindowsServices.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\WindowsServices.exe" "WindowsServices.exe" ENABLE5⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015MD5
2902de11e30dcc620b184e3bb0f0c1cb
SHA15d11d14a2558801a2688dc2d6dfad39ac294f222
SHA256e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544
SHA512efd415cde25b827ac2a7ca4d6486ce3a43cdcc1c31d3a94fd7944681aa3e83a4966625bf2e6770581c4b59d05e35ff9318d9adaddade9070f131076892af2fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
d24ea0e6fc2f548a03bea6b1c10783fc
SHA1af4d3e7ba838b336a991756af35683da0ddfda72
SHA256a2b73a80fef0a9ce87e87f6f6d19d70ce566bb31d1ffc7872f559abb7b5b4125
SHA5122b4e7feea3ea3f5875a15dc3bbfbddb699a29745398dba1f51a23e3a34949f53b5fd0fec2e78538a1b3762ea46f66540ea3f69b723998d4d415e2004668f162e
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sgyae4t\imagestore.datMD5
f6cd1bcd4e9a0990490d57f1e89b2ce6
SHA148fabaee02577bff18797bcaf08e5a0d4f444a21
SHA25628479cd6ee5e85d6d7c81983ece7772f39140941e9ab3c85636f49dd76c97e69
SHA5122e78968ff2e8724f90e0d4e538276c0cd28eeb6173f9971a406d515645608e9dd4cd839a44faad857d482f687d321e6f67a9114c0ede9779738f8fde6992071f
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
C:\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
C:\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
C:\Users\Admin\AppData\Local\Temp\darknj.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
C:\Users\Admin\AppData\Local\Temp\darknj.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MO55EVN6.txtMD5
ec84659dd308144c2b8772179cec344c
SHA1a97805cf4b8720aa9101f182fb18f582d78f7ac2
SHA25690da5fb52e4d4cdb53a451e71d4fb8497f35c8af235402c2fe1df72ae2ca11b4
SHA5128ba761bcd0c076f303b3a852e21e5fe755af2f144fa93180536cb72375886187093babb069a6fb8e42f927761761769cf73bf5090cb33af1d863c8f2a580aed3
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exeMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exeMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
\Users\Admin\AppData\Local\Temp\darknj.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
\Users\Admin\AppData\Local\Temp\darknj.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
\Users\Admin\AppData\Roaming\WindowsServices.exeMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
memory/320-106-0x0000000000000000-mapping.dmp
-
memory/752-93-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/752-88-0x0000000000000000-mapping.dmp
-
memory/1168-77-0x0000000000000000-mapping.dmp
-
memory/1168-84-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB
-
memory/1240-78-0x0000000000000000-mapping.dmp
-
memory/1252-85-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1252-82-0x0000000000000000-mapping.dmp
-
memory/1364-75-0x0000000000000000-mapping.dmp
-
memory/1432-97-0x0000000000000000-mapping.dmp
-
memory/1524-91-0x0000000000000000-mapping.dmp
-
memory/1524-94-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1724-74-0x0000000000000000-mapping.dmp
-
memory/1788-73-0x0000000000000000-mapping.dmp
-
memory/1820-59-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1860-100-0x0000000000000000-mapping.dmp
-
memory/1860-104-0x0000000002120000-0x0000000002121000-memory.dmpFilesize
4KB
-
memory/1948-71-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1948-68-0x0000000000000000-mapping.dmp
-
memory/1980-62-0x0000000000000000-mapping.dmp
-
memory/2028-96-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmpFilesize
8KB
-
memory/2028-95-0x0000000000000000-mapping.dmp