Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 17:36
Static task
static1
Behavioral task
behavioral1
Sample
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe
Resource
win10v2004-20220901-en
General
-
Target
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe
-
Size
825KB
-
MD5
8ee96064220b9576479c458e2ad51411
-
SHA1
ef27c1347df38df970d6d0ac9c3330c60d032dbb
-
SHA256
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8
-
SHA512
74658cad0d8b38191e90e068e3e7bb7429e7e3a41555a5fadf33b6118ac36e8f4f1b8e5de20c17a340985285e7899c104d1eb5f5e8074c5dc193b934dc016f8a
-
SSDEEP
12288:GPcF55DQMSjPaiibTKQZEHi3usCJbGwVHxxhqW+yeGUqG2RKSC:GPGUVPanKMZ35CJCw3rY41n
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
AppLaunch.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WidnowsUpdate\\msdcsc.exe" AppLaunch.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 384 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 520 attrib.exe 700 attrib.exe -
Loads dropped DLL 1 IoCs
Processes:
AppLaunch.exepid process 2016 AppLaunch.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AppLaunch.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\WidnowsUpdate\\msdcsc.exe" AppLaunch.exe -
Drops file in System32 directory 3 IoCs
Processes:
AppLaunch.exedescription ioc process File opened for modification C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exe AppLaunch.exe File opened for modification C:\Windows\SysWOW64\WidnowsUpdate\ AppLaunch.exe File created C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exe AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exedescription pid process target process PID 1964 set thread context of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe Token: SeIncreaseQuotaPrivilege 2016 AppLaunch.exe Token: SeSecurityPrivilege 2016 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2016 AppLaunch.exe Token: SeLoadDriverPrivilege 2016 AppLaunch.exe Token: SeSystemProfilePrivilege 2016 AppLaunch.exe Token: SeSystemtimePrivilege 2016 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2016 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2016 AppLaunch.exe Token: SeCreatePagefilePrivilege 2016 AppLaunch.exe Token: SeBackupPrivilege 2016 AppLaunch.exe Token: SeRestorePrivilege 2016 AppLaunch.exe Token: SeShutdownPrivilege 2016 AppLaunch.exe Token: SeDebugPrivilege 2016 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 2016 AppLaunch.exe Token: SeChangeNotifyPrivilege 2016 AppLaunch.exe Token: SeRemoteShutdownPrivilege 2016 AppLaunch.exe Token: SeUndockPrivilege 2016 AppLaunch.exe Token: SeManageVolumePrivilege 2016 AppLaunch.exe Token: SeImpersonatePrivilege 2016 AppLaunch.exe Token: SeCreateGlobalPrivilege 2016 AppLaunch.exe Token: 33 2016 AppLaunch.exe Token: 34 2016 AppLaunch.exe Token: 35 2016 AppLaunch.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exeAppLaunch.execmd.execmd.exedescription pid process target process PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 1964 wrote to memory of 2016 1964 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 2016 wrote to memory of 2004 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 2004 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 2004 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 2004 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 2004 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 2004 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 2004 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 1768 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 1768 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 1768 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 1768 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 1768 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 1768 2016 AppLaunch.exe cmd.exe PID 2016 wrote to memory of 1768 2016 AppLaunch.exe cmd.exe PID 1768 wrote to memory of 700 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 700 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 700 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 700 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 700 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 700 1768 cmd.exe attrib.exe PID 1768 wrote to memory of 700 1768 cmd.exe attrib.exe PID 2004 wrote to memory of 520 2004 cmd.exe attrib.exe PID 2004 wrote to memory of 520 2004 cmd.exe attrib.exe PID 2004 wrote to memory of 520 2004 cmd.exe attrib.exe PID 2004 wrote to memory of 520 2004 cmd.exe attrib.exe PID 2004 wrote to memory of 520 2004 cmd.exe attrib.exe PID 2004 wrote to memory of 520 2004 cmd.exe attrib.exe PID 2004 wrote to memory of 520 2004 cmd.exe attrib.exe PID 2016 wrote to memory of 384 2016 AppLaunch.exe msdcsc.exe PID 2016 wrote to memory of 384 2016 AppLaunch.exe msdcsc.exe PID 2016 wrote to memory of 384 2016 AppLaunch.exe msdcsc.exe PID 2016 wrote to memory of 384 2016 AppLaunch.exe msdcsc.exe PID 2016 wrote to memory of 384 2016 AppLaunch.exe msdcsc.exe PID 2016 wrote to memory of 384 2016 AppLaunch.exe msdcsc.exe PID 2016 wrote to memory of 384 2016 AppLaunch.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 520 attrib.exe 700 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe"C:\Users\Admin\AppData\Local\Temp\cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exe"C:\Windows\system32\WidnowsUpdate\msdcsc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpcmd.batFilesize
62B
MD5c6abd7a109bb37ab773b9e79b91b7741
SHA17933b8795914b27483d2afed35b3830e8bf5bdb6
SHA2568bc84b3ddfd9c295f555926bf1c311be423732423c585ca90796cdee7a245629
SHA51235d14c9b7366a4737e3685223d55d85c583c7fbe73274577424dc8d9960cc78c79a80a8b42a62f6d9d9962ddd60cf2a332411d4ac18196258dc9d5b0b575e3dc
-
C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exeFilesize
54KB
MD50f01571a3e4c71eb4313175aae86488e
SHA12ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA2568cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794
-
C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exeFilesize
54KB
MD50f01571a3e4c71eb4313175aae86488e
SHA12ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA2568cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794
-
\Windows\SysWOW64\WidnowsUpdate\msdcsc.exeFilesize
54KB
MD50f01571a3e4c71eb4313175aae86488e
SHA12ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA2568cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794
-
memory/384-87-0x0000000000000000-mapping.dmp
-
memory/520-83-0x0000000000000000-mapping.dmp
-
memory/700-82-0x0000000000000000-mapping.dmp
-
memory/1768-78-0x0000000000000000-mapping.dmp
-
memory/1964-74-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/1964-54-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/1964-92-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/2004-77-0x0000000000000000-mapping.dmp
-
memory/2016-65-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-62-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-76-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-71-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-67-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-69-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-64-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-73-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-60-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-58-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-56-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-55-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2016-90-0x0000000000401000-0x000000000049F000-memory.dmpFilesize
632KB
-
memory/2016-70-0x000000000049F92C-mapping.dmp