Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 19:16
Behavioral task
behavioral1
Sample
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
Resource
win7-20220414-en
General
-
Target
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
-
Size
252KB
-
MD5
32307c24db9052003547acd8c7814a09
-
SHA1
1804e608aef820e4b344e996dbad49276cc237b5
-
SHA256
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3
-
SHA512
7e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1016 msdcsc.exe -
Processes:
resource yara_rule \Users\Admin\Documents\MSDCSC\msdcsc.exe upx \Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 628 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exepid process 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1016 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeSecurityPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeTakeOwnershipPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeLoadDriverPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeSystemProfilePrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeSystemtimePrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeProfSingleProcessPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeIncBasePriorityPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeCreatePagefilePrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeBackupPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeRestorePrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeShutdownPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeDebugPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeSystemEnvironmentPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeChangeNotifyPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeRemoteShutdownPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeUndockPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeManageVolumePrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeImpersonatePrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeCreateGlobalPrivilege 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: 33 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: 34 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: 35 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeIncreaseQuotaPrivilege 1016 msdcsc.exe Token: SeSecurityPrivilege 1016 msdcsc.exe Token: SeTakeOwnershipPrivilege 1016 msdcsc.exe Token: SeLoadDriverPrivilege 1016 msdcsc.exe Token: SeSystemProfilePrivilege 1016 msdcsc.exe Token: SeSystemtimePrivilege 1016 msdcsc.exe Token: SeProfSingleProcessPrivilege 1016 msdcsc.exe Token: SeIncBasePriorityPrivilege 1016 msdcsc.exe Token: SeCreatePagefilePrivilege 1016 msdcsc.exe Token: SeBackupPrivilege 1016 msdcsc.exe Token: SeRestorePrivilege 1016 msdcsc.exe Token: SeShutdownPrivilege 1016 msdcsc.exe Token: SeDebugPrivilege 1016 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1016 msdcsc.exe Token: SeChangeNotifyPrivilege 1016 msdcsc.exe Token: SeRemoteShutdownPrivilege 1016 msdcsc.exe Token: SeUndockPrivilege 1016 msdcsc.exe Token: SeManageVolumePrivilege 1016 msdcsc.exe Token: SeImpersonatePrivilege 1016 msdcsc.exe Token: SeCreateGlobalPrivilege 1016 msdcsc.exe Token: 33 1016 msdcsc.exe Token: 34 1016 msdcsc.exe Token: 35 1016 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1016 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1272 wrote to memory of 1768 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 1272 wrote to memory of 1768 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 1272 wrote to memory of 1768 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 1272 wrote to memory of 1768 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 1272 wrote to memory of 1660 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 1272 wrote to memory of 1660 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 1272 wrote to memory of 1660 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 1272 wrote to memory of 1660 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1272 wrote to memory of 628 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 1660 wrote to memory of 1712 1660 cmd.exe attrib.exe PID 1660 wrote to memory of 1712 1660 cmd.exe attrib.exe PID 1660 wrote to memory of 1712 1660 cmd.exe attrib.exe PID 1660 wrote to memory of 1712 1660 cmd.exe attrib.exe PID 1768 wrote to memory of 956 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 956 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 956 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 956 1768 cmd.exe attrib.exe PID 1272 wrote to memory of 1016 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe msdcsc.exe PID 1272 wrote to memory of 1016 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe msdcsc.exe PID 1272 wrote to memory of 1016 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe msdcsc.exe PID 1272 wrote to memory of 1016 1272 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe msdcsc.exe PID 1016 wrote to memory of 876 1016 msdcsc.exe iexplore.exe PID 1016 wrote to memory of 876 1016 msdcsc.exe iexplore.exe PID 1016 wrote to memory of 876 1016 msdcsc.exe iexplore.exe PID 1016 wrote to memory of 876 1016 msdcsc.exe iexplore.exe PID 1016 wrote to memory of 544 1016 msdcsc.exe explorer.exe PID 1016 wrote to memory of 544 1016 msdcsc.exe explorer.exe PID 1016 wrote to memory of 544 1016 msdcsc.exe explorer.exe PID 1016 wrote to memory of 544 1016 msdcsc.exe explorer.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe PID 1016 wrote to memory of 1224 1016 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1712 attrib.exe 956 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe"C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
252KB
MD532307c24db9052003547acd8c7814a09
SHA11804e608aef820e4b344e996dbad49276cc237b5
SHA25687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3
SHA5127e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
252KB
MD532307c24db9052003547acd8c7814a09
SHA11804e608aef820e4b344e996dbad49276cc237b5
SHA25687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3
SHA5127e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
252KB
MD532307c24db9052003547acd8c7814a09
SHA11804e608aef820e4b344e996dbad49276cc237b5
SHA25687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3
SHA5127e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
252KB
MD532307c24db9052003547acd8c7814a09
SHA11804e608aef820e4b344e996dbad49276cc237b5
SHA25687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3
SHA5127e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596
-
memory/628-57-0x0000000000000000-mapping.dmp
-
memory/956-60-0x0000000000000000-mapping.dmp
-
memory/1016-63-0x0000000000000000-mapping.dmp
-
memory/1224-67-0x0000000000000000-mapping.dmp
-
memory/1272-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1660-56-0x0000000000000000-mapping.dmp
-
memory/1712-59-0x0000000000000000-mapping.dmp
-
memory/1768-55-0x0000000000000000-mapping.dmp