Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 19:16
Behavioral task
behavioral1
Sample
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
Resource
win7-20220414-en
General
-
Target
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
-
Size
252KB
-
MD5
32307c24db9052003547acd8c7814a09
-
SHA1
1804e608aef820e4b344e996dbad49276cc237b5
-
SHA256
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3
-
SHA512
7e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4292 msdcsc.exe -
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 4292 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeSecurityPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeTakeOwnershipPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeLoadDriverPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeSystemProfilePrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeSystemtimePrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeProfSingleProcessPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeIncBasePriorityPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeCreatePagefilePrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeBackupPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeRestorePrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeShutdownPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeDebugPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeSystemEnvironmentPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeChangeNotifyPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeRemoteShutdownPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeUndockPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeManageVolumePrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeImpersonatePrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeCreateGlobalPrivilege 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: 33 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: 34 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: 35 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: 36 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe Token: SeIncreaseQuotaPrivilege 4292 msdcsc.exe Token: SeSecurityPrivilege 4292 msdcsc.exe Token: SeTakeOwnershipPrivilege 4292 msdcsc.exe Token: SeLoadDriverPrivilege 4292 msdcsc.exe Token: SeSystemProfilePrivilege 4292 msdcsc.exe Token: SeSystemtimePrivilege 4292 msdcsc.exe Token: SeProfSingleProcessPrivilege 4292 msdcsc.exe Token: SeIncBasePriorityPrivilege 4292 msdcsc.exe Token: SeCreatePagefilePrivilege 4292 msdcsc.exe Token: SeBackupPrivilege 4292 msdcsc.exe Token: SeRestorePrivilege 4292 msdcsc.exe Token: SeShutdownPrivilege 4292 msdcsc.exe Token: SeDebugPrivilege 4292 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4292 msdcsc.exe Token: SeChangeNotifyPrivilege 4292 msdcsc.exe Token: SeRemoteShutdownPrivilege 4292 msdcsc.exe Token: SeUndockPrivilege 4292 msdcsc.exe Token: SeManageVolumePrivilege 4292 msdcsc.exe Token: SeImpersonatePrivilege 4292 msdcsc.exe Token: SeCreateGlobalPrivilege 4292 msdcsc.exe Token: 33 4292 msdcsc.exe Token: 34 4292 msdcsc.exe Token: 35 4292 msdcsc.exe Token: 36 4292 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 4292 msdcsc.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.execmd.exemsdcsc.exedescription pid process target process PID 3096 wrote to memory of 4248 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 3096 wrote to memory of 4248 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 3096 wrote to memory of 4248 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 3096 wrote to memory of 4252 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 3096 wrote to memory of 4252 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 3096 wrote to memory of 4252 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe cmd.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 3096 wrote to memory of 2172 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe notepad.exe PID 4248 wrote to memory of 4828 4248 cmd.exe attrib.exe PID 4248 wrote to memory of 4828 4248 cmd.exe attrib.exe PID 4248 wrote to memory of 4828 4248 cmd.exe attrib.exe PID 4252 wrote to memory of 744 4252 cmd.exe attrib.exe PID 4252 wrote to memory of 744 4252 cmd.exe attrib.exe PID 4252 wrote to memory of 744 4252 cmd.exe attrib.exe PID 3096 wrote to memory of 4292 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe msdcsc.exe PID 3096 wrote to memory of 4292 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe msdcsc.exe PID 3096 wrote to memory of 4292 3096 87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe msdcsc.exe PID 4292 wrote to memory of 2596 4292 msdcsc.exe iexplore.exe PID 4292 wrote to memory of 2596 4292 msdcsc.exe iexplore.exe PID 4292 wrote to memory of 2596 4292 msdcsc.exe iexplore.exe PID 4292 wrote to memory of 3440 4292 msdcsc.exe explorer.exe PID 4292 wrote to memory of 3440 4292 msdcsc.exe explorer.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe PID 4292 wrote to memory of 4612 4292 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4828 attrib.exe 744 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe"C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
252KB
MD532307c24db9052003547acd8c7814a09
SHA11804e608aef820e4b344e996dbad49276cc237b5
SHA25687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3
SHA5127e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
252KB
MD532307c24db9052003547acd8c7814a09
SHA11804e608aef820e4b344e996dbad49276cc237b5
SHA25687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3
SHA5127e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596
-
memory/744-134-0x0000000000000000-mapping.dmp
-
memory/2172-132-0x0000000000000000-mapping.dmp
-
memory/3440-138-0x0000000000000000-mapping.dmp
-
memory/4248-130-0x0000000000000000-mapping.dmp
-
memory/4252-131-0x0000000000000000-mapping.dmp
-
memory/4292-135-0x0000000000000000-mapping.dmp
-
memory/4612-139-0x0000000000000000-mapping.dmp
-
memory/4828-133-0x0000000000000000-mapping.dmp