Analysis
-
max time kernel
191s -
max time network
208s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe
Resource
win7-20220414-en
General
-
Target
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe
-
Size
308KB
-
MD5
a7495ebd5b117c20f373a1769534470a
-
SHA1
2fa33f0113d280d0aaa73e94e79a4c02fa78e788
-
SHA256
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940
-
SHA512
363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9
Malware Config
Extracted
darkcomet
Guest16
bibl12345.ddns.net:1604
DC_MUTEX-AJ56C7W
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Jy8jYvuQiUbf
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Windows
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 5 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeDesktopLayer.exemsdcsc.exemsdcscSrv.exeDesktopLayer.exepid process 1392 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe 888 DesktopLayer.exe 780 msdcsc.exe 2028 msdcscSrv.exe 1064 DesktopLayer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 588 attrib.exe 1568 attrib.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe upx C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe upx C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe upx behavioral1/memory/1392-63-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx \Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral1/memory/888-66-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1376-73-0x0000000000400000-0x00000000004C6000-memory.dmp upx C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe upx \ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe upx \ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe upx behavioral1/memory/2028-88-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx \Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx \ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe upx behavioral1/memory/1376-95-0x0000000004EC0000-0x0000000004F86000-memory.dmp upx behavioral1/memory/780-96-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral1/memory/780-98-0x0000000000400000-0x00000000004C6000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1116 notepad.exe -
Loads dropped DLL 6 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exemsdcsc.exemsdcscSrv.exepid process 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 1392 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 780 msdcsc.exe 2028 msdcscSrv.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in Program Files directory 5 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exemsdcscSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxC4C6.tmp 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\pxCB6B.tmp msdcscSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe msdcscSrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7BBC9B51-FDDB-11EC-B0A3-6280490416C4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363952961" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exeDesktopLayer.exepid process 888 DesktopLayer.exe 888 DesktopLayer.exe 888 DesktopLayer.exe 888 DesktopLayer.exe 1064 DesktopLayer.exe 1064 DesktopLayer.exe 1064 DesktopLayer.exe 1064 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 780 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeSecurityPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeTakeOwnershipPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeLoadDriverPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeSystemProfilePrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeSystemtimePrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeProfSingleProcessPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeIncBasePriorityPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeCreatePagefilePrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeBackupPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeRestorePrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeShutdownPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeDebugPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeSystemEnvironmentPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeChangeNotifyPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeRemoteShutdownPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeUndockPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeManageVolumePrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeImpersonatePrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeCreateGlobalPrivilege 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: 33 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: 34 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: 35 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeIncreaseQuotaPrivilege 780 msdcsc.exe Token: SeSecurityPrivilege 780 msdcsc.exe Token: SeTakeOwnershipPrivilege 780 msdcsc.exe Token: SeLoadDriverPrivilege 780 msdcsc.exe Token: SeSystemProfilePrivilege 780 msdcsc.exe Token: SeSystemtimePrivilege 780 msdcsc.exe Token: SeProfSingleProcessPrivilege 780 msdcsc.exe Token: SeIncBasePriorityPrivilege 780 msdcsc.exe Token: SeCreatePagefilePrivilege 780 msdcsc.exe Token: SeBackupPrivilege 780 msdcsc.exe Token: SeRestorePrivilege 780 msdcsc.exe Token: SeShutdownPrivilege 780 msdcsc.exe Token: SeDebugPrivilege 780 msdcsc.exe Token: SeSystemEnvironmentPrivilege 780 msdcsc.exe Token: SeChangeNotifyPrivilege 780 msdcsc.exe Token: SeRemoteShutdownPrivilege 780 msdcsc.exe Token: SeUndockPrivilege 780 msdcsc.exe Token: SeManageVolumePrivilege 780 msdcsc.exe Token: SeImpersonatePrivilege 780 msdcsc.exe Token: SeCreateGlobalPrivilege 780 msdcsc.exe Token: 33 780 msdcsc.exe Token: 34 780 msdcsc.exe Token: 35 780 msdcsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 948 iexplore.exe 948 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
