Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:53
Behavioral task
behavioral1
Sample
39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe
Resource
win7-20220414-en
General
-
Target
39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe
-
Size
252KB
-
MD5
feed791679eb25e2ceb17ef7bcf86f59
-
SHA1
7c7107ca75819e7155440319b8cee889947ce494
-
SHA256
39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240
-
SHA512
3c458c1c9b072256e55b03de3c67d312383969de36118fcf729a1c800c8d05d810dd6f31f59958523c7053b718752b8666c6ed21c5d629173001a5736ac9e423
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1464 msdcsc.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe upx \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe upx C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe upx C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe upx -
Loads dropped DLL 2 IoCs
Processes:
39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exepid process 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1464 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeSecurityPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeTakeOwnershipPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeLoadDriverPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeSystemProfilePrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeSystemtimePrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeProfSingleProcessPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeIncBasePriorityPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeCreatePagefilePrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeBackupPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeRestorePrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeShutdownPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeDebugPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeSystemEnvironmentPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeChangeNotifyPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeRemoteShutdownPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeUndockPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeManageVolumePrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeImpersonatePrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeCreateGlobalPrivilege 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: 33 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: 34 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: 35 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe Token: SeIncreaseQuotaPrivilege 1464 msdcsc.exe Token: SeSecurityPrivilege 1464 msdcsc.exe Token: SeTakeOwnershipPrivilege 1464 msdcsc.exe Token: SeLoadDriverPrivilege 1464 msdcsc.exe Token: SeSystemProfilePrivilege 1464 msdcsc.exe Token: SeSystemtimePrivilege 1464 msdcsc.exe Token: SeProfSingleProcessPrivilege 1464 msdcsc.exe Token: SeIncBasePriorityPrivilege 1464 msdcsc.exe Token: SeCreatePagefilePrivilege 1464 msdcsc.exe Token: SeBackupPrivilege 1464 msdcsc.exe Token: SeRestorePrivilege 1464 msdcsc.exe Token: SeShutdownPrivilege 1464 msdcsc.exe Token: SeDebugPrivilege 1464 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1464 msdcsc.exe Token: SeChangeNotifyPrivilege 1464 msdcsc.exe Token: SeRemoteShutdownPrivilege 1464 msdcsc.exe Token: SeUndockPrivilege 1464 msdcsc.exe Token: SeManageVolumePrivilege 1464 msdcsc.exe Token: SeImpersonatePrivilege 1464 msdcsc.exe Token: SeCreateGlobalPrivilege 1464 msdcsc.exe Token: 33 1464 msdcsc.exe Token: 34 1464 msdcsc.exe Token: 35 1464 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1464 msdcsc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1868 wrote to memory of 1924 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe cmd.exe PID 1868 wrote to memory of 1924 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe cmd.exe PID 1868 wrote to memory of 1924 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe cmd.exe PID 1868 wrote to memory of 1924 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe cmd.exe PID 1868 wrote to memory of 1128 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe cmd.exe PID 1868 wrote to memory of 1128 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe cmd.exe PID 1868 wrote to memory of 1128 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe cmd.exe PID 1868 wrote to memory of 1128 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe cmd.exe PID 1924 wrote to memory of 2036 1924 cmd.exe attrib.exe PID 1924 wrote to memory of 2036 1924 cmd.exe attrib.exe PID 1924 wrote to memory of 2036 1924 cmd.exe attrib.exe PID 1924 wrote to memory of 2036 1924 cmd.exe attrib.exe PID 1128 wrote to memory of 1188 1128 cmd.exe attrib.exe PID 1128 wrote to memory of 1188 1128 cmd.exe attrib.exe PID 1128 wrote to memory of 1188 1128 cmd.exe attrib.exe PID 1128 wrote to memory of 1188 1128 cmd.exe attrib.exe PID 1868 wrote to memory of 1464 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe msdcsc.exe PID 1868 wrote to memory of 1464 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe msdcsc.exe PID 1868 wrote to memory of 1464 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe msdcsc.exe PID 1868 wrote to memory of 1464 1868 39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe msdcsc.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe PID 1464 wrote to memory of 328 1464 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2036 attrib.exe 1188 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe"C:\Users\Admin\AppData\Local\Temp\39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\39c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
252KB
MD5feed791679eb25e2ceb17ef7bcf86f59
SHA17c7107ca75819e7155440319b8cee889947ce494
SHA25639c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240
SHA5123c458c1c9b072256e55b03de3c67d312383969de36118fcf729a1c800c8d05d810dd6f31f59958523c7053b718752b8666c6ed21c5d629173001a5736ac9e423
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
252KB
MD5feed791679eb25e2ceb17ef7bcf86f59
SHA17c7107ca75819e7155440319b8cee889947ce494
SHA25639c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240
SHA5123c458c1c9b072256e55b03de3c67d312383969de36118fcf729a1c800c8d05d810dd6f31f59958523c7053b718752b8666c6ed21c5d629173001a5736ac9e423
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
252KB
MD5feed791679eb25e2ceb17ef7bcf86f59
SHA17c7107ca75819e7155440319b8cee889947ce494
SHA25639c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240
SHA5123c458c1c9b072256e55b03de3c67d312383969de36118fcf729a1c800c8d05d810dd6f31f59958523c7053b718752b8666c6ed21c5d629173001a5736ac9e423
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
252KB
MD5feed791679eb25e2ceb17ef7bcf86f59
SHA17c7107ca75819e7155440319b8cee889947ce494
SHA25639c1e6b2be52d7021d682e6eb9bcf94808e43104dd82317cd7724ba83c923240
SHA5123c458c1c9b072256e55b03de3c67d312383969de36118fcf729a1c800c8d05d810dd6f31f59958523c7053b718752b8666c6ed21c5d629173001a5736ac9e423
-
memory/328-65-0x0000000000000000-mapping.dmp
-
memory/1128-56-0x0000000000000000-mapping.dmp
-
memory/1188-58-0x0000000000000000-mapping.dmp
-
memory/1464-61-0x0000000000000000-mapping.dmp
-
memory/1868-54-0x0000000075541000-0x0000000075543000-memory.dmpFilesize
8KB
-
memory/1924-55-0x0000000000000000-mapping.dmp
-
memory/2036-57-0x0000000000000000-mapping.dmp