General
Target

87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe

Filesize

252KB

Completed

21-05-2022 19:19

Task

behavioral2

Score
10/10
MD5

32307c24db9052003547acd8c7814a09

SHA1

1804e608aef820e4b344e996dbad49276cc237b5

SHA256

87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3

SHA256

7e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596

Malware Config
Signatures 21

Filter: none

Defense Evasion
Discovery
Persistence
  • Darkcomet

    Description

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence
    87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe

    TTPs

    Winlogon Helper DLLModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
  • Modifies firewall policy service
    msdcsc.exe

    Tags

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Set value (int)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"msdcsc.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfilemsdcsc.exe
    Set value (int)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"msdcsc.exe
  • Modifies security service
    msdcsc.exe

    Tags

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Set value (int)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"msdcsc.exe
  • Windows security bypass

    TTPs

    Disabling Security ToolsModify Registry
  • Disables RegEdit via registry modification

    Tags

  • Disables Task Manager via registry modification

    Tags

  • Executes dropped EXE
    msdcsc.exe

    Reported IOCs

    pidprocess
    4292msdcsc.exe
  • Sets file to hidden

    Description

    Modifies file attributes to stop it showing in Explorer etc.

    Tags

    TTPs

    Hidden Files and Directories
  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/files/0x000300000000071f-136.datupx
    behavioral2/files/0x000300000000071f-137.datupx
  • Checks computer location settings
    87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
  • Windows security modification
    msdcsc.exe

    TTPs

    Disabling Security ToolsModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"msdcsc.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"msdcsc.exe
  • Adds Run key to start application
    87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"msdcsc.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Modifies registry class
    87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
  • Suspicious behavior: GetForegroundWindowSpam
    msdcsc.exe

    Reported IOCs

    pidprocess
    4292msdcsc.exe
  • Suspicious use of AdjustPrivilegeToken
    87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeIncreaseQuotaPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeSecurityPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeTakeOwnershipPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeLoadDriverPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeSystemProfilePrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeSystemtimePrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeProfSingleProcessPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeIncBasePriorityPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeCreatePagefilePrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeBackupPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeRestorePrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeShutdownPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeDebugPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeSystemEnvironmentPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeChangeNotifyPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeRemoteShutdownPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeUndockPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeManageVolumePrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeImpersonatePrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeCreateGlobalPrivilege309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: 33309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: 34309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: 35309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: 36309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    Token: SeIncreaseQuotaPrivilege4292msdcsc.exe
    Token: SeSecurityPrivilege4292msdcsc.exe
    Token: SeTakeOwnershipPrivilege4292msdcsc.exe
    Token: SeLoadDriverPrivilege4292msdcsc.exe
    Token: SeSystemProfilePrivilege4292msdcsc.exe
    Token: SeSystemtimePrivilege4292msdcsc.exe
    Token: SeProfSingleProcessPrivilege4292msdcsc.exe
    Token: SeIncBasePriorityPrivilege4292msdcsc.exe
    Token: SeCreatePagefilePrivilege4292msdcsc.exe
    Token: SeBackupPrivilege4292msdcsc.exe
    Token: SeRestorePrivilege4292msdcsc.exe
    Token: SeShutdownPrivilege4292msdcsc.exe
    Token: SeDebugPrivilege4292msdcsc.exe
    Token: SeSystemEnvironmentPrivilege4292msdcsc.exe
    Token: SeChangeNotifyPrivilege4292msdcsc.exe
    Token: SeRemoteShutdownPrivilege4292msdcsc.exe
    Token: SeUndockPrivilege4292msdcsc.exe
    Token: SeManageVolumePrivilege4292msdcsc.exe
    Token: SeImpersonatePrivilege4292msdcsc.exe
    Token: SeCreateGlobalPrivilege4292msdcsc.exe
    Token: 334292msdcsc.exe
    Token: 344292msdcsc.exe
    Token: 354292msdcsc.exe
    Token: 364292msdcsc.exe
  • Suspicious use of SetWindowsHookEx
    msdcsc.exe

