a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91

Resubmissions

26-07-2022 07:12

220726-h1ld8sehcq 10

24-02-2022 11:15

220224-nczjvachd8 8

02-08-2021 09:23

210802-dz94clans6 8

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
02-08-2021 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Size

497KB
MD5

23595373d96bdbaf4a1361971aa96539
SHA1

020b0f179386a5ceee09e042ed7818ee42b2eba8
SHA256

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
SHA512

7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3564	mcinsupd.exe
208	mcinsupd.exe

Loads dropped DLL 2 IoCs

pid	Process
3564	mcinsupd.exe
208	mcinsupd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	mcinsupd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\McAfee VirusScan API Daily Update Module = "\"C:\\Users\\Admin\\McAfee VirusScan API Daily Update Module\\mcinsupd.exe\" 600 0"	mcinsupd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\KET.FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 38003800360030003700330036003100330037003100330045004600360043000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4076	svchost.exe
4076	svchost.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4076	svchost.exe
744	rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	mcinsupd.exe
Token: SeTcbPrivilege	3564	mcinsupd.exe
Token: SeDebugPrivilege	208	mcinsupd.exe
Token: SeTcbPrivilege	208	mcinsupd.exe
Token: SeDebugPrivilege	4076	svchost.exe
Token: SeTcbPrivilege	4076	svchost.exe
Token: SeDebugPrivilege	744	rundll32.exe
Token: SeTcbPrivilege	744	rundll32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3564	3908	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	75
PID 3908 wrote to memory of 3564	3908	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	75
PID 3908 wrote to memory of 3564	3908	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	75
PID 3564 wrote to memory of 208	3564	mcinsupd.exe	77
PID 3564 wrote to memory of 208	3564	mcinsupd.exe	77
PID 3564 wrote to memory of 208	3564	mcinsupd.exe	77
PID 208 wrote to memory of 4076	208	mcinsupd.exe	79
PID 208 wrote to memory of 4076	208	mcinsupd.exe	79
PID 208 wrote to memory of 4076	208	mcinsupd.exe	79
PID 208 wrote to memory of 4076	208	mcinsupd.exe	79
PID 208 wrote to memory of 4076	208	mcinsupd.exe	79
PID 208 wrote to memory of 4076	208	mcinsupd.exe	79
PID 208 wrote to memory of 4076	208	mcinsupd.exe	79
PID 208 wrote to memory of 4076	208	mcinsupd.exe	79
PID 4076 wrote to memory of 744	4076	svchost.exe	82
PID 4076 wrote to memory of 744	4076	svchost.exe	82
PID 4076 wrote to memory of 744	4076	svchost.exe	82
PID 4076 wrote to memory of 744	4076	svchost.exe	82
PID 4076 wrote to memory of 744	4076	svchost.exe	82
PID 4076 wrote to memory of 744	4076	svchost.exe	82
PID 4076 wrote to memory of 744	4076	svchost.exe	82
PID 4076 wrote to memory of 744	4076	svchost.exe	82

C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe
    "C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe" 600 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe 601 0
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe 609 4076
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-129-0x0000000000440000-0x00000000004EE000-memory.dmp

Filesize
696KB

Download
memory/208-130-0x0000000002100000-0x0000000002135000-memory.dmp

Filesize
212KB

Download
memory/744-134-0x00000000008F0000-0x0000000000A3A000-memory.dmp

Filesize
1.3MB

Download
memory/3564-127-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/3564-128-0x00000000020C0000-0x00000000020F5000-memory.dmp

Filesize
212KB

Download
memory/4076-131-0x0000000000C10000-0x0000000000C12000-memory.dmp

Filesize
8KB

Download
memory/4076-132-0x0000000000D60000-0x0000000000D95000-memory.dmp

Filesize
212KB

Download