Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:22
Static task
static1
Behavioral task
behavioral1
Sample
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe
Resource
win7-20220812-en
General
-
Target
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe
-
Size
856KB
-
MD5
0c6b3509bb5a0e67d037afa5eb523076
-
SHA1
3f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
-
SHA256
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
-
SHA512
b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
SSDEEP
24576:HOGEY2LlIP8pKAWy8y60UOauWAFrYDz0M:JEYeIPH7OxVx5
Malware Config
Extracted
darkcomet
Guest16
lundinzzz.no-ip.biz:1604
lundinzzz.no-ip.biz:82
DC_MUTEX-XK6B8QX
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
H8YYXHd9Vk1a
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe -
Executes dropped EXE 7 IoCs
Processes:
msdcsc.exemsdcsc.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exepid process 364 msdcsc.exe 1100 msdcsc.exe 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 2036 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1768 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1400 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1536 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1884 attrib.exe 1572 attrib.exe -
Loads dropped DLL 7 IoCs
Processes:
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exemsdcsc.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exepid process 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 364 msdcsc.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exemsdcsc.exedescription pid process target process PID 1972 set thread context of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 364 set thread context of 1100 364 msdcsc.exe msdcsc.exe PID 1972 set thread context of 1260 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 set thread context of 2036 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 set thread context of 1768 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 set thread context of 1400 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 set thread context of 1536 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exemsdcsc.exepid process 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 364 msdcsc.exe 364 msdcsc.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1100 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exemsdcsc.exemsdcsc.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exedescription pid process Token: SeDebugPrivilege 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeIncreaseQuotaPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeSecurityPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeTakeOwnershipPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeLoadDriverPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeSystemProfilePrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeSystemtimePrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeProfSingleProcessPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeIncBasePriorityPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeCreatePagefilePrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeBackupPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeRestorePrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeShutdownPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeDebugPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeSystemEnvironmentPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeChangeNotifyPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeRemoteShutdownPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeUndockPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeManageVolumePrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeImpersonatePrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeCreateGlobalPrivilege 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: 33 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: 34 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: 35 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeDebugPrivilege 364 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1100 msdcsc.exe Token: SeSecurityPrivilege 1100 msdcsc.exe Token: SeTakeOwnershipPrivilege 1100 msdcsc.exe Token: SeLoadDriverPrivilege 1100 msdcsc.exe Token: SeSystemProfilePrivilege 1100 msdcsc.exe Token: SeSystemtimePrivilege 1100 msdcsc.exe Token: SeProfSingleProcessPrivilege 1100 msdcsc.exe Token: SeIncBasePriorityPrivilege 1100 msdcsc.exe Token: SeCreatePagefilePrivilege 1100 msdcsc.exe Token: SeBackupPrivilege 1100 msdcsc.exe Token: SeRestorePrivilege 1100 msdcsc.exe Token: SeShutdownPrivilege 1100 msdcsc.exe Token: SeDebugPrivilege 1100 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1100 msdcsc.exe Token: SeChangeNotifyPrivilege 1100 msdcsc.exe Token: SeRemoteShutdownPrivilege 1100 msdcsc.exe Token: SeUndockPrivilege 1100 msdcsc.exe Token: SeManageVolumePrivilege 1100 msdcsc.exe Token: SeImpersonatePrivilege 1100 msdcsc.exe Token: SeCreateGlobalPrivilege 1100 msdcsc.exe Token: 33 1100 msdcsc.exe Token: 34 1100 msdcsc.exe Token: 35 1100 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeSecurityPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeTakeOwnershipPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeLoadDriverPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeSystemProfilePrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeSystemtimePrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeProfSingleProcessPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeIncBasePriorityPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeCreatePagefilePrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeBackupPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeRestorePrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeShutdownPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeDebugPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeSystemEnvironmentPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeChangeNotifyPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe Token: SeRemoteShutdownPrivilege 1260 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1100 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 1972 wrote to memory of 2044 1972 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe PID 2044 wrote to memory of 896 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe cmd.exe PID 2044 wrote to memory of 896 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe cmd.exe PID 2044 wrote to memory of 896 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe cmd.exe PID 2044 wrote to memory of 896 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe cmd.exe PID 2044 wrote to memory of 2040 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe cmd.exe PID 2044 wrote to memory of 2040 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe cmd.exe PID 2044 wrote to memory of 2040 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe cmd.exe PID 2044 wrote to memory of 2040 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe cmd.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2044 wrote to memory of 864 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe notepad.exe PID 2040 wrote to memory of 1884 2040 cmd.exe attrib.exe PID 2040 wrote to memory of 1884 2040 cmd.exe attrib.exe PID 2040 wrote to memory of 1884 2040 cmd.exe attrib.exe PID 2040 wrote to memory of 1884 2040 cmd.exe attrib.exe PID 896 wrote to memory of 1572 896 cmd.exe attrib.exe PID 896 wrote to memory of 1572 896 cmd.exe attrib.exe PID 896 wrote to memory of 1572 896 cmd.exe attrib.exe PID 896 wrote to memory of 1572 896 cmd.exe attrib.exe PID 2044 wrote to memory of 364 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe msdcsc.exe PID 2044 wrote to memory of 364 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe msdcsc.exe PID 2044 wrote to memory of 364 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe msdcsc.exe PID 2044 wrote to memory of 364 2044 067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe PID 364 wrote to memory of 1100 364 msdcsc.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1572 attrib.exe 1884 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
C:\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
\Users\Admin\AppData\Local\Temp\067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
856KB
MD50c6b3509bb5a0e67d037afa5eb523076
SHA13f8c601b9e3cf8af1b7a7f8e8b99f337caa97d9d
SHA256067da2f3df03a2df83b8420c44bcef19995a483179ec0f572777df86622ba461
SHA512b50df71b7ce1f4f5f67e235e137371d3ec6bc468428c6b2055451e19f468552d82161f20742fc874f44cf3130818b65d022c320788bf176da85d4d69a30b970d
-
memory/364-90-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/364-82-0x0000000000000000-mapping.dmp
-
memory/364-261-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/864-77-0x0000000000000000-mapping.dmp
-
memory/896-75-0x0000000000000000-mapping.dmp
-
memory/1100-104-0x000000000048F888-mapping.dmp
-
memory/1100-128-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1100-262-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1260-135-0x0000000000220000-0x000000000030A000-memory.dmpFilesize
936KB
-
memory/1260-127-0x000000000048F888-mapping.dmp
-
memory/1400-221-0x000000000048F888-mapping.dmp
-
memory/1536-252-0x000000000048F888-mapping.dmp
-
memory/1572-80-0x0000000000000000-mapping.dmp
-
memory/1768-190-0x000000000048F888-mapping.dmp
-
memory/1884-79-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB
-
memory/1972-260-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1972-55-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1992-112-0x0000000000000000-mapping.dmp
-
memory/2036-159-0x000000000048F888-mapping.dmp
-
memory/2040-76-0x0000000000000000-mapping.dmp
-
memory/2044-72-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-88-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-74-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-71-0x000000000048F888-mapping.dmp
-
memory/2044-70-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-68-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-66-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-65-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-63-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-61-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-59-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-57-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-56-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB