b9e9b93e99d1a8fe172d70419181a74376af8188dcb03249037d4daea27f110e

Analysis

max time kernel
99s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSDev.exe
Size 254KB
Sample221101-mkad9aaha4
SHA256 b9e9b93e99d1a8fe172d70419181a74376af8188dcb03249037d4daea27f110e
MD5 a418886a31852be25064d3573f2bc87d
SHA1 a32c247d543ed54f5a4a881882fef8e14840234c
SHA512 e1b8fb71b8d544089312bc57f716d5d93bff075ac4fc1c779e649480ffadbfbfc68d1818648c4071031e2d4ef5a78bd9487902c6da8af6aeaf61cdaff1f5efb6
SSDEEP 3072:MgHUDWt2bzu+dJ+2HuyplcYKxgqiTZmiJOglGGQMp0+WoY46322bJrXDXk:9vtwzFdJ+gXp6YKxe+GQ1oh6TXk
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4324	MSCache.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	MSDev.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cache = "\"C:\\Users\\Admin\\AppData\\Local\\MSCache\\MSCache.exe\""	MSDev.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	MSDev.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4020	MSDev.exe
4020	MSDev.exe
4324	MSCache.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	MSCache.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 4324	4020	MSDev.exe	79
PID 4020 wrote to memory of 4324	4020	MSDev.exe	79
PID 4324 wrote to memory of 4044	4324	MSCache.exe	82
PID 4324 wrote to memory of 4044	4324	MSCache.exe	82
PID 4324 wrote to memory of 1316	4324	MSCache.exe	89
PID 4324 wrote to memory of 1316	4324	MSCache.exe	89

C:\Users\Admin\AppData\Local\Temp\MSDev.exe
"C:\Users\Admin\AppData\Local\Temp\MSDev.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\MSCache\MSCache.exe
  "C:\Users\Admin\AppData\Local\MSCache\MSCache.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Query /TN DRPR
    3⤵
    PID:4044
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /sc minute /tn DRPR /tr C:\Users\Admin\AppData\Local\MSCache\MSDev.exe /mo 15 /F
    3⤵
    - Creates scheduled task(s)
    PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

023F2BD90AEC133DACB74365D7D2C74D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\023F2BD90AEC133DACB74365D7D2C74D
Size 503B
SHA256 5f2ecab67dfe7d81034fdf4f38d1cf396a4df9a23ce51bacbbdb9ee6e0d7ecc4
MD5 50ff539552f1ef7b6e20b69ee971c2d1
SHA1 c19d5711a61c77740188154f9c5d97b7ae9558ec
SHA512 1c992292d354b1437c76d27307388360b7e95445f0a81d8337785964914a23c89c41646deb164b4a07797d7a4df141ff6547b4634885dbcb873ec4b54003f61e
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 717B
SHA256 e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
MD5 ec8ff3b1ded0246437b1472c69dd1811
SHA1 d813e874c2524e3a7da6c466c67854ad16800326
SHA512 e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
MD5 SHA1 SHA512

Submit Download

023F2BD90AEC133DACB74365D7D2C74D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\023F2BD90AEC133DACB74365D7D2C74D
Size 548B
SHA256 46b6d5e7f33d63b155295c684bd4898ad9d1b653a2ffd309c26ef2eb07368a62
MD5 779642eb18c9e6a70ec399cd1b16f586
SHA1 8f00026fd50df4dda510a974a29b84b211846f84
SHA512 f896c194a060695429ec0b94f458ca61c63345aed7c113861c2eb9a79a90d152313433c7ce3945cee43ee793f31c97b2125c3f3f7b2eb25b4afb223b6c228148
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 49a7b2c9d1b01399b27abb452a93138caa634f66276e848cccca12ea4eaa65b7
MD5 f19f20b8a7359656ef7a5ae4a8a58769
SHA1 74c815660b152815405c44af4a1844dff3173624
SHA512 48633c5417b6c70f93c0b5f31fd5e54005e1715ac0a854a23ce60f55bb1e41c25999b886390859d4eced17476ebd258ebc4537819cdc44c6cad89a816b6759a2
MD5 SHA1 SHA512

Submit Download

MSCache.exe

Path C:\Users\Admin\AppData\Local\MSCache\MSCache.exe
Size 261KB
SHA256 2cad816abfe4d816cf5ecd81fb23773b6cfa1e85b466d5e5a48112862ceb3efb
MD5 1ea8a827ad4c565b1c2ae43b0a020092
SHA1 9c80d85e90175ec3bf419a902f2bdb8420628516
SHA512 7c2c457f483ad0e97c12ec970974296b38bbcc23251af419ed29ee847a5ac69ae7075d4c1ba1cdb1bc203b4c8edd25861557324013efa07e700f02376f464a38
SSDEEP 3072:hM5O08xVwE2XR4AbdmsHiWKld7uI8WrbwLqTygEpzN/X43gVLoY46bEEBSZJv3:hMD8/wpR4Ab8sHiWKNuIxi6Q9ohHEc3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSCache.exe

Path C:\Users\Admin\AppData\Local\MSCache\MSCache.exe
Size 261KB
SHA256 2cad816abfe4d816cf5ecd81fb23773b6cfa1e85b466d5e5a48112862ceb3efb
MD5 1ea8a827ad4c565b1c2ae43b0a020092
SHA1 9c80d85e90175ec3bf419a902f2bdb8420628516
SHA512 7c2c457f483ad0e97c12ec970974296b38bbcc23251af419ed29ee847a5ac69ae7075d4c1ba1cdb1bc203b4c8edd25861557324013efa07e700f02376f464a38
SSDEEP 3072:hM5O08xVwE2XR4AbdmsHiWKld7uI8WrbwLqTygEpzN/X43gVLoY46bEEBSZJv3:hMD8/wpR4Ab8sHiWKNuIxi6Q9ohHEc3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4324-139-0x000001CD171F0000-0x000001CD171F8000-memory.dmp

Download

memory/4324-140-0x000001CD30D60000-0x000001CD30D82000-memory.dmp

Download

memory/4324-142-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Download

memory/4324-143-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Download