1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c

Resubmissions

23/01/2022, 16:46

220123-t96bjsgbem 10

17/01/2022, 19:00

220117-xntbmsccfp 8

Analysis

max time kernel
4265511s
max time network
565s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
17/01/2022, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

msg.exe
Size

392KB
MD5

d90d0f4d6dad402b5d025987030cc87c
SHA1

fad66bdf5c5dc2c050cbc574832c6995dba086a0
SHA256

1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c
SHA512

c2faeacfd588585633630ad710f443a72c7617c2d5e37dbfe43570e6ac5904e4b81eb682356a48a93bb794ef5e9d8ad0d673966d57798079b4de62ea61241024

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2096	igfxCUIService.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	msg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	igfxCUIService.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\igfxCUIService = "C:\\ProgramData\\SystemData\\igfxCUIService.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1804	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2180	powershell.exe
2180	powershell.exe
3368	powershell.exe
3368	powershell.exe
3784	powershell.exe
3784	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2980	MusNotification.exe
Token: SeCreatePagefilePrivilege	2980	MusNotification.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeIncreaseQuotaPrivilege	1908	WMIC.exe
Token: SeSecurityPrivilege	1908	WMIC.exe
Token: SeTakeOwnershipPrivilege	1908	WMIC.exe
Token: SeLoadDriverPrivilege	1908	WMIC.exe
Token: SeSystemProfilePrivilege	1908	WMIC.exe
Token: SeSystemtimePrivilege	1908	WMIC.exe
Token: SeProfSingleProcessPrivilege	1908	WMIC.exe
Token: SeIncBasePriorityPrivilege	1908	WMIC.exe
Token: SeCreatePagefilePrivilege	1908	WMIC.exe
Token: SeBackupPrivilege	1908	WMIC.exe
Token: SeRestorePrivilege	1908	WMIC.exe
Token: SeShutdownPrivilege	1908	WMIC.exe
Token: SeDebugPrivilege	1908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1908	WMIC.exe
Token: SeRemoteShutdownPrivilege	1908	WMIC.exe
Token: SeUndockPrivilege	1908	WMIC.exe
Token: SeManageVolumePrivilege	1908	WMIC.exe
Token: 33	1908	WMIC.exe
Token: 34	1908	WMIC.exe
Token: 35	1908	WMIC.exe
Token: 36	1908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1908	WMIC.exe
Token: SeSecurityPrivilege	1908	WMIC.exe
Token: SeTakeOwnershipPrivilege	1908	WMIC.exe
Token: SeLoadDriverPrivilege	1908	WMIC.exe
Token: SeSystemProfilePrivilege	1908	WMIC.exe
Token: SeSystemtimePrivilege	1908	WMIC.exe
Token: SeProfSingleProcessPrivilege	1908	WMIC.exe
Token: SeIncBasePriorityPrivilege	1908	WMIC.exe
Token: SeCreatePagefilePrivilege	1908	WMIC.exe
Token: SeBackupPrivilege	1908	WMIC.exe
Token: SeRestorePrivilege	1908	WMIC.exe
Token: SeShutdownPrivilege	1908	WMIC.exe
Token: SeDebugPrivilege	1908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1908	WMIC.exe
Token: SeRemoteShutdownPrivilege	1908	WMIC.exe
Token: SeUndockPrivilege	1908	WMIC.exe
Token: SeManageVolumePrivilege	1908	WMIC.exe
Token: 33	1908	WMIC.exe
Token: 34	1908	WMIC.exe
Token: 35	1908	WMIC.exe
Token: 36	1908	WMIC.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeIncreaseQuotaPrivilege	2840	WMIC.exe
Token: SeSecurityPrivilege	2840	WMIC.exe
Token: SeTakeOwnershipPrivilege	2840	WMIC.exe
Token: SeLoadDriverPrivilege	2840	WMIC.exe
Token: SeSystemProfilePrivilege	2840	WMIC.exe
Token: SeSystemtimePrivilege	2840	WMIC.exe
Token: SeProfSingleProcessPrivilege	2840	WMIC.exe
Token: SeIncBasePriorityPrivilege	2840	WMIC.exe
Token: SeCreatePagefilePrivilege	2840	WMIC.exe
Token: SeBackupPrivilege	2840	WMIC.exe
Token: SeRestorePrivilege	2840	WMIC.exe
Token: SeShutdownPrivilege	2840	WMIC.exe
Token: SeDebugPrivilege	2840	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2840	WMIC.exe
Token: SeRemoteShutdownPrivilege	2840	WMIC.exe
Token: SeUndockPrivilege	2840	WMIC.exe
Token: SeManageVolumePrivilege	2840	WMIC.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2180	2052	msg.exe	57
PID 2052 wrote to memory of 2180	2052	msg.exe	57
PID 2052 wrote to memory of 2180	2052	msg.exe	57
PID 2052 wrote to memory of 2096	2052	msg.exe	59
PID 2052 wrote to memory of 2096	2052	msg.exe	59
PID 2052 wrote to memory of 2096	2052	msg.exe	59
PID 2096 wrote to memory of 3368	2096	igfxCUIService.exe	60
PID 2096 wrote to memory of 3368	2096	igfxCUIService.exe	60
PID 2096 wrote to memory of 3368	2096	igfxCUIService.exe	60
PID 3368 wrote to memory of 1456	3368	powershell.exe	62
PID 3368 wrote to memory of 1456	3368	powershell.exe	62
PID 3368 wrote to memory of 1456	3368	powershell.exe	62
PID 3368 wrote to memory of 1908	3368	powershell.exe	65
PID 3368 wrote to memory of 1908	3368	powershell.exe	65
PID 3368 wrote to memory of 1908	3368	powershell.exe	65
PID 2096 wrote to memory of 3784	2096	igfxCUIService.exe	66
PID 2096 wrote to memory of 3784	2096	igfxCUIService.exe	66
PID 2096 wrote to memory of 3784	2096	igfxCUIService.exe	66
PID 2096 wrote to memory of 648	2096	igfxCUIService.exe	68
PID 2096 wrote to memory of 648	2096	igfxCUIService.exe	68
PID 2096 wrote to memory of 648	2096	igfxCUIService.exe	68
PID 648 wrote to memory of 2840	648	cmd.exe	70
PID 648 wrote to memory of 2840	648	cmd.exe	70
PID 648 wrote to memory of 2840	648	cmd.exe	70
PID 2096 wrote to memory of 1352	2096	igfxCUIService.exe	71
PID 2096 wrote to memory of 1352	2096	igfxCUIService.exe	71
PID 2096 wrote to memory of 1352	2096	igfxCUIService.exe	71
PID 1352 wrote to memory of 1956	1352	cmd.exe	73
PID 1352 wrote to memory of 1956	1352	cmd.exe	73
PID 1352 wrote to memory of 1956	1352	cmd.exe	73
PID 2096 wrote to memory of 1800	2096	igfxCUIService.exe	74
PID 2096 wrote to memory of 1800	2096	igfxCUIService.exe	74
PID 2096 wrote to memory of 1800	2096	igfxCUIService.exe	74
PID 1800 wrote to memory of 1804	1800	cmd.exe	76
PID 1800 wrote to memory of 1804	1800	cmd.exe	76
PID 1800 wrote to memory of 1804	1800	cmd.exe	76

