Analysis
-
max time kernel
208s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 05:15
Static task
static1
Behavioral task
behavioral1
Sample
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe
Resource
win7-20221111-en
General
-
Target
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe
-
Size
377KB
-
MD5
a1f0d356df081f4cde159183f402ee93
-
SHA1
3c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
-
SHA256
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
-
SHA512
47442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
SSDEEP
6144:GxL3BJrfJXTGhbR1OJguwMNNvyGAcE0njDs9Eoej+4+bnjb3PZAizgk9:urTfkNF3aNvyGAhE09yKdjjDZxp
Malware Config
Extracted
darkcomet
HF
safethinking.zapto.org:1604
DC_MUTEX-F0NJMAE
-
InstallPath
MSDCSC\svchost.exe
-
gencode
JGGiVLcb5Yzq
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
svchost
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\svchost.exe" c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile svchost.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 1484 svchost.exe 1556 svchost.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1772 attrib.exe 1756 attrib.exe -
Processes:
resource yara_rule behavioral1/memory/1776-57-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1776-59-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1776-61-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1776-63-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1776-65-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1776-66-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1776-71-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1556-89-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1556-90-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1556-91-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1556-93-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exepid process 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe -
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exec76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exesvchost.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\svchost.exe" c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\svchost.exe" svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exesvchost.exedescription pid process target process PID 1688 set thread context of 1516 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 1688 set thread context of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1484 set thread context of 1964 1484 svchost.exe iexplore.exe PID 1484 set thread context of 1556 1484 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377069888" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFE66E11-7527-11ED-BDBF-EEAC7132E42C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exesvchost.exepid process 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe 1484 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svchost.exepid process 1556 svchost.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exesvchost.exedescription pid process Token: SeIncreaseQuotaPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeSecurityPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeTakeOwnershipPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeLoadDriverPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeSystemProfilePrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeSystemtimePrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeProfSingleProcessPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeIncBasePriorityPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeCreatePagefilePrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeBackupPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeRestorePrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeShutdownPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeDebugPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeSystemEnvironmentPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeChangeNotifyPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeRemoteShutdownPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeUndockPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeManageVolumePrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeImpersonatePrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeCreateGlobalPrivilege 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: 33 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: 34 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: 35 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeIncreaseQuotaPrivilege 1556 svchost.exe Token: SeSecurityPrivilege 1556 svchost.exe Token: SeTakeOwnershipPrivilege 1556 svchost.exe Token: SeLoadDriverPrivilege 1556 svchost.exe Token: SeSystemProfilePrivilege 1556 svchost.exe Token: SeSystemtimePrivilege 1556 svchost.exe Token: SeProfSingleProcessPrivilege 1556 svchost.exe Token: SeIncBasePriorityPrivilege 1556 svchost.exe Token: SeCreatePagefilePrivilege 1556 svchost.exe Token: SeBackupPrivilege 1556 svchost.exe Token: SeRestorePrivilege 1556 svchost.exe Token: SeShutdownPrivilege 1556 svchost.exe Token: SeDebugPrivilege 1556 svchost.exe Token: SeSystemEnvironmentPrivilege 1556 svchost.exe Token: SeChangeNotifyPrivilege 1556 svchost.exe Token: SeRemoteShutdownPrivilege 1556 svchost.exe Token: SeUndockPrivilege 1556 svchost.exe Token: SeManageVolumePrivilege 1556 svchost.exe Token: SeImpersonatePrivilege 1556 svchost.exe Token: SeCreateGlobalPrivilege 1556 svchost.exe Token: 33 1556 svchost.exe Token: 34 1556 svchost.exe Token: 35 1556 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1516 iexplore.exe 1516 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEsvchost.exepid process 1516 iexplore.exe 1516 iexplore.exe 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1516 iexplore.exe 1516 iexplore.exe 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE 1556 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exeiexplore.exec76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.execmd.execmd.exesvchost.exesvchost.exedescription pid process target process PID 1688 wrote to memory of 1516 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 1688 wrote to memory of 1516 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 1688 wrote to memory of 1516 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 