a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91

Resubmissions

26-07-2022 07:12

220726-h1ld8sehcq 10

24-02-2022 11:15

220224-nczjvachd8 8

02-08-2021 09:23

210802-dz94clans6 8

Analysis

max time kernel
149s
max time network
186s
platform
windows7_x64
resource
win7v20210408
submitted
02-08-2021 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Size

497KB
MD5

23595373d96bdbaf4a1361971aa96539
SHA1

020b0f179386a5ceee09e042ed7818ee42b2eba8
SHA256

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
SHA512

7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

mcinsupd.exemcinsupd.exe

pid process

1848 mcinsupd.exe
1036 mcinsupd.exe

pid	process
1848	mcinsupd.exe
1036	mcinsupd.exe

Loads dropped DLL 6 IoCs

Processes:

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exemcinsupd.exemcinsupd.exe

pid	process
2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
1848	mcinsupd.exe
1036	mcinsupd.exe

Drops file in Program Files directory 7 IoCs

Processes:

mcinsupd.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll	mcinsupd.exe
File created	C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll	mcinsupd.exe
File opened for modification	C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat	mcinsupd.exe
File created	C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat	mcinsupd.exe
File opened for modification	C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe	mcinsupd.exe
File created	C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe	mcinsupd.exe
File opened for modification	C:\Program Files (x86)\McAfee VirusScan	mcinsupd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\aa-42-f0-13-0a-82	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 20a852819087d701	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = e0fca3939087d701	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = c0677e6e9087d701	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 807a73a69087d701	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDetectedUrl	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = 20a852819087d701	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = e0fca3939087d701	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = 807a73a69087d701	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = c0677e6e9087d701	svchost.exe

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\KET.FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 34004500340041004100380042003100360037003800410036003400310041000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exerundll32.exe

pid	process
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
1308	svchost.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
1308	svchost.exe
1308	svchost.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
1308	svchost.exe
1308	svchost.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
1308	svchost.exe
1308	svchost.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
1308	svchost.exe
1308	svchost.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
916	rundll32.exe
1308	svchost.exe
1308	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exerundll32.exe

pid process

1308 svchost.exe
916 rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

mcinsupd.exemcinsupd.exesvchost.exerundll32.exe

description	pid	process
Token: SeDebugPrivilege	1848	mcinsupd.exe
Token: SeTcbPrivilege	1848	mcinsupd.exe
Token: SeDebugPrivilege	1036	mcinsupd.exe
Token: SeTcbPrivilege	1036	mcinsupd.exe
Token: SeDebugPrivilege	1308	svchost.exe
Token: SeTcbPrivilege	1308	svchost.exe
Token: SeDebugPrivilege	916	rundll32.exe
Token: SeTcbPrivilege	916	rundll32.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exemcinsupd.exesvchost.exe

description	pid	process	target process
PID 2004 wrote to memory of 1848	2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 2004 wrote to memory of 1848	2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 2004 wrote to memory of 1848	2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 2004 wrote to memory of 1848	2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 2004 wrote to memory of 1848	2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 2004 wrote to memory of 1848	2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 2004 wrote to memory of 1848	2004	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1036 wrote to memory of 1308	1036	mcinsupd.exe	svchost.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe
PID 1308 wrote to memory of 916	1308	svchost.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe
"C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe" 600 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe 601 0
2⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe 609 1308
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat
MD5
87443239386f6bbc435fe0d8e92a0cec

SHA1
068a0a8a25cb8eacd249ffd9c853a70630c7a7ac

SHA256
170f6b0a434e0688e43c14596948afe2b5f09cb4a4a1910f8dd9f3ee3848964c

SHA512
67d13d7e3c5183ac09515ad4da254ff7dff946c192d072d69d48c1489f144749f9f4eb42a62fd99550e94e6b20b0911ac31416e331489b8e07cc6b5b5135dafb

Download Submit
C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll
MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dat
MD5
87443239386f6bbc435fe0d8e92a0cec

SHA1
068a0a8a25cb8eacd249ffd9c853a70630c7a7ac

SHA256
170f6b0a434e0688e43c14596948afe2b5f09cb4a4a1910f8dd9f3ee3848964c

SHA512
67d13d7e3c5183ac09515ad4da254ff7dff946c192d072d69d48c1489f144749f9f4eb42a62fd99550e94e6b20b0911ac31416e331489b8e07cc6b5b5135dafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll
MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
\Program Files (x86)\McAfee VirusScan\mytilus3.dll
MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll
MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
memory/916-85-0x0000000000250000-0x0000000000285000-memory.dmp

Filesize
212KB

Download
memory/916-83-0x0000000000000000-mapping.dmp

Download
memory/1036-80-0x0000000000240000-0x00000000002E0000-memory.dmp

Filesize
640KB

Download
memory/1308-76-0x0000000000000000-mapping.dmp

Download
memory/1308-81-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/1308-82-0x00000000001C0000-0x00000000001F5000-memory.dmp

Filesize
212KB

Download
memory/1848-79-0x0000000000380000-0x00000000003B5000-memory.dmp

Filesize
212KB

Download
memory/1848-78-0x0000000000250000-0x000000000026F000-memory.dmp

Filesize
124KB

Download
memory/1848-64-0x0000000000000000-mapping.dmp

Download
memory/2004-59-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download