Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/11/2022, 16:59
Behavioral task
behavioral1
Sample
de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe
- Size 646KB
- Sample221119-vhmkssbf64
- SHA256 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3
- MD5 24e0238c9ba4cfc5c1beb11d60b2d3b1
- SHA1 fb57c5b71d64c3f0a14348277debd6da6d9fbd77
- SHA512 21cda59ce5897792f7c1178da448e20791749b8e1bb1839a4a7cbb2622f99e51d0ca676b5649be2408a79c6e2f46269a1bb5b85d9af61990b8bbe2dd35bdd9f1
- SSDEEP 12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixR:5UKoN0bUxgGa/pfBHDb+y1HgZL
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe - Executes dropped EXE 1 IoCs
pid Process 4056 msdcsc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4056 set thread context of 456 4056 msdcsc.exe 81 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeSecurityPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeTakeOwnershipPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeLoadDriverPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeSystemProfilePrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeSystemtimePrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeProfSingleProcessPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeIncBasePriorityPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeCreatePagefilePrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeBackupPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeRestorePrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeShutdownPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeDebugPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeSystemEnvironmentPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeChangeNotifyPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeRemoteShutdownPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeUndockPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeManageVolumePrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeImpersonatePrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeCreateGlobalPrivilege 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: 33 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: 34 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: 35 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: 36 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe Token: SeIncreaseQuotaPrivilege 4056 msdcsc.exe Token: SeSecurityPrivilege 4056 msdcsc.exe Token: SeTakeOwnershipPrivilege 4056 msdcsc.exe Token: SeLoadDriverPrivilege 4056 msdcsc.exe Token: SeSystemProfilePrivilege 4056 msdcsc.exe Token: SeSystemtimePrivilege 4056 msdcsc.exe Token: SeProfSingleProcessPrivilege 4056 msdcsc.exe Token: SeIncBasePriorityPrivilege 4056 msdcsc.exe Token: SeCreatePagefilePrivilege 4056 msdcsc.exe Token: SeBackupPrivilege 4056 msdcsc.exe Token: SeRestorePrivilege 4056 msdcsc.exe Token: SeShutdownPrivilege 4056 msdcsc.exe Token: SeDebugPrivilege 4056 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4056 msdcsc.exe Token: SeChangeNotifyPrivilege 4056 msdcsc.exe Token: SeRemoteShutdownPrivilege 4056 msdcsc.exe Token: SeUndockPrivilege 4056 msdcsc.exe Token: SeManageVolumePrivilege 4056 msdcsc.exe Token: SeImpersonatePrivilege 4056 msdcsc.exe Token: SeCreateGlobalPrivilege 4056 msdcsc.exe Token: 33 4056 msdcsc.exe Token: 34 4056 msdcsc.exe Token: 35 4056 msdcsc.exe Token: 36 4056 msdcsc.exe Token: SeIncreaseQuotaPrivilege 456 iexplore.exe Token: SeSecurityPrivilege 456 iexplore.exe Token: SeTakeOwnershipPrivilege 456 iexplore.exe Token: SeLoadDriverPrivilege 456 iexplore.exe Token: SeSystemProfilePrivilege 456 iexplore.exe Token: SeSystemtimePrivilege 456 iexplore.exe Token: SeProfSingleProcessPrivilege 456 iexplore.exe Token: SeIncBasePriorityPrivilege 456 iexplore.exe Token: SeCreatePagefilePrivilege 456 iexplore.exe Token: SeBackupPrivilege 456 iexplore.exe Token: SeRestorePrivilege 456 iexplore.exe Token: SeShutdownPrivilege 456 iexplore.exe Token: SeDebugPrivilege 456 iexplore.exe Token: SeSystemEnvironmentPrivilege 456 iexplore.exe Token: SeChangeNotifyPrivilege 456 iexplore.exe Token: SeRemoteShutdownPrivilege 456 iexplore.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 456 iexplore.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4968 wrote to memory of 4056 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe 80 PID 4968 wrote to memory of 4056 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe 80 PID 4968 wrote to memory of 4056 4968 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe 80 PID 4056 wrote to memory of 456 4056 msdcsc.exe 81 PID 4056 wrote to memory of 456 4056 msdcsc.exe 81 PID 4056 wrote to memory of 456 4056 msdcsc.exe 81 PID 4056 wrote to memory of 456 4056 msdcsc.exe 81 PID 4056 wrote to memory of 456 4056 msdcsc.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe"C:\Users\Admin\AppData\Local\Temp\de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:456
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
- Size 646KB
- SHA256 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3
- MD5 24e0238c9ba4cfc5c1beb11d60b2d3b1
- SHA1 fb57c5b71d64c3f0a14348277debd6da6d9fbd77
- SHA512 21cda59ce5897792f7c1178da448e20791749b8e1bb1839a4a7cbb2622f99e51d0ca676b5649be2408a79c6e2f46269a1bb5b85d9af61990b8bbe2dd35bdd9f1
- SSDEEP 12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixR:5UKoN0bUxgGa/pfBHDb+y1HgZL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
- Size 646KB
- SHA256 de613ffc247439f180022abbaf8163fb24139b0ac7c36cac27173c5371dc79c3
- MD5 24e0238c9ba4cfc5c1beb11d60b2d3b1
- SHA1 fb57c5b71d64c3f0a14348277debd6da6d9fbd77
- SHA512 21cda59ce5897792f7c1178da448e20791749b8e1bb1839a4a7cbb2622f99e51d0ca676b5649be2408a79c6e2f46269a1bb5b85d9af61990b8bbe2dd35bdd9f1
- SSDEEP 12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixR:5UKoN0bUxgGa/pfBHDb+y1HgZL
- MD5 SHA1 SHA512 SSDEEP