a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91

Resubmissions

26-07-2022 07:12

220726-h1ld8sehcq 10

24-02-2022 11:15

220224-nczjvachd8 8

02-08-2021 09:23

210802-dz94clans6 8

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
02-08-2021 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Size

497KB
MD5

23595373d96bdbaf4a1361971aa96539
SHA1

020b0f179386a5ceee09e042ed7818ee42b2eba8
SHA256

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
SHA512

7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

mcinsupd.exemcinsupd.exe

pid process

3564 mcinsupd.exe
208 mcinsupd.exe
Loads dropped DLL 2 IoCs

Processes:

mcinsupd.exemcinsupd.exe

pid process

3564 mcinsupd.exe
208 mcinsupd.exe

pid	process
3564	mcinsupd.exe
208	mcinsupd.exe

pid	process
3564	mcinsupd.exe
208	mcinsupd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mcinsupd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	mcinsupd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\McAfee VirusScan API Daily Update Module = "\"C:\\Users\\Admin\\McAfee VirusScan API Daily Update Module\\mcinsupd.exe\" 600 0"	mcinsupd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\KET.FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 38003800360030003700330036003100330037003100330045004600360043000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exerundll32.exe

pid	process
4076	svchost.exe
4076	svchost.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
4076	svchost.exe
4076	svchost.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe
744	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exerundll32.exe

pid process

4076 svchost.exe
744 rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

mcinsupd.exemcinsupd.exesvchost.exerundll32.exe

description	pid	process
Token: SeDebugPrivilege	3564	mcinsupd.exe
Token: SeTcbPrivilege	3564	mcinsupd.exe
Token: SeDebugPrivilege	208	mcinsupd.exe
Token: SeTcbPrivilege	208	mcinsupd.exe
Token: SeDebugPrivilege	4076	svchost.exe
Token: SeTcbPrivilege	4076	svchost.exe
Token: SeDebugPrivilege	744	rundll32.exe
Token: SeTcbPrivilege	744	rundll32.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exemcinsupd.exemcinsupd.exesvchost.exe

description	pid	process	target process
PID 3908 wrote to memory of 3564	3908	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 3908 wrote to memory of 3564	3908	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 3908 wrote to memory of 3564	3908	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	mcinsupd.exe
PID 3564 wrote to memory of 208	3564	mcinsupd.exe	mcinsupd.exe
PID 3564 wrote to memory of 208	3564	mcinsupd.exe	mcinsupd.exe
PID 3564 wrote to memory of 208	3564	mcinsupd.exe	mcinsupd.exe
PID 208 wrote to memory of 4076	208	mcinsupd.exe	svchost.exe
PID 208 wrote to memory of 4076	208	mcinsupd.exe	svchost.exe
PID 208 wrote to memory of 4076	208	mcinsupd.exe	svchost.exe
PID 208 wrote to memory of 4076	208	mcinsupd.exe	svchost.exe
PID 208 wrote to memory of 4076	208	mcinsupd.exe	svchost.exe
PID 208 wrote to memory of 4076	208	mcinsupd.exe	svchost.exe
PID 208 wrote to memory of 4076	208	mcinsupd.exe	svchost.exe
PID 208 wrote to memory of 4076	208	mcinsupd.exe	svchost.exe
PID 4076 wrote to memory of 744	4076	svchost.exe	rundll32.exe
PID 4076 wrote to memory of 744	4076	svchost.exe	rundll32.exe
PID 4076 wrote to memory of 744	4076	svchost.exe	rundll32.exe
PID 4076 wrote to memory of 744	4076	svchost.exe	rundll32.exe
PID 4076 wrote to memory of 744	4076	svchost.exe	rundll32.exe
PID 4076 wrote to memory of 744	4076	svchost.exe	rundll32.exe
PID 4076 wrote to memory of 744	4076	svchost.exe	rundll32.exe
PID 4076 wrote to memory of 744	4076	svchost.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564

C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe
"C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe" 600 0
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe 601 0
4⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe 609 4076
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dat
MD5
87443239386f6bbc435fe0d8e92a0cec

SHA1
068a0a8a25cb8eacd249ffd9c853a70630c7a7ac

SHA256
170f6b0a434e0688e43c14596948afe2b5f09cb4a4a1910f8dd9f3ee3848964c

SHA512
67d13d7e3c5183ac09515ad4da254ff7dff946c192d072d69d48c1489f144749f9f4eb42a62fd99550e94e6b20b0911ac31416e331489b8e07cc6b5b5135dafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll
MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe
MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Users\Admin\McAfee VirusScan API Daily Update Module\mytilus3.dat
MD5
87443239386f6bbc435fe0d8e92a0cec

SHA1
068a0a8a25cb8eacd249ffd9c853a70630c7a7ac

SHA256
170f6b0a434e0688e43c14596948afe2b5f09cb4a4a1910f8dd9f3ee3848964c

SHA512
67d13d7e3c5183ac09515ad4da254ff7dff946c192d072d69d48c1489f144749f9f4eb42a62fd99550e94e6b20b0911ac31416e331489b8e07cc6b5b5135dafb

Download Submit
C:\Users\Admin\McAfee VirusScan API Daily Update Module\mytilus3.dll
MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll
MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
\Users\Admin\McAfee VirusScan API Daily Update Module\mytilus3.dll
MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
memory/208-129-0x0000000000440000-0x00000000004EE000-memory.dmp

Filesize
696KB

Download
memory/208-120-0x0000000000000000-mapping.dmp

Download
memory/208-130-0x0000000002100000-0x0000000002135000-memory.dmp

Filesize
212KB

Download
memory/744-134-0x00000000008F0000-0x0000000000A3A000-memory.dmp

Filesize
1.3MB

Download
memory/744-133-0x0000000000000000-mapping.dmp

Download
memory/3564-127-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/3564-128-0x00000000020C0000-0x00000000020F5000-memory.dmp

Filesize
212KB

Download
memory/3564-114-0x0000000000000000-mapping.dmp

Download
memory/4076-131-0x0000000000C10000-0x0000000000C12000-memory.dmp

Filesize
8KB

Download
memory/4076-132-0x0000000000D60000-0x0000000000D95000-memory.dmp

Filesize
212KB

Download
memory/4076-126-0x0000000000000000-mapping.dmp

Download