Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 17:36
Static task
static1
Behavioral task
behavioral1
Sample
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe
Resource
win10v2004-20220901-en
General
-
Target
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe
-
Size
825KB
-
MD5
8ee96064220b9576479c458e2ad51411
-
SHA1
ef27c1347df38df970d6d0ac9c3330c60d032dbb
-
SHA256
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8
-
SHA512
74658cad0d8b38191e90e068e3e7bb7429e7e3a41555a5fadf33b6118ac36e8f4f1b8e5de20c17a340985285e7899c104d1eb5f5e8074c5dc193b934dc016f8a
-
SSDEEP
12288:GPcF55DQMSjPaiibTKQZEHi3usCJbGwVHxxhqW+yeGUqG2RKSC:GPGUVPanKMZ35CJCw3rY41n
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
AppLaunch.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WidnowsUpdate\\msdcsc.exe" AppLaunch.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4044 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1320 attrib.exe 5116 attrib.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AppLaunch.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\WidnowsUpdate\\msdcsc.exe" AppLaunch.exe -
Drops file in System32 directory 3 IoCs
Processes:
AppLaunch.exedescription ioc process File opened for modification C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exe AppLaunch.exe File opened for modification C:\Windows\SysWOW64\WidnowsUpdate\ AppLaunch.exe File created C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exe AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exedescription pid process target process PID 4864 set thread context of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
Modifies registry class 1 IoCs
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe Token: SeIncreaseQuotaPrivilege 4760 AppLaunch.exe Token: SeSecurityPrivilege 4760 AppLaunch.exe Token: SeTakeOwnershipPrivilege 4760 AppLaunch.exe Token: SeLoadDriverPrivilege 4760 AppLaunch.exe Token: SeSystemProfilePrivilege 4760 AppLaunch.exe Token: SeSystemtimePrivilege 4760 AppLaunch.exe Token: SeProfSingleProcessPrivilege 4760 AppLaunch.exe Token: SeIncBasePriorityPrivilege 4760 AppLaunch.exe Token: SeCreatePagefilePrivilege 4760 AppLaunch.exe Token: SeBackupPrivilege 4760 AppLaunch.exe Token: SeRestorePrivilege 4760 AppLaunch.exe Token: SeShutdownPrivilege 4760 AppLaunch.exe Token: SeDebugPrivilege 4760 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 4760 AppLaunch.exe Token: SeChangeNotifyPrivilege 4760 AppLaunch.exe Token: SeRemoteShutdownPrivilege 4760 AppLaunch.exe Token: SeUndockPrivilege 4760 AppLaunch.exe Token: SeManageVolumePrivilege 4760 AppLaunch.exe Token: SeImpersonatePrivilege 4760 AppLaunch.exe Token: SeCreateGlobalPrivilege 4760 AppLaunch.exe Token: 33 4760 AppLaunch.exe Token: 34 4760 AppLaunch.exe Token: 35 4760 AppLaunch.exe Token: 36 4760 AppLaunch.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exeAppLaunch.execmd.execmd.exedescription pid process target process PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4864 wrote to memory of 4760 4864 cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe AppLaunch.exe PID 4760 wrote to memory of 3420 4760 AppLaunch.exe cmd.exe PID 4760 wrote to memory of 3420 4760 AppLaunch.exe cmd.exe PID 4760 wrote to memory of 3420 4760 AppLaunch.exe cmd.exe PID 4760 wrote to memory of 64 4760 AppLaunch.exe cmd.exe PID 4760 wrote to memory of 64 4760 AppLaunch.exe cmd.exe PID 4760 wrote to memory of 64 4760 AppLaunch.exe cmd.exe PID 3420 wrote to memory of 1320 3420 cmd.exe attrib.exe PID 3420 wrote to memory of 1320 3420 cmd.exe attrib.exe PID 3420 wrote to memory of 1320 3420 cmd.exe attrib.exe PID 64 wrote to memory of 5116 64 cmd.exe attrib.exe PID 64 wrote to memory of 5116 64 cmd.exe attrib.exe PID 64 wrote to memory of 5116 64 cmd.exe attrib.exe PID 4760 wrote to memory of 4044 4760 AppLaunch.exe msdcsc.exe PID 4760 wrote to memory of 4044 4760 AppLaunch.exe msdcsc.exe PID 4760 wrote to memory of 4044 4760 AppLaunch.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1320 attrib.exe 5116 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe"C:\Users\Admin\AppData\Local\Temp\cb2ba9ccdb9029771747844d79baa1cffdf68239a25396f9641b70eb52f1ddf8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exe"C:\Windows\system32\WidnowsUpdate\msdcsc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpcmd.batFilesize
62B
MD5c6abd7a109bb37ab773b9e79b91b7741
SHA17933b8795914b27483d2afed35b3830e8bf5bdb6
SHA2568bc84b3ddfd9c295f555926bf1c311be423732423c585ca90796cdee7a245629
SHA51235d14c9b7366a4737e3685223d55d85c583c7fbe73274577424dc8d9960cc78c79a80a8b42a62f6d9d9962ddd60cf2a332411d4ac18196258dc9d5b0b575e3dc
-
C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exeFilesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
C:\Windows\SysWOW64\WidnowsUpdate\msdcsc.exeFilesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
memory/64-139-0x0000000000000000-mapping.dmp
-
memory/1320-141-0x0000000000000000-mapping.dmp
-
memory/3420-138-0x0000000000000000-mapping.dmp
-
memory/4044-143-0x0000000000000000-mapping.dmp
-
memory/4760-136-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/4760-135-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/4760-134-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/4760-133-0x0000000000000000-mapping.dmp
-
memory/4864-132-0x0000000074B50000-0x0000000075101000-memory.dmpFilesize
5.7MB
-
memory/4864-137-0x0000000074B50000-0x0000000075101000-memory.dmpFilesize
5.7MB
-
memory/5116-142-0x0000000000000000-mapping.dmp