Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe
Resource
win7-20220414-en
General
-
Target
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe
-
Size
308KB
-
MD5
a7495ebd5b117c20f373a1769534470a
-
SHA1
2fa33f0113d280d0aaa73e94e79a4c02fa78e788
-
SHA256
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940
-
SHA512
363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9
Malware Config
Extracted
darkcomet
Guest16
bibl12345.ddns.net:1604
DC_MUTEX-AJ56C7W
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Jy8jYvuQiUbf
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Windows
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 5 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeDesktopLayer.exemsdcsc.exemsdcscSrv.exeDesktopLayer.exepid process 1844 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe 1000 DesktopLayer.exe 2228 msdcsc.exe 1896 msdcscSrv.exe 2284 DesktopLayer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3104 attrib.exe 3596 attrib.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe upx C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe upx behavioral2/memory/2700-133-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral2/memory/1844-134-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/1000-139-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/1896-154-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2228-156-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral2/memory/2700-157-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral2/memory/2228-158-0x0000000000400000-0x00000000004C6000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in Program Files directory 5 IoCs
Processes:
msdcscSrv.exe46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe msdcscSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\px719B.tmp 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\px7FD3.tmp msdcscSrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30970344" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "633136845" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30970344" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30970344" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363952869" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "633136845" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{512AD5B1-FDDB-11EC-B274-76C19ED5575B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "641262352" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Modifies registry class 1 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
DesktopLayer.exeDesktopLayer.exepid process 1000 DesktopLayer.exe 1000 DesktopLayer.exe 1000 DesktopLayer.exe 1000 DesktopLayer.exe 1000 DesktopLayer.exe 1000 DesktopLayer.exe 1000 DesktopLayer.exe 1000 DesktopLayer.exe 2284 DesktopLayer.exe 2284 DesktopLayer.exe 2284 DesktopLayer.exe 2284 DesktopLayer.exe 2284 DesktopLayer.exe 2284 DesktopLayer.exe 2284 DesktopLayer.exe 2284 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
msdcsc.exeiexplore.exepid process 2228 msdcsc.exe 636 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeSecurityPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeTakeOwnershipPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeLoadDriverPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeSystemProfilePrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeSystemtimePrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeProfSingleProcessPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeIncBasePriorityPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeCreatePagefilePrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeBackupPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeRestorePrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeShutdownPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeDebugPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeSystemEnvironmentPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeChangeNotifyPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeRemoteShutdownPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeUndockPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeManageVolumePrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeImpersonatePrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeCreateGlobalPrivilege 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: 33 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: 34 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: 35 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: 36 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe Token: SeIncreaseQuotaPrivilege 2228 msdcsc.exe Token: SeSecurityPrivilege 2228 msdcsc.exe Token: SeTakeOwnershipPrivilege 2228 msdcsc.exe Token: SeLoadDriverPrivilege 2228 msdcsc.exe Token: SeSystemProfilePrivilege 2228 msdcsc.exe Token: SeSystemtimePrivilege 2228 msdcsc.exe Token: SeProfSingleProcessPrivilege 2228 msdcsc.exe Token: SeIncBasePriorityPrivilege 2228 msdcsc.exe Token: SeCreatePagefilePrivilege 2228 msdcsc.exe Token: SeBackupPrivilege 2228 msdcsc.exe Token: SeRestorePrivilege 2228 msdcsc.exe Token: SeShutdownPrivilege 2228 msdcsc.exe Token: SeDebugPrivilege 2228 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2228 msdcsc.exe Token: SeChangeNotifyPrivilege 2228 msdcsc.exe Token: SeRemoteShutdownPrivilege 2228 msdcsc.exe Token: SeUndockPrivilege 2228 msdcsc.exe Token: SeManageVolumePrivilege 2228 msdcsc.exe Token: SeImpersonatePrivilege 2228 msdcsc.exe Token: SeCreateGlobalPrivilege 2228 msdcsc.exe Token: 33 2228 msdcsc.exe Token: 34 2228 msdcsc.exe Token: 35 2228 msdcsc.exe Token: 36 2228 msdcsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 636 iexplore.exe 636 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
