Analysis
-
max time kernel
150s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:50
Static task
static1
Behavioral task
behavioral1
Sample
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe
Resource
win7-20220812-en
General
-
Target
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe
-
Size
329KB
-
MD5
077feedaf2385940d6cb6c485254592f
-
SHA1
105d08d7b083f2204df82ab591c69ebeeddb4299
-
SHA256
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1
-
SHA512
bb78dac12ccc5e84feed1849eb4433ae0850ac71b3df175613dc4bd0fcd520664cdf052345653bc8d48645179d269c3e55adb057f884947abb2e69252221562f
-
SSDEEP
6144:4Qg2zQOG2voQTgbCHEE/fNBLdT9/zxW4q1w12R8OUkYO/WJB:4QdG2wQTgblE3NldT9MZy12RsOk
Malware Config
Extracted
darkcomet
Hacker
cpuexplorerwindows.no-ip.org:1000
DC_MUTEX-25175UU
-
InstallPath
explorer\msdcsc.exe
-
gencode
J2mfaePjL8uT
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Desktop\\explorer\\msdcsc.exe" c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 1080 msdcsc.exe 816 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 760 attrib.exe 1380 attrib.exe -
Processes:
resource yara_rule behavioral1/memory/1496-65-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/1496-67-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/1496-69-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/1496-71-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/1496-74-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/1496-75-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/1496-76-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/1496-98-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/816-110-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/816-111-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/816-114-0x0000000000400000-0x00000000004CB000-memory.dmp upx behavioral1/memory/816-115-0x0000000000400000-0x00000000004CB000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1824 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exepid process 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Desktop\\explorer\\msdcsc.exe" c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Desktop\\explorer\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exemsdcsc.exedescription pid process target process PID 784 set thread context of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 1080 set thread context of 816 1080 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 816 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeSecurityPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeTakeOwnershipPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeLoadDriverPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeSystemProfilePrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeSystemtimePrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeProfSingleProcessPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeIncBasePriorityPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeCreatePagefilePrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeBackupPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeRestorePrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeShutdownPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeDebugPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeSystemEnvironmentPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeChangeNotifyPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeRemoteShutdownPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeUndockPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeManageVolumePrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeImpersonatePrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeCreateGlobalPrivilege 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: 33 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: 34 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: 35 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe Token: SeIncreaseQuotaPrivilege 816 msdcsc.exe Token: SeSecurityPrivilege 816 msdcsc.exe Token: SeTakeOwnershipPrivilege 816 msdcsc.exe Token: SeLoadDriverPrivilege 816 msdcsc.exe Token: SeSystemProfilePrivilege 816 msdcsc.exe Token: SeSystemtimePrivilege 816 msdcsc.exe Token: SeProfSingleProcessPrivilege 816 msdcsc.exe Token: SeIncBasePriorityPrivilege 816 msdcsc.exe Token: SeCreatePagefilePrivilege 816 msdcsc.exe Token: SeBackupPrivilege 816 msdcsc.exe Token: SeRestorePrivilege 816 msdcsc.exe Token: SeShutdownPrivilege 816 msdcsc.exe Token: SeDebugPrivilege 816 msdcsc.exe Token: SeSystemEnvironmentPrivilege 816 msdcsc.exe Token: SeChangeNotifyPrivilege 816 msdcsc.exe Token: SeRemoteShutdownPrivilege 816 msdcsc.exe Token: SeUndockPrivilege 816 msdcsc.exe Token: SeManageVolumePrivilege 816 msdcsc.exe Token: SeImpersonatePrivilege 816 msdcsc.exe Token: SeCreateGlobalPrivilege 816 msdcsc.exe Token: 33 816 msdcsc.exe Token: 34 816 msdcsc.exe Token: 35 816 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exemsdcsc.exemsdcsc.exepid process 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe 1080 msdcsc.exe 816 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exec704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.execmd.execmd.exemsdcsc.exemsdcsc.exedescription pid process target process PID 784 wrote to memory of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 784 wrote to memory of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 784 wrote to memory of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 784 wrote to memory of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 784 wrote to memory of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 784 wrote to memory of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 784 wrote to memory of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 784 wrote to memory of 1496 784 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe PID 1496 wrote to memory of 1480 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe cmd.exe PID 1496 wrote to memory of 1480 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe cmd.exe PID 1496 wrote to memory of 1480 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe cmd.exe PID 1496 wrote to memory of 1480 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe cmd.exe PID 1496 wrote to memory of 1528 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe cmd.exe PID 1496 wrote to memory of 1528 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe cmd.exe PID 1496 wrote to memory of 1528 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe cmd.exe PID 1496 wrote to memory of 1528 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe cmd.exe PID 1480 wrote to memory of 1380 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 1380 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 1380 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 1380 1480 cmd.exe attrib.exe PID 1528 wrote to memory of 760 1528 cmd.exe attrib.exe PID 1528 wrote to memory of 760 1528 cmd.exe attrib.exe PID 1528 wrote to memory of 760 1528 cmd.exe attrib.exe PID 1528 wrote to memory of 760 1528 cmd.exe attrib.