1688 wrote to memory of 1516 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 1688 wrote to memory of 1516 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 1688 wrote to memory of 1516 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 1688 wrote to memory of 1516 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 1688 wrote to memory of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1688 wrote to memory of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1688 wrote to memory of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1688 wrote to memory of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1688 wrote to memory of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1688 wrote to memory of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1688 wrote to memory of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1688 wrote to memory of 1776 1688 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1516 wrote to memory of 1056 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 1056 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 1056 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 1056 1516 iexplore.exe IEXPLORE.EXE PID 1776 wrote to memory of 1912 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1776 wrote to memory of 1912 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1776 wrote to memory of 1912 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1776 wrote to memory of 1912 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1776 wrote to memory of 1800 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1776 wrote to memory of 1800 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1776 wrote to memory of 1800 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1776 wrote to memory of 1800 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1912 wrote to memory of 1772 1912 cmd.exe attrib.exe PID 1912 wrote to memory of 1772 1912 cmd.exe attrib.exe PID 1912 wrote to memory of 1772 1912 cmd.exe attrib.exe PID 1912 wrote to memory of 1772 1912 cmd.exe attrib.exe PID 1800 wrote to memory of 1756 1800 cmd.exe attrib.exe PID 1800 wrote to memory of 1756 1800 cmd.exe attrib.exe PID 1800 wrote to memory of 1756 1800 cmd.exe attrib.exe PID 1800 wrote to memory of 1756 1800 cmd.exe attrib.exe PID 1776 wrote to memory of 1484 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe svchost.exe PID 1776 wrote to memory of 1484 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe svchost.exe PID 1776 wrote to memory of 1484 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe svchost.exe PID 1776 wrote to memory of 1484 1776 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe svchost.exe PID 1484 wrote to memory of 1964 1484 svchost.exe iexplore.exe PID 1484 wrote to memory of 1964 1484 svchost.exe iexplore.exe PID 1484 wrote to memory of 1964 1484 svchost.exe iexplore.exe PID 1484 wrote to memory of 1964 1484 svchost.exe iexplore.exe PID 1484 wrote to memory of 1964 1484 svchost.exe iexplore.exe PID 1484 wrote to memory of 1964 1484 svchost.exe iexplore.exe PID 1484 wrote to memory of 1964 1484 svchost.exe iexplore.exe PID 1516 wrote to memory of 1336 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 1336 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 1336 1516 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 1336 1516 iexplore.exe IEXPLORE.EXE PID 1484 wrote to memory of 1556 1484 svchost.exe svchost.exe PID 1484 wrote to memory of 1556 1484 svchost.exe svchost.exe PID 1484 wrote to memory of 1556 1484 svchost.exe svchost.exe PID 1484 wrote to memory of 1556 1484 svchost.exe svchost.exe PID 1484 wrote to memory of 1556 1484 svchost.exe svchost.exe PID 1484 wrote to memory of 1556 1484 svchost.exe svchost.exe PID 1484 wrote to memory of 1556 1484 svchost.exe svchost.exe PID 1484 wrote to memory of 1556 1484 svchost.exe svchost.exe PID 1556 wrote to memory of 1852 1556 svchost.exe notepad.exe PID 1556 wrote to memory of 1852 1556 svchost.exe notepad.exe PID 1556 wrote to memory of 1852 1556 svchost.exe notepad.exe PID 1556 wrote to memory of 1852 1556 svchost.exe notepad.exe PID 1556 wrote to memory of 1852 1556 svchost.exe notepad.exe PID 1556 wrote to memory of 1852 1556 svchost.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" svchost.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1772 attrib.exe 1756 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe"C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:209930 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exeC:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
C:\Users\Admin\AppData\Roaming\InstallDir\help.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\T717Q32Q.txtFilesize
608B
MD58bac0cb344d9588f20494d4a8cb5728c
SHA10c49358f99aa08fd3e4b61b2588605fed8a3ca87
SHA256791c943f2f207eac05c1de3abbf5aabde82617d80a4ef9a30a2f344dfb600c9e
SHA512646a1480264c6a7258e9e5265fff59db355036195b48ecbfb6b86a088db2fbcdf26825d743207c437fcebbc5bd225eb6323f4668f0bdd51856d4420cb2760abf
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
memory/1484-74-0x0000000000000000-mapping.dmp
-
memory/1556-85-0x00000000004BD910-mapping.dmp
-
memory/1556-89-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1556-90-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1556-91-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1556-93-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1688-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/1688-55-0x00000000001B0000-0x00000000001B4000-memory.dmpFilesize
16KB
-
memory/1756-70-0x0000000000000000-mapping.dmp
-
memory/1772-69-0x0000000000000000-mapping.dmp
-
memory/1776-63-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1776-71-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1776-66-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1776-65-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1776-62-0x00000000004BD910-mapping.dmp
-
memory/1776-61-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1776-59-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1776-57-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1776-56-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1800-68-0x0000000000000000-mapping.dmp
-
memory/1852-92-0x0000000000000000-mapping.dmp
-
memory/1912-67-0x0000000000000000-mapping.dmp