C:\Users\Admin\AppData\Local\Temp\msg.exe
"C:\Users\Admin\AppData\Local\Temp\msg.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" copy 'C:\Users\Admin\AppData\Local\Temp\msg.exe' 'C:\ProgramData\SystemData\igfxCUIService.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\ProgramData\SystemData\igfxCUIService.exe
  "C:\ProgramData\SystemData\igfxCUIService.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" getmac | Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber | Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\SysWOW64\getmac.exe
      "C:\Windows\system32\getmac.exe"
      4⤵
      PID:1456
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      "C:\Windows\System32\Wbem\WMIC.exe" path win32_physicalmedia get SerialNumber
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $env:username | Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\tempu.txt'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic OS get Caption, CSDVersion, OSArchitecture, Version / value > "C:\ProgramData\SystemData\tempo1.txt" && type "C:\ProgramData\SystemData\tempo1.txt" > "C:\ProgramData\SystemData\tempo2.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic OS get Caption, CSDVersion, OSArchitecture, Version / value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic nicconfig where 'IPEnabled = True' get ipaddress > "C:\ProgramData\SystemData\tempi1.txt" && type "C:\ProgramData\SystemData\tempi1.txt" > "C:\ProgramData\SystemData\tempi2.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic nicconfig where 'IPEnabled = True' get ipaddress
      4⤵
      PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V igfxCUIService /t REG_SZ /D "C:\ProgramData\SystemData\igfxCUIService.exe" /F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V igfxCUIService /t REG_SZ /D "C:\ProgramData\SystemData\igfxCUIService.exe" /F
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1804

