Analysis
- max time kernel
152s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
11/10/2022, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe
- Size 482KB
- Sample221011-laf9dafgd4
- SHA256 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de
- MD5 62f3ec290a4439799bbfd62283db801c
- SHA1 ad32bfea862a3881eab78dd4fe63f04894f2c326
- SHA512 de29cb271533ce259c206758273f3a5b4ad99fe1d07c9fe606e8a25c35472d128e85d6adef13f318fa719b8d2667cfe4bdfa8419d9a7823c13eb4f8e372f8d3e
- SSDEEP 12288:W8jg5H7m3gidtHuK6abHin1fZZhjY/iNIv/:fqSg4HinHWiiX
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe - Executes dropped EXE 1 IoCs
pid Process 392 msdcsc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" iexplore.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 392 set thread context of 400 392 msdcsc.exe 87 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 2448 PING.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeSecurityPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeTakeOwnershipPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeLoadDriverPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeSystemProfilePrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeSystemtimePrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeProfSingleProcessPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeIncBasePriorityPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeCreatePagefilePrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeBackupPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeRestorePrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeShutdownPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeDebugPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeSystemEnvironmentPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeChangeNotifyPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeRemoteShutdownPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeUndockPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeManageVolumePrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeImpersonatePrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeCreateGlobalPrivilege 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: 33 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: 34 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: 35 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: 36 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe Token: SeIncreaseQuotaPrivilege 392 msdcsc.exe Token: SeSecurityPrivilege 392 msdcsc.exe Token: SeTakeOwnershipPrivilege 392 msdcsc.exe Token: SeLoadDriverPrivilege 392 msdcsc.exe Token: SeSystemProfilePrivilege 392 msdcsc.exe Token: SeSystemtimePrivilege 392 msdcsc.exe Token: SeProfSingleProcessPrivilege 392 msdcsc.exe Token: SeIncBasePriorityPrivilege 392 msdcsc.exe Token: SeCreatePagefilePrivilege 392 msdcsc.exe Token: SeBackupPrivilege 392 msdcsc.exe Token: SeRestorePrivilege 392 msdcsc.exe Token: SeShutdownPrivilege 392 msdcsc.exe Token: SeDebugPrivilege 392 msdcsc.exe Token: SeSystemEnvironmentPrivilege 392 msdcsc.exe Token: SeChangeNotifyPrivilege 392 msdcsc.exe Token: SeRemoteShutdownPrivilege 392 msdcsc.exe Token: SeUndockPrivilege 392 msdcsc.exe Token: SeManageVolumePrivilege 392 msdcsc.exe Token: SeImpersonatePrivilege 392 msdcsc.exe Token: SeCreateGlobalPrivilege 392 msdcsc.exe Token: 33 392 msdcsc.exe Token: 34 392 msdcsc.exe Token: 35 392 msdcsc.exe Token: 36 392 msdcsc.exe Token: SeIncreaseQuotaPrivilege 400 iexplore.exe Token: SeSecurityPrivilege 400 iexplore.exe Token: SeTakeOwnershipPrivilege 400 iexplore.exe Token: SeLoadDriverPrivilege 400 iexplore.exe Token: SeSystemProfilePrivilege 400 iexplore.exe Token: SeSystemtimePrivilege 400 iexplore.exe Token: SeProfSingleProcessPrivilege 400 iexplore.exe Token: SeIncBasePriorityPrivilege 400 iexplore.exe Token: SeCreatePagefilePrivilege 400 iexplore.exe Token: SeBackupPrivilege 400 iexplore.exe Token: SeRestorePrivilege 400 iexplore.exe Token: SeShutdownPrivilege 400 iexplore.exe Token: SeDebugPrivilege 400 iexplore.exe Token: SeSystemEnvironmentPrivilege 400 iexplore.exe Token: SeChangeNotifyPrivilege 400 iexplore.exe Token: SeRemoteShutdownPrivilege 400 iexplore.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 400 iexplore.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3208 wrote to memory of 2796 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe 83 PID 3208 wrote to memory of 2796 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe 83 PID 3208 wrote to memory of 2796 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe 83 PID 3208 wrote to memory of 392 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe 86 PID 3208 wrote to memory of 392 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe 86 PID 3208 wrote to memory of 392 3208 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe 86 PID 2796 wrote to memory of 2448 2796 cmd.exe 85 PID 2796 wrote to memory of 2448 2796 cmd.exe 85 PID 2796 wrote to memory of 2448 2796 cmd.exe 85 PID 392 wrote to memory of 400 392 msdcsc.exe 87 PID 392 wrote to memory of 400 392 msdcsc.exe 87 PID 392 wrote to memory of 400 392 msdcsc.exe 87 PID 392 wrote to memory of 400 392 msdcsc.exe 87 PID 392 wrote to memory of 400 392 msdcsc.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe"C:\Users\Admin\AppData\Local\Temp\53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 43⤵
- Runs ping.exe
PID:2448
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:400
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
- Size 482KB
- SHA256 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de
- MD5 62f3ec290a4439799bbfd62283db801c
- SHA1 ad32bfea862a3881eab78dd4fe63f04894f2c326
- SHA512 de29cb271533ce259c206758273f3a5b4ad99fe1d07c9fe606e8a25c35472d128e85d6adef13f318fa719b8d2667cfe4bdfa8419d9a7823c13eb4f8e372f8d3e
- SSDEEP 12288:W8jg5H7m3gidtHuK6abHin1fZZhjY/iNIv/:fqSg4HinHWiiX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
- Size 482KB
- SHA256 53d1f1a9d3709cf662eeb3a31ac65d17da82d7378bde20434f37f44fb34828de
- MD5 62f3ec290a4439799bbfd62283db801c
- SHA1 ad32bfea862a3881eab78dd4fe63f04894f2c326
- SHA512 de29cb271533ce259c206758273f3a5b4ad99fe1d07c9fe606e8a25c35472d128e85d6adef13f318fa719b8d2667cfe4bdfa8419d9a7823c13eb4f8e372f8d3e
- SSDEEP 12288:W8jg5H7m3gidtHuK6abHin1fZZhjY/iNIv/:fqSg4HinHWiiX
- MD5 SHA1 SHA512 SSDEEP