iexplore.exeIEXPLORE.EXEmsdcsc.exeIEXPLORE.EXEpid process 636 iexplore.exe 636 iexplore.exe 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 2228 msdcsc.exe 636 iexplore.exe 636 iexplore.exe 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeDesktopLayer.exeiexplore.execmd.execmd.exemsdcsc.exedescription pid process target process PID 2700 wrote to memory of 1844 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe PID 2700 wrote to memory of 1844 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe PID 2700 wrote to memory of 1844 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe PID 1844 wrote to memory of 1000 1844 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe DesktopLayer.exe PID 1844 wrote to memory of 1000 1844 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe DesktopLayer.exe PID 1844 wrote to memory of 1000 1844 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe DesktopLayer.exe PID 1000 wrote to memory of 636 1000 DesktopLayer.exe iexplore.exe PID 1000 wrote to memory of 636 1000 DesktopLayer.exe iexplore.exe PID 636 wrote to memory of 1960 636 iexplore.exe IEXPLORE.EXE PID 636 wrote to memory of 1960 636 iexplore.exe IEXPLORE.EXE PID 636 wrote to memory of 1960 636 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 2388 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 2700 wrote to memory of 2388 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 2700 wrote to memory of 2388 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 2700 wrote to memory of 1828 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 2700 wrote to memory of 1828 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 2700 wrote to memory of 1828 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe cmd.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2700 wrote to memory of 2936 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe notepad.exe PID 2388 wrote to memory of 3104 2388 cmd.exe attrib.exe PID 2388 wrote to memory of 3104 2388 cmd.exe attrib.exe PID 2388 wrote to memory of 3104 2388 cmd.exe attrib.exe PID 1828 wrote to memory of 3596 1828 cmd.exe attrib.exe PID 1828 wrote to memory of 3596 1828 cmd.exe attrib.exe PID 1828 wrote to memory of 3596 1828 cmd.exe attrib.exe PID 2700 wrote to memory of 2228 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe msdcsc.exe PID 2700 wrote to memory of 2228 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe msdcsc.exe PID 2700 wrote to memory of 2228 2700 46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe msdcsc.exe PID 2228 wrote to memory of 1896 2228 msdcsc.exe msdcscSrv.exe PID 2228 wrote to memory of 1896 2228 msdcsc.exe msdcscSrv.exe PID 2228 wrote to memory of 1896 2228 msdcsc.exe msdcscSrv.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe PID 2228 wrote to memory of 2040 2228 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3596 attrib.exe 3104 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe"C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeC:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:636 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:636 CREDAT:82948 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exeFilesize
308KB
MD5a7495ebd5b117c20f373a1769534470a
SHA12fa33f0113d280d0aaa73e94e79a4c02fa78e788
SHA25646b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940
SHA512363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exeFilesize
308KB
MD5a7495ebd5b117c20f373a1769534470a
SHA12fa33f0113d280d0aaa73e94e79a4c02fa78e788
SHA25646b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940
SHA512363385c5726ad38918e5769c668feb4cf4e42f8a6dab847f25d452c56d92d1934f2573b3a1026098fd0c67c995be6967ef3e73ce2639ded00636e30ed1d546d9
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcscSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5f46df6d8b4b4db4e1dc315559df90120
SHA16e276344ce29422caf44382d1976bca7bf06c6ed
SHA256202f370ff58874e4e5e56ff634031c48ef1ee599db976ebd25790c65f8780ac2
SHA512b32a203bfaabef4763f1c0de9398d52da1465c234b82da541e9987d5114efae93e391d8437018f0c34d70464d5c9b1fb3c084b3adb5ad430f7cb3459aed42706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD51f4a47943c3347de236ec97dd38a9279
SHA19d5a20700d812a945670ee91d571ff76d4e8e048
SHA256e02c1d4c321853ed7f1a4a86152f7bac260fdcd5e1c3fe7016103bbaec3079c0
SHA5120e540ad9e106cae9e500c3c369ffce752a78d38042976b46ea339a2110b6b1962e589cb3815be357d230bec3bc123df200372bad21bb6982662e6ba343874955
-
C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\46b620f55c618725f4bbf2889e0427d819804ec89263efb836e800118160d940Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/1000-139-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1000-135-0x0000000000000000-mapping.dmp
-
memory/1828-141-0x0000000000000000-mapping.dmp
-
memory/1844-136-0x0000000002030000-0x000000000203F000-memory.dmpFilesize
60KB
-
memory/1844-134-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1844-130-0x0000000000000000-mapping.dmp
-
memory/1896-154-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1896-148-0x0000000000000000-mapping.dmp
-
memory/2040-151-0x0000000000000000-mapping.dmp
-
memory/2228-145-0x0000000000000000-mapping.dmp
-
memory/2228-156-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2228-158-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2284-152-0x0000000000000000-mapping.dmp
-
memory/2388-140-0x0000000000000000-mapping.dmp
-
memory/2700-157-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2700-133-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2936-142-0x0000000000000000-mapping.dmp
-
memory/3104-143-0x0000000000000000-mapping.dmp
-
memory/3596-144-0x0000000000000000-mapping.dmp