Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 09:57
Static task
static1
Behavioral task
behavioral1
Sample
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe
Resource
win7-20220812-en
General
-
Target
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe
-
Size
1.3MB
-
MD5
613ab7ed6c2775609f3c9e7b165004da
-
SHA1
7d303cd2d2fea564dc21f0f68a24ef2258ea60b0
-
SHA256
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
-
SHA512
38a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
SSDEEP
24576:RRmJkcoQricOIQxiZY1ia132cWcOrcEMEsDhec44t+Ry34WyuHOiWSz:eJZoQrbTFZY1ia13ycOYEMbec4E12JiV
Malware Config
Extracted
darkcomet
power
gamesgate.servegame.com:1338
gamesgate.servegame.com:8080
gamesgate.servegame.com:1090
gamesgate.servegame.com:27015
gamesgate.servegame.com:5550
gamesgate.servegame.com:1080
gamesgate.servegame.com:2000
gamesgate.servegame.com:15963
DC_MUTEX-DS3FNSW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6NxBhjX09mvh
-
install
true
-
offline_keylogger
true
-
password
power94
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 752 msdcsc.exe 788 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 520 attrib.exe 1812 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 560 notepad.exe -
Loads dropped DLL 1 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exepid process 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exemsdcsc.exedescription pid process target process PID 1852 set thread context of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 752 set thread context of 788 752 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 788 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeSecurityPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeTakeOwnershipPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeLoadDriverPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeSystemProfilePrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeSystemtimePrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeProfSingleProcessPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeIncBasePriorityPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeCreatePagefilePrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeBackupPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeRestorePrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeShutdownPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeDebugPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeSystemEnvironmentPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeChangeNotifyPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeRemoteShutdownPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeUndockPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeManageVolumePrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeImpersonatePrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeCreateGlobalPrivilege 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: 33 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: 34 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: 35 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeIncreaseQuotaPrivilege 788 msdcsc.exe Token: SeSecurityPrivilege 788 msdcsc.exe Token: SeTakeOwnershipPrivilege 788 msdcsc.exe Token: SeLoadDriverPrivilege 788 msdcsc.exe Token: SeSystemProfilePrivilege 788 msdcsc.exe Token: SeSystemtimePrivilege 788 msdcsc.exe Token: SeProfSingleProcessPrivilege 788 msdcsc.exe Token: SeIncBasePriorityPrivilege 788 msdcsc.exe Token: SeCreatePagefilePrivilege 788 msdcsc.exe Token: SeBackupPrivilege 788 msdcsc.exe Token: SeRestorePrivilege 788 msdcsc.exe Token: SeShutdownPrivilege 788 msdcsc.exe Token: SeDebugPrivilege 788 msdcsc.exe Token: SeSystemEnvironmentPrivilege 788 msdcsc.exe Token: SeChangeNotifyPrivilege 788 msdcsc.exe Token: SeRemoteShutdownPrivilege 788 msdcsc.exe Token: SeUndockPrivilege 788 msdcsc.exe Token: SeManageVolumePrivilege 788 msdcsc.exe Token: SeImpersonatePrivilege 788 msdcsc.exe Token: SeCreateGlobalPrivilege 788 msdcsc.exe Token: 33 788 msdcsc.exe Token: 34 788 msdcsc.exe Token: 35 788 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 788 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.execmd.execmd.exemsdcsc.exemsdcsc.exedescription pid process target process PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1852 wrote to memory of 1732 1852 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1732 wrote to memory of 1336 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1732 wrote to memory of 1336 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1732 wrote to memory of 1336 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1732 wrote to memory of 1336 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1732 wrote to memory of 1832 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1732 wrote to memory of 1832 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1732 wrote to memory of 1832 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1732 wrote to memory of 1832 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1732 wrote to memory of 560 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1336 wrote to memory of 520 1336 cmd.exe attrib.exe PID 1336 wrote to memory of 520 1336 cmd.exe attrib.exe PID 1336 wrote to memory of 520 1336 cmd.exe attrib.exe PID 1336 wrote to memory of 520 1336 cmd.exe attrib.exe PID 1832 wrote to memory of 1812 1832 cmd.exe attrib.exe PID 1832 wrote to memory of 1812 1832 cmd.exe attrib.exe PID 1832 wrote to memory of 1812 1832 cmd.exe attrib.exe PID 1832 wrote to memory of 1812 1832 cmd.exe attrib.exe PID 1732 wrote to memory of 752 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe msdcsc.exe PID 1732 wrote to memory of 752 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe msdcsc.exe PID 1732 wrote to memory of 752 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe msdcsc.exe PID 1732 wrote to memory of 752 1732 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 752 wrote to memory of 788 752 msdcsc.exe msdcsc.exe PID 788 wrote to memory of 592 788 msdcsc.exe notepad.exe PID 788 wrote to memory of 592 788 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 520 attrib.exe 1812 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe"C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe"C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.3MB
MD5613ab7ed6c2775609f3c9e7b165004da
SHA17d303cd2d2fea564dc21f0f68a24ef2258ea60b0
SHA256883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
SHA51238a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.3MB
MD5613ab7ed6c2775609f3c9e7b165004da
SHA17d303cd2d2fea564dc21f0f68a24ef2258ea60b0
SHA256883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
SHA51238a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.3MB
MD5613ab7ed6c2775609f3c9e7b165004da
SHA17d303cd2d2fea564dc21f0f68a24ef2258ea60b0
SHA256883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
SHA51238a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.3MB
MD5613ab7ed6c2775609f3c9e7b165004da
SHA17d303cd2d2fea564dc21f0f68a24ef2258ea60b0
SHA256883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
SHA51238a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
memory/520-78-0x0000000000000000-mapping.dmp
-
memory/560-76-0x0000000000000000-mapping.dmp
-
memory/592-105-0x0000000000000000-mapping.dmp
-
memory/752-81-0x0000000000000000-mapping.dmp
-
memory/788-109-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/788-108-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/788-100-0x000000000048F888-mapping.dmp
-
memory/1336-74-0x0000000000000000-mapping.dmp
-
memory/1732-65-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-67-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-55-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-71-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-70-0x000000000048F888-mapping.dmp
-
memory/1732-56-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-69-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-73-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-107-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-64-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-62-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-60-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1732-58-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1812-80-0x0000000000000000-mapping.dmp
-
memory/1832-75-0x0000000000000000-mapping.dmp
-
memory/1852-54-0x0000000075521000-0x0000000075523000-memory.dmpFilesize
8KB