Analysis
-
max time kernel
157s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 09:57
Static task
static1
Behavioral task
behavioral1
Sample
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe
Resource
win7-20220812-en
General
-
Target
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe
-
Size
1.3MB
-
MD5
613ab7ed6c2775609f3c9e7b165004da
-
SHA1
7d303cd2d2fea564dc21f0f68a24ef2258ea60b0
-
SHA256
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
-
SHA512
38a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
SSDEEP
24576:RRmJkcoQricOIQxiZY1ia132cWcOrcEMEsDhec44t+Ry34WyuHOiWSz:eJZoQrbTFZY1ia13ycOYEMbec4E12JiV
Malware Config
Extracted
darkcomet
power
gamesgate.servegame.com:1338
gamesgate.servegame.com:8080
gamesgate.servegame.com:1090
gamesgate.servegame.com:27015
gamesgate.servegame.com:5550
gamesgate.servegame.com:1080
gamesgate.servegame.com:2000
gamesgate.servegame.com:15963
DC_MUTEX-DS3FNSW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6NxBhjX09mvh
-
install
true
-
offline_keylogger
true
-
password
power94
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 4968 msdcsc.exe 2396 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1536 attrib.exe 4692 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exemsdcsc.exedescription pid process target process PID 2736 set thread context of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 4968 set thread context of 2396 4968 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 2396 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeSecurityPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeTakeOwnershipPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeLoadDriverPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeSystemProfilePrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeSystemtimePrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeProfSingleProcessPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeIncBasePriorityPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeCreatePagefilePrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeBackupPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeRestorePrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeShutdownPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeDebugPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeSystemEnvironmentPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeChangeNotifyPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeRemoteShutdownPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeUndockPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeManageVolumePrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeImpersonatePrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeCreateGlobalPrivilege 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: 33 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: 34 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: 35 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: 36 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe Token: SeIncreaseQuotaPrivilege 2396 msdcsc.exe Token: SeSecurityPrivilege 2396 msdcsc.exe Token: SeTakeOwnershipPrivilege 2396 msdcsc.exe Token: SeLoadDriverPrivilege 2396 msdcsc.exe Token: SeSystemProfilePrivilege 2396 msdcsc.exe Token: SeSystemtimePrivilege 2396 msdcsc.exe Token: SeProfSingleProcessPrivilege 2396 msdcsc.exe Token: SeIncBasePriorityPrivilege 2396 msdcsc.exe Token: SeCreatePagefilePrivilege 2396 msdcsc.exe Token: SeBackupPrivilege 2396 msdcsc.exe Token: SeRestorePrivilege 2396 msdcsc.exe Token: SeShutdownPrivilege 2396 msdcsc.exe Token: SeDebugPrivilege 2396 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2396 msdcsc.exe Token: SeChangeNotifyPrivilege 2396 msdcsc.exe Token: SeRemoteShutdownPrivilege 2396 msdcsc.exe Token: SeUndockPrivilege 2396 msdcsc.exe Token: SeManageVolumePrivilege 2396 msdcsc.exe Token: SeImpersonatePrivilege 2396 msdcsc.exe Token: SeCreateGlobalPrivilege 2396 msdcsc.exe Token: 33 2396 msdcsc.exe Token: 34 2396 msdcsc.exe Token: 35 2396 msdcsc.exe Token: 36 2396 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 2396 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.execmd.execmd.exemsdcsc.exemsdcsc.exedescription pid process target process PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 2736 wrote to memory of 1576 2736 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe PID 1576 wrote to memory of 3644 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1576 wrote to memory of 3644 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1576 wrote to memory of 3644 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1576 wrote to memory of 1516 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1576 wrote to memory of 1516 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1576 wrote to memory of 1516 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe cmd.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4996 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe notepad.exe PID 1576 wrote to memory of 4968 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe msdcsc.exe PID 1576 wrote to memory of 4968 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe msdcsc.exe PID 1576 wrote to memory of 4968 1576 883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe msdcsc.exe PID 1516 wrote to memory of 1536 1516 cmd.exe attrib.exe PID 1516 wrote to memory of 1536 1516 cmd.exe attrib.exe PID 1516 wrote to memory of 1536 1516 cmd.exe attrib.exe PID 3644 wrote to memory of 4692 3644 cmd.exe attrib.exe PID 3644 wrote to memory of 4692 3644 cmd.exe attrib.exe PID 3644 wrote to memory of 4692 3644 cmd.exe attrib.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 4968 wrote to memory of 2396 4968 msdcsc.exe msdcsc.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe PID 2396 wrote to memory of 3376 2396 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4692 attrib.exe 1536 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe"C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe"C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.3MB
MD5613ab7ed6c2775609f3c9e7b165004da
SHA17d303cd2d2fea564dc21f0f68a24ef2258ea60b0
SHA256883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
SHA51238a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.3MB
MD5613ab7ed6c2775609f3c9e7b165004da
SHA17d303cd2d2fea564dc21f0f68a24ef2258ea60b0
SHA256883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
SHA51238a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.3MB
MD5613ab7ed6c2775609f3c9e7b165004da
SHA17d303cd2d2fea564dc21f0f68a24ef2258ea60b0
SHA256883cf3810eb735788c1bd2a988516b0dff332834bde632a57de80f83bbfa56a2
SHA51238a376a1230269abc1c94392e98c0a8b71b12ff3b690546751229528c82da8541840d572cb76a0b7f0f5df04c4939c65490d7f1f837af7c430feca4ecf6b775a
-
memory/1516-138-0x0000000000000000-mapping.dmp
-
memory/1536-143-0x0000000000000000-mapping.dmp
-
memory/1576-132-0x0000000000000000-mapping.dmp
-
memory/1576-136-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1576-135-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1576-134-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1576-151-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1576-133-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2396-153-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2396-152-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2396-145-0x0000000000000000-mapping.dmp
-
memory/3376-150-0x0000000000000000-mapping.dmp
-
memory/3644-137-0x0000000000000000-mapping.dmp
-
memory/4692-144-0x0000000000000000-mapping.dmp
-
memory/4968-140-0x0000000000000000-mapping.dmp
-
memory/4996-139-0x0000000000000000-mapping.dmp