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-133-0x00000000046D0000-0x0000000004706000-memory.dmp

Filesize
216KB

Download
memory/2180-145-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/2180-140-0x0000000007FC0000-0x0000000007FDE000-memory.dmp

Filesize
120KB

Download
memory/2180-131-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/2180-134-0x0000000006CC0000-0x0000000006CC1000-memory.dmp

Filesize
4KB

Download
memory/2180-135-0x0000000006CC2000-0x0000000006CC3000-memory.dmp

Filesize
4KB

Download
memory/2180-132-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/2180-139-0x00000000079A0000-0x0000000007A06000-memory.dmp

Filesize
408KB

Download
memory/2180-141-0x0000000008F70000-0x0000000009006000-memory.dmp

Filesize
600KB

Download
memory/2180-136-0x0000000007300000-0x0000000007928000-memory.dmp

Filesize
6.2MB

Download
memory/2180-144-0x00000000095C0000-0x0000000009B64000-memory.dmp

Filesize
5.6MB

Download
memory/2180-138-0x0000000007090000-0x00000000070F6000-memory.dmp

Filesize
408KB

Download
memory/2180-143-0x0000000008500000-0x0000000008522000-memory.dmp

Filesize
136KB

Download
memory/2180-137-0x0000000006FF0000-0x0000000007012000-memory.dmp

Filesize
136KB

Download
memory/2180-142-0x00000000084B0000-0x00000000084CA000-memory.dmp

Filesize
104KB

Download
memory/3368-162-0x0000000009640000-0x0000000009CBA000-memory.dmp

Filesize
6.5MB

Download
memory/3368-161-0x0000000007D70000-0x0000000007D8E000-memory.dmp

Filesize
120KB

Download
memory/3368-164-0x00000000043E5000-0x00000000043E7000-memory.dmp

Filesize
8KB

Download
memory/3368-151-0x0000000004290000-0x0000000004291000-memory.dmp

Filesize
4KB

Download
memory/3368-152-0x0000000004290000-0x0000000004291000-memory.dmp

Filesize
4KB

Download
memory/3368-153-0x00000000043F0000-0x0000000004426000-memory.dmp

Filesize
216KB

Download
memory/3368-155-0x0000000006F80000-0x00000000075A8000-memory.dmp

Filesize
6.2MB

Download
memory/3368-167-0x0000000004290000-0x0000000004291000-memory.dmp

Filesize
4KB

Download
memory/3368-154-0x00000000043E0000-0x00000000043E1000-memory.dmp

Filesize
4KB

Download
memory/3368-156-0x00000000043E2000-0x00000000043E3000-memory.dmp

Filesize
4KB

Download
memory/3368-157-0x0000000006E70000-0x0000000006E92000-memory.dmp

Filesize
136KB

Download
memory/3368-158-0x0000000007740000-0x00000000077A6000-memory.dmp

Filesize
408KB

Download
memory/3368-163-0x0000000008250000-0x000000000826A000-memory.dmp

Filesize
104KB

Download
memory/3368-159-0x00000000077B0000-0x0000000007816000-memory.dmp

Filesize
408KB

Download
memory/3784-175-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/3784-178-0x0000000007710000-0x0000000007776000-memory.dmp

Filesize
408KB

Download
memory/3784-184-0x00000000045A5000-0x00000000045A7000-memory.dmp

Filesize
8KB

Download
memory/3784-185-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/3784-182-0x00000000097D0000-0x0000000009E4A000-memory.dmp

Filesize
6.5MB

Download
memory/3784-181-0x0000000007D80000-0x0000000007D9E000-memory.dmp

Filesize
120KB

Download
memory/3784-179-0x00000000077F0000-0x0000000007856000-memory.dmp

Filesize
408KB

Download
memory/3784-183-0x0000000008370000-0x000000000838A000-memory.dmp

Filesize
104KB

Download
memory/3784-177-0x0000000007570000-0x0000000007592000-memory.dmp

Filesize
136KB

Download
memory/3784-176-0x00000000045A2000-0x00000000045A3000-memory.dmp

Filesize
4KB

Download
memory/3784-174-0x0000000006F40000-0x0000000007568000-memory.dmp

Filesize
6.2MB

Download
memory/3784-173-0x0000000004520000-0x0000000004556000-memory.dmp

Filesize
216KB

Download
memory/3784-171-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/3784-172-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download