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1824 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe notepad.exe PID 1496 wrote to memory of 1080 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe msdcsc.exe PID 1496 wrote to memory of 1080 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe msdcsc.exe PID 1496 wrote to memory of 1080 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe msdcsc.exe PID 1496 wrote to memory of 1080 1496 c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe msdcsc.exe PID 1080 wrote to memory of 816 1080 msdcsc.exe msdcsc.exe PID 1080 wrote to memory of 816 1080 msdcsc.exe msdcsc.exe PID 1080 wrote to memory of 816 1080 msdcsc.exe msdcsc.exe PID 1080 wrote to memory of 816 1080 msdcsc.exe msdcsc.exe PID 1080 wrote to memory of 816 1080 msdcsc.exe msdcsc.exe PID 1080 wrote to memory of 816 1080 msdcsc.exe msdcsc.exe PID 1080 wrote to memory of 816 1080 msdcsc.exe msdcsc.exe PID 1080 wrote to memory of 816 1080 msdcsc.exe msdcsc.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe PID 816 wrote to memory of 1960 816 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 760 attrib.exe 1380 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe"C:\Users\Admin\AppData\Local\Temp\c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
-
C:\Users\Admin\Desktop\explorer\msdcsc.exe"C:\Users\Admin\Desktop\explorer\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\explorer\msdcsc.exe
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\explorer\msdcsc.exeFilesize
329KB
MD5077feedaf2385940d6cb6c485254592f
SHA1105d08d7b083f2204df82ab591c69ebeeddb4299
SHA256c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1
SHA512bb78dac12ccc5e84feed1849eb4433ae0850ac71b3df175613dc4bd0fcd520664cdf052345653bc8d48645179d269c3e55adb057f884947abb2e69252221562f
-
C:\Users\Admin\Desktop\explorer\msdcsc.exeFilesize
329KB
MD5077feedaf2385940d6cb6c485254592f
SHA1105d08d7b083f2204df82ab591c69ebeeddb4299
SHA256c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1
SHA512bb78dac12ccc5e84feed1849eb4433ae0850ac71b3df175613dc4bd0fcd520664cdf052345653bc8d48645179d269c3e55adb057f884947abb2e69252221562f
-
C:\Users\Admin\Desktop\explorer\msdcsc.exeFilesize
329KB
MD5077feedaf2385940d6cb6c485254592f
SHA1105d08d7b083f2204df82ab591c69ebeeddb4299
SHA256c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1
SHA512bb78dac12ccc5e84feed1849eb4433ae0850ac71b3df175613dc4bd0fcd520664cdf052345653bc8d48645179d269c3e55adb057f884947abb2e69252221562f
-
\Users\Admin\Desktop\explorer\msdcsc.exeFilesize
329KB
MD5077feedaf2385940d6cb6c485254592f
SHA1105d08d7b083f2204df82ab591c69ebeeddb4299
SHA256c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1
SHA512bb78dac12ccc5e84feed1849eb4433ae0850ac71b3df175613dc4bd0fcd520664cdf052345653bc8d48645179d269c3e55adb057f884947abb2e69252221562f
-
\Users\Admin\Desktop\explorer\msdcsc.exeFilesize
329KB
MD5077feedaf2385940d6cb6c485254592f
SHA1105d08d7b083f2204df82ab591c69ebeeddb4299
SHA256c704c4d969efd8e763ca9652d892da7c920001486bdf25c86a890166a0990ce1
SHA512bb78dac12ccc5e84feed1849eb4433ae0850ac71b3df175613dc4bd0fcd520664cdf052345653bc8d48645179d269c3e55adb057f884947abb2e69252221562f
-
memory/760-80-0x0000000000000000-mapping.dmp
-
memory/784-59-0x0000000000370000-0x0000000000380000-memory.dmpFilesize
64KB
-
memory/784-73-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/784-62-0x00000000003A0000-0x00000000003B0000-memory.dmpFilesize
64KB
-
memory/784-63-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/784-61-0x0000000000390000-0x00000000003A0000-memory.dmpFilesize
64KB
-
memory/784-55-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/784-56-0x0000000000300000-0x0000000000310000-memory.dmpFilesize
64KB
-
memory/784-57-0x0000000000310000-0x0000000000320000-memory.dmpFilesize
64KB
-
memory/784-54-0x0000000000220000-0x0000000000230000-memory.dmpFilesize
64KB
-
memory/784-60-0x0000000000380000-0x0000000000390000-memory.dmpFilesize
64KB
-
memory/784-58-0x0000000000320000-0x0000000000330000-memory.dmpFilesize
64KB
-
memory/816-115-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/816-105-0x00000000004C0E70-mapping.dmp
-
memory/816-110-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/816-111-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/816-114-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1080-94-0x0000000000360000-0x0000000000370000-memory.dmpFilesize
64KB
-
memory/1080-92-0x0000000000340000-0x0000000000350000-memory.dmpFilesize
64KB
-
memory/1080-108-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-97-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-85-0x0000000000000000-mapping.dmp
-
memory/1080-93-0x0000000000350000-0x0000000000360000-memory.dmpFilesize
64KB
-
memory/1080-87-0x00000000002A0000-0x00000000002B0000-memory.dmpFilesize
64KB
-
memory/1080-88-0x00000000002B0000-0x00000000002C0000-memory.dmpFilesize
64KB
-
memory/1080-89-0x0000000000300000-0x0000000000310000-memory.dmpFilesize
64KB
-
memory/1080-91-0x0000000000330000-0x0000000000340000-memory.dmpFilesize
64KB
-
memory/1380-79-0x0000000000000000-mapping.dmp
-
memory/1480-77-0x0000000000000000-mapping.dmp
-
memory/1496-75-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1496-71-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1496-74-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1496-72-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/1496-96-0x0000000003AA0000-0x0000000003AAB000-memory.dmpFilesize
44KB
-
memory/1496-64-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1496-98-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1496-76-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1496-70-0x00000000004C0E70-mapping.dmp
-
memory/1496-65-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1496-69-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1496-67-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1528-78-0x0000000000000000-mapping.dmp
-
memory/1824-81-0x0000000000000000-mapping.dmp
-
memory/1960-112-0x0000000000000000-mapping.dmp