Analysis
-
max time kernel
152s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 05:33
Static task
static1
Behavioral task
behavioral1
Sample
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe
Resource
win7-20220812-en
General
-
Target
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe
-
Size
728KB
-
MD5
e936ee9540a39e6f96544ceb64109d43
-
SHA1
7009a12790c17f814fbd708acf05a7ccc3f46d9f
-
SHA256
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48
-
SHA512
a6f69161adafd7b6c83feb60180a63f46b7092802e25251a3326dc7eea9f093c1ae056b225ee206c346bfad60731b3ebb55551b2ba9d3202214fdafd591b7a6d
-
SSDEEP
12288:fQ9HfogpbIAUjLVfp5xyAVgDfT0INc7FcsduLIBjgKmFSKHW8HUaosrK:bgpbFUVfp5vQL/mmw1BjgKToUaosu
Malware Config
Extracted
darkcomet
Guest16
giox3.no-ip.biz:1993
DC_MUTEX-6H6WXL4
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
XobFUkY25DbB
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 2736 msdcsc.exe 4712 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4820 attrib.exe 4784 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 4 IoCs
Processes:
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exemsdcsc.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exemsdcsc.exedescription pid process target process PID 3804 set thread context of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 2736 set thread context of 4712 2736 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 4712 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeSecurityPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeTakeOwnershipPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeLoadDriverPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeSystemProfilePrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeSystemtimePrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeProfSingleProcessPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeIncBasePriorityPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeCreatePagefilePrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeBackupPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeRestorePrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeShutdownPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeDebugPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeSystemEnvironmentPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeChangeNotifyPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeRemoteShutdownPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeUndockPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeManageVolumePrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeImpersonatePrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeCreateGlobalPrivilege 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: 33 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: 34 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: 35 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: 36 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe Token: SeIncreaseQuotaPrivilege 4712 msdcsc.exe Token: SeSecurityPrivilege 4712 msdcsc.exe Token: SeTakeOwnershipPrivilege 4712 msdcsc.exe Token: SeLoadDriverPrivilege 4712 msdcsc.exe Token: SeSystemProfilePrivilege 4712 msdcsc.exe Token: SeSystemtimePrivilege 4712 msdcsc.exe Token: SeProfSingleProcessPrivilege 4712 msdcsc.exe Token: SeIncBasePriorityPrivilege 4712 msdcsc.exe Token: SeCreatePagefilePrivilege 4712 msdcsc.exe Token: SeBackupPrivilege 4712 msdcsc.exe Token: SeRestorePrivilege 4712 msdcsc.exe Token: SeShutdownPrivilege 4712 msdcsc.exe Token: SeDebugPrivilege 4712 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4712 msdcsc.exe Token: SeChangeNotifyPrivilege 4712 msdcsc.exe Token: SeRemoteShutdownPrivilege 4712 msdcsc.exe Token: SeUndockPrivilege 4712 msdcsc.exe Token: SeManageVolumePrivilege 4712 msdcsc.exe Token: SeImpersonatePrivilege 4712 msdcsc.exe Token: SeCreateGlobalPrivilege 4712 msdcsc.exe Token: 33 4712 msdcsc.exe Token: 34 4712 msdcsc.exe Token: 35 4712 msdcsc.exe Token: 36 4712 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 4712 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exec45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.execmd.execmd.exemsdcsc.exemsdcsc.exedescription pid process target process PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 3804 wrote to memory of 2040 3804 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe PID 2040 wrote to memory of 3148 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe cmd.exe PID 2040 wrote to memory of 3148 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe cmd.exe PID 2040 wrote to memory of 3148 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe cmd.exe PID 2040 wrote to memory of 1536 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe cmd.exe PID 2040 wrote to memory of 1536 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe cmd.exe PID 2040 wrote to memory of 1536 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe cmd.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 2040 wrote to memory of 1296 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe notepad.exe PID 3148 wrote to memory of 4820 3148 cmd.exe attrib.exe PID 3148 wrote to memory of 4820 3148 cmd.exe attrib.exe PID 3148 wrote to memory of 4820 3148 cmd.exe attrib.exe PID 1536 wrote to memory of 4784 1536 cmd.exe attrib.exe PID 1536 wrote to memory of 4784 1536 cmd.exe attrib.exe PID 1536 wrote to memory of 4784 1536 cmd.exe attrib.exe PID 2040 wrote to memory of 2736 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe msdcsc.exe PID 2040 wrote to memory of 2736 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe msdcsc.exe PID 2040 wrote to memory of 2736 2040 c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 2736 wrote to memory of 4712 2736 msdcsc.exe msdcsc.exe PID 4712 wrote to memory of 4940 4712 msdcsc.exe notepad.exe PID 4712 wrote to memory of 4940 4712 msdcsc.exe notepad.exe PID 4712 wrote to memory of 4940 4712 msdcsc.exe notepad.exe PID 4712 wrote to memory of 4940 4712 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4820 attrib.exe 4784 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe"C:\Users\Admin\AppData\Local\Temp\c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exeC:\Users\Admin\AppData\Local\Temp\c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeC:\Windows\SysWOW64\MSDCSC\msdcsc.exe4⤵
- Modifies firewall policy service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5e936ee9540a39e6f96544ceb64109d43
SHA17009a12790c17f814fbd708acf05a7ccc3f46d9f
SHA256c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48
SHA512a6f69161adafd7b6c83feb60180a63f46b7092802e25251a3326dc7eea9f093c1ae056b225ee206c346bfad60731b3ebb55551b2ba9d3202214fdafd591b7a6d
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5e936ee9540a39e6f96544ceb64109d43
SHA17009a12790c17f814fbd708acf05a7ccc3f46d9f
SHA256c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48
SHA512a6f69161adafd7b6c83feb60180a63f46b7092802e25251a3326dc7eea9f093c1ae056b225ee206c346bfad60731b3ebb55551b2ba9d3202214fdafd591b7a6d
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5e936ee9540a39e6f96544ceb64109d43
SHA17009a12790c17f814fbd708acf05a7ccc3f46d9f
SHA256c45da0c02202b27f6aa1b71808c49c4c37e8f55ef476b602c2b2fcfe06c67d48
SHA512a6f69161adafd7b6c83feb60180a63f46b7092802e25251a3326dc7eea9f093c1ae056b225ee206c346bfad60731b3ebb55551b2ba9d3202214fdafd591b7a6d
-
memory/1296-140-0x0000000000000000-mapping.dmp
-
memory/1536-139-0x0000000000000000-mapping.dmp
-
memory/2040-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2040-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2040-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2040-146-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2040-132-0x0000000000000000-mapping.dmp
-
memory/2040-133-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2736-143-0x0000000000000000-mapping.dmp
-
memory/3148-138-0x0000000000000000-mapping.dmp
-
memory/3804-134-0x0000000000750000-0x0000000000756000-memory.dmpFilesize
24KB
-
memory/4712-147-0x0000000000000000-mapping.dmp
-
memory/4712-151-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4712-153-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4712-154-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4784-142-0x0000000000000000-mapping.dmp
-
memory/4820-141-0x0000000000000000-mapping.dmp
-
memory/4940-152-0x0000000000000000-mapping.dmp