iexplore.exemsdcsc.exeIEXPLORE.EXEpid process 948 iexplore.exe 948 iexplore.exe 780 msdcsc.exe 948 iexplore.exe 948 iexplore.exe 672 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeDesktopLayer.execmd.execmd.exeiexplore.exemsdcsc.exemsdcscSrv.exedescription pid process target process PID 1376 wrote to memory of 1392 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe PID 1376 wrote to memory of 1392 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe PID 1376 wrote to memory of 1392 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe PID 1376 wrote to memory of 1392 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe PID 1392 wrote to memory of 888 1392 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe DesktopLayer.exe PID 1392 wrote to memory of 888 1392 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe DesktopLayer.exe PID 1392 wrote to memory of 888 1392 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe DesktopLayer.exe PID 1392 wrote to memory of 888 1392 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe DesktopLayer.exe PID 888 wrote to memory of 948 888 DesktopLayer.exe iexplore.exe PID 888 wrote to memory of 948 888 DesktopLayer.exe iexplore.exe PID 888 wrote to memory of 948 888 DesktopLayer.exe iexplore.exe PID 888 wrote to memory of 948 888 DesktopLayer.exe iexplore.exe PID 1376 wrote to memory of 1620 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 1376 wrote to memory of 1620 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 1376 wrote to memory of 1620 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 1376 wrote to memory of 1620 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 1376 wrote to memory of 520 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 1376 wrote to memory of 520 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 1376 wrote to memory of 520 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 1376 wrote to memory of 520 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 520 wrote to memory of 1568 520 cmd.exe attrib.exe PID 520 wrote to memory of 1568 520 cmd.exe attrib.exe PID 520 wrote to memory of 1568 520 cmd.exe attrib.exe PID 520 wrote to memory of 1568 520 cmd.exe attrib.exe PID 1620 wrote to memory of 588 1620 cmd.exe attrib.exe PID 1620 wrote to memory of 588 1620 cmd.exe attrib.exe PID 1620 wrote to memory of 588 1620 cmd.exe attrib.exe PID 1620 wrote to memory of 588 1620 cmd.exe attrib.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 1376 wrote to memory of 1116 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 948 wrote to memory of 672 948 iexplore.exe IEXPLORE.EXE PID 948 wrote to memory of 672 948 iexplore.exe IEXPLORE.EXE PID 948 wrote to memory of 672 948 iexplore.exe IEXPLORE.EXE PID 948 wrote to memory of 672 948 iexplore.exe IEXPLORE.EXE PID 1376 wrote to memory of 780 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe msdcsc.exe PID 1376 wrote to memory of 780 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe msdcsc.exe PID 1376 wrote to memory of 780 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe msdcsc.exe PID 1376 wrote to memory of 780 1376 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe msdcsc.exe PID 780 wrote to memory of 2028 780 msdcsc.exe msdcscSrv.exe PID 780 wrote to memory of 2028 780 msdcsc.exe msdcscSrv.exe PID 780 wrote to memory of 2028 780 msdcsc.exe msdcscSrv.exe PID 780 wrote to memory of 2028 780 msdcsc.exe msdcscSrv.exe PID 2028 wrote to memory of 1064 2028 msdcscSrv.exe DesktopLayer.exe PID 2028 wrote to memory of 1064 2028 msdcscSrv.exe DesktopLayer.exe PID 2028 wrote to memory of 1064 2028 msdcscSrv.exe DesktopLayer.exe PID 2028 wrote to memory of 1064 2028 msdcscSrv.exe DesktopLayer.exe PID 780 wrote to memory of 1608 780 msdcsc.exe notepad.exe PID 780 wrote to memory of 1608 780 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 588 attrib.exe 1568 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe"C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeC:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:948 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exeFilesize
308KB
MD5a7495ebd5b117c20f373a1769534470a
SHA12fa33f0113d280d0aaa73e94e79a4c02fa78e788
SHA25646b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940
SHA512363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exeFilesize
308KB
MD5a7495ebd5b117c20f373a1769534470a
SHA12fa33f0113d280d0aaa73e94e79a4c02fa78e788
SHA25646b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940
SHA512363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G3TO1Q7K.txtFilesize
604B
MD5b66bfc5e27d2354e8f605c17b456c52f
SHA199d3a99764e5c0b425a11b5a0ed0ee1185124e0f
SHA2566e8f365b45d0851e982b11a7c2cdd7bfd6caf82920d2c584bc7c3b8a7f9c3a0d
SHA5124c626d6c9dd5cf2bb532f7fe08260dbc659db891e3525a3a52c968032199199e8139b137b831396ab74cb16c3d3780eaf260832b2442fa569271e0e59ee28881
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exeFilesize
308KB
MD5a7495ebd5b117c20f373a1769534470a
SHA12fa33f0113d280d0aaa73e94e79a4c02fa78e788
SHA25646b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940
SHA512363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9
-
\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exeFilesize
308KB
MD5a7495ebd5b117c20f373a1769534470a
SHA12fa33f0113d280d0aaa73e94e79a4c02fa78e788
SHA25646b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940
SHA512363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9
-
\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/520-68-0x0000000000000000-mapping.dmp
-
memory/588-70-0x0000000000000000-mapping.dmp
-
memory/780-76-0x0000000000000000-mapping.dmp
-
memory/780-96-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/780-99-0x0000000000320000-0x000000000034E000-memory.dmpFilesize
184KB
-
memory/780-98-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/780-97-0x0000000000320000-0x000000000034E000-memory.dmpFilesize
184KB
-
memory/888-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/888-61-0x0000000000000000-mapping.dmp
-
memory/1064-87-0x0000000000000000-mapping.dmp
-
memory/1116-71-0x0000000000000000-mapping.dmp
-
memory/1376-95-0x0000000004EC0000-0x0000000004F86000-memory.dmpFilesize
792KB
-
memory/1376-54-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/1376-73-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1376-77-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB
-
memory/1376-78-0x0000000004EC0000-0x0000000004F86000-memory.dmpFilesize
792KB
-
memory/1392-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1392-56-0x0000000000000000-mapping.dmp
-
memory/1568-69-0x0000000000000000-mapping.dmp
-
memory/1608-92-0x0000000000000000-mapping.dmp
-
memory/1620-67-0x0000000000000000-mapping.dmp
-
memory/2028-88-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2028-82-0x0000000000000000-mapping.dmp