    Reported IOCs

    pidprocess
    4292msdcsc.exe
  • Suspicious use of WriteProcessMemory
    87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.execmd.exemsdcsc.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3096 wrote to memory of 4248309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.exe
    PID 3096 wrote to memory of 4248309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.exe
    PID 3096 wrote to memory of 4248309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.exe
    PID 3096 wrote to memory of 4252309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.exe
    PID 3096 wrote to memory of 4252309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.exe
    PID 3096 wrote to memory of 4252309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.execmd.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 3096 wrote to memory of 2172309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exenotepad.exe
    PID 4248 wrote to memory of 48284248cmd.exeattrib.exe
    PID 4248 wrote to memory of 48284248cmd.exeattrib.exe
    PID 4248 wrote to memory of 48284248cmd.exeattrib.exe
    PID 4252 wrote to memory of 7444252cmd.exeattrib.exe
    PID 4252 wrote to memory of 7444252cmd.exeattrib.exe
    PID 4252 wrote to memory of 7444252cmd.exeattrib.exe
    PID 3096 wrote to memory of 4292309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exe
    PID 3096 wrote to memory of 4292309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exe
    PID 3096 wrote to memory of 4292309687e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exemsdcsc.exe
    PID 4292 wrote to memory of 25964292msdcsc.exeiexplore.exe
    PID 4292 wrote to memory of 25964292msdcsc.exeiexplore.exe
    PID 4292 wrote to memory of 25964292msdcsc.exeiexplore.exe
    PID 4292 wrote to memory of 34404292msdcsc.exeexplorer.exe
    PID 4292 wrote to memory of 34404292msdcsc.exeexplorer.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
    PID 4292 wrote to memory of 46124292msdcsc.exenotepad.exe
  • System policy modification
    msdcsc.exe

    Tags

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"msdcsc.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersionmsdcsc.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorernmsdcsc.exe
  • Views/modifies file attributes
    attrib.exeattrib.exe

    Tags

    TTPs

    Hidden Files and Directories

    Reported IOCs

    pidprocess
    4828attrib.exe
    744attrib.exe
Processes 10
  • C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe
    "C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe"
    Modifies WinLogon for persistence
    Checks computer location settings
    Adds Run key to start application
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe" +s +h
      Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3.exe" +s +h
        Views/modifies file attributes
        PID:4828
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        Views/modifies file attributes
        PID:744
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      PID:2172
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      Modifies firewall policy service
      Modifies security service
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4292
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        PID:2596
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        PID:3440
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        PID:4612
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

                      MD5

                      32307c24db9052003547acd8c7814a09

                      SHA1

                      1804e608aef820e4b344e996dbad49276cc237b5

                      SHA256

                      87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3

                      SHA512

                      7e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596

                    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

                      MD5

                      32307c24db9052003547acd8c7814a09

                      SHA1

                      1804e608aef820e4b344e996dbad49276cc237b5

                      SHA256

                      87e1433bec2bd9d8fdc02e52d03d29005b82546996d045068ffce11088a660c3

                      SHA512

                      7e3db616a5e1e25eb2b94a8a537c90b657f99fa92471c38108eb0e859476a6e5adecfe3ef46da9729cc3605a79c694f74a2a923b4f6e5f9bc5d5515186bca596

                    • memory/744-134-0x0000000000000000-mapping.dmp

                    • memory/2172-132-0x0000000000000000-mapping.dmp

                    • memory/3440-138-0x0000000000000000-mapping.dmp

                    • memory/4248-130-0x0000000000000000-mapping.dmp

                    • memory/4252-131-0x0000000000000000-mapping.dmp

                    • memory/4292-135-0x0000000000000000-mapping.dmp

                    • memory/4612-139-0x0000000000000000-mapping.dmp

                    • memory/4828-133-0x0000000000000000-mapping.dmp