Analysis
- max time kernel
152s - max time network
188s - platform
windows7_x64 - resource
win7-20220414-en - submitted
14/04/2022, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
opengl installer.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target opengl installer.exe
- Size 252KB
- Sample220414-p8a2sshebl
- SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
- MD5 ad987dd8602b2b78090a08f73212a7a0
- SHA1 4cc227c83d1403a29c2f68ef0afe12725e0dc996
- SHA512 248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
- MD5 SHA1 SHA512
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\msdcsc.exe" opengl installer.exe - Disables RegEdit via registry modification
- Executes dropped EXE 1 IoCs
pid Process 1744 msdcsc.exe -
resource yara_rule behavioral1/files/0x0009000000013a17-55.dat upx behavioral1/files/0x0009000000013a17-56.dat upx behavioral1/files/0x0009000000013a17-58.dat upx behavioral1/files/0x0009000000013a17-61.dat upx behavioral1/files/0x0009000000013a17-60.dat upx behavioral1/files/0x0009000000013a17-63.dat upx behavioral1/files/0x0009000000013a17-62.dat upx - Loads dropped DLL 5 IoCs
pid Process 1712 opengl installer.exe 1712 opengl installer.exe 1744 msdcsc.exe 1744 msdcsc.exe 1744 msdcsc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\msdcsc.exe" opengl installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\msdcsc.exe" msdcsc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1712 opengl installer.exe Token: SeSecurityPrivilege 1712 opengl installer.exe Token: SeTakeOwnershipPrivilege 1712 opengl installer.exe Token: SeLoadDriverPrivilege 1712 opengl installer.exe Token: SeSystemProfilePrivilege 1712 opengl installer.exe Token: SeSystemtimePrivilege 1712 opengl installer.exe Token: SeProfSingleProcessPrivilege 1712 opengl installer.exe Token: SeIncBasePriorityPrivilege 1712 opengl installer.exe Token: SeCreatePagefilePrivilege 1712 opengl installer.exe Token: SeBackupPrivilege 1712 opengl installer.exe Token: SeRestorePrivilege 1712 opengl installer.exe Token: SeShutdownPrivilege 1712 opengl installer.exe Token: SeDebugPrivilege 1712 opengl installer.exe Token: SeSystemEnvironmentPrivilege 1712 opengl installer.exe Token: SeChangeNotifyPrivilege 1712 opengl installer.exe Token: SeRemoteShutdownPrivilege 1712 opengl installer.exe Token: SeUndockPrivilege 1712 opengl installer.exe Token: SeManageVolumePrivilege 1712 opengl installer.exe Token: SeImpersonatePrivilege 1712 opengl installer.exe Token: SeCreateGlobalPrivilege 1712 opengl installer.exe Token: 33 1712 opengl installer.exe Token: 34 1712 opengl installer.exe Token: 35 1712 opengl installer.exe Token: SeIncreaseQuotaPrivilege 1744 msdcsc.exe Token: SeSecurityPrivilege 1744 msdcsc.exe Token: SeTakeOwnershipPrivilege 1744 msdcsc.exe Token: SeLoadDriverPrivilege 1744 msdcsc.exe Token: SeSystemProfilePrivilege 1744 msdcsc.exe Token: SeSystemtimePrivilege 1744 msdcsc.exe Token: SeProfSingleProcessPrivilege 1744 msdcsc.exe Token: SeIncBasePriorityPrivilege 1744 msdcsc.exe Token: SeCreatePagefilePrivilege 1744 msdcsc.exe Token: SeBackupPrivilege 1744 msdcsc.exe Token: SeRestorePrivilege 1744 msdcsc.exe Token: SeShutdownPrivilege 1744 msdcsc.exe Token: SeDebugPrivilege 1744 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1744 msdcsc.exe Token: SeChangeNotifyPrivilege 1744 msdcsc.exe Token: SeRemoteShutdownPrivilege 1744 msdcsc.exe Token: SeUndockPrivilege 1744 msdcsc.exe Token: SeManageVolumePrivilege 1744 msdcsc.exe Token: SeImpersonatePrivilege 1744 msdcsc.exe Token: SeCreateGlobalPrivilege 1744 msdcsc.exe Token: 33 1744 msdcsc.exe Token: 34 1744 msdcsc.exe Token: 35 1744 msdcsc.exe Token: SeRestorePrivilege 1712 opengl installer.exe Token: SeBackupPrivilege 1712 opengl installer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1744 msdcsc.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1744 1712 opengl installer.exe 28 PID 1712 wrote to memory of 1744 1712 opengl installer.exe 28 PID 1712 wrote to memory of 1744 1712 opengl installer.exe 28 PID 1712 wrote to memory of 1744 1712 opengl installer.exe 28 PID 1712 wrote to memory of 1744 1712 opengl installer.exe 28 PID 1712 wrote to memory of 1744 1712 opengl installer.exe 28 PID 1712 wrote to memory of 1744 1712 opengl installer.exe 28 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29 PID 1744 wrote to memory of 1736 1744 msdcsc.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\opengl installer.exe"C:\Users\Admin\AppData\Local\Temp\opengl installer.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1736
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe
- Size 252KB
- SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
- MD5 ad987dd8602b2b78090a08f73212a7a0
- SHA1 4cc227c83d1403a29c2f68ef0afe12725e0dc996
- SHA512 248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
- SSDEEP 6144:xcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:xcWkbgTYWnYnt/IDYhP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe
- Size 252KB
- SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
- MD5 ad987dd8602b2b78090a08f73212a7a0
- SHA1 4cc227c83d1403a29c2f68ef0afe12725e0dc996
- SHA512 248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
- SSDEEP 6144:xcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:xcWkbgTYWnYnt/IDYhP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe
- Size 252KB
- SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
- MD5 ad987dd8602b2b78090a08f73212a7a0
- SHA1 4cc227c83d1403a29c2f68ef0afe12725e0dc996
- SHA512 248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
- SSDEEP 6144:xcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:xcWkbgTYWnYnt/IDYhP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe
- Size 252KB
- SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
- MD5 ad987dd8602b2b78090a08f73212a7a0
- SHA1 4cc227c83d1403a29c2f68ef0afe12725e0dc996
- SHA512 248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
- SSDEEP 6144:xcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:xcWkbgTYWnYnt/IDYhP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe
- Size 252KB
- SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
- MD5 ad987dd8602b2b78090a08f73212a7a0
- SHA1 4cc227c83d1403a29c2f68ef0afe12725e0dc996
- SHA512 248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
- SSDEEP 6144:xcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:xcWkbgTYWnYnt/IDYhP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe
- Size 252KB
- SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
- MD5 ad987dd8602b2b78090a08f73212a7a0
- SHA1 4cc227c83d1403a29c2f68ef0afe12725e0dc996
- SHA512 248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
- SSDEEP 6144:xcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:xcWkbgTYWnYnt/IDYhP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Microsoft\msdcsc.exe
- Size 252KB
- SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
- MD5 ad987dd8602b2b78090a08f73212a7a0
- SHA1 4cc227c83d1403a29c2f68ef0afe12725e0dc996
- SHA512 248f94693dd0ee2514f900a1d68356179e971c29ca625fb499aab6dc7767dedcf452dfa9ccc571c06cb2cbdd32798d7451bbc4a917014b5147e22ffdec3bd47d
- SSDEEP 6144:xcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:xcWkbgTYWnYnt/IDYhP
- MD5 SHA1 SHA512 SSDEEP