Analysis
-
max time kernel
161s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 05:15
Static task
static1
Behavioral task
behavioral1
Sample
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe
Resource
win7-20221111-en
General
-
Target
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe
-
Size
377KB
-
MD5
a1f0d356df081f4cde159183f402ee93
-
SHA1
3c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
-
SHA256
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
-
SHA512
47442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
SSDEEP
6144:GxL3BJrfJXTGhbR1OJguwMNNvyGAcE0njDs9Eoej+4+bnjb3PZAizgk9:urTfkNF3aNvyGAhE09yKdjjDZxp
Malware Config
Extracted
darkcomet
HF
safethinking.zapto.org:1604
DC_MUTEX-F0NJMAE
-
InstallPath
MSDCSC\svchost.exe
-
gencode
JGGiVLcb5Yzq
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
svchost
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\svchost.exe" c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" svchost.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 1072 svchost.exe 3856 svchost.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2564 attrib.exe 2684 attrib.exe -
Processes:
resource yara_rule behavioral2/memory/1544-134-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1544-135-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1544-136-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1544-137-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1544-138-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1544-147-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/3856-152-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/3856-153-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/3856-155-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/3856-156-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/3856-157-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe -
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exec76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exesvchost.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\svchost.exe" c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\svchost.exe" svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exesvchost.exedescription pid process target process PID 4076 set thread context of 3080 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 4076 set thread context of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 1072 set thread context of 4912 1072 svchost.exe iexplore.exe PID 1072 set thread context of 3856 1072 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B57FA82D-7527-11ED-BF5F-D2F35ABB710A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2373761779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2581418253" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000884" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000884" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377069899" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000884" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2581418253" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2373761779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000884" IEXPLORE.EXE -
Modifies registry class 1 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exesvchost.exepid process 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe 1072 svchost.exe 1072 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svchost.exepid process 3856 svchost.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exesvchost.exedescription pid process Token: SeIncreaseQuotaPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeSecurityPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeTakeOwnershipPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeLoadDriverPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeSystemProfilePrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeSystemtimePrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeProfSingleProcessPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeIncBasePriorityPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeCreatePagefilePrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeBackupPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeRestorePrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeShutdownPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeDebugPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeSystemEnvironmentPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeChangeNotifyPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeRemoteShutdownPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeUndockPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeManageVolumePrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeImpersonatePrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeCreateGlobalPrivilege 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: 33 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: 34 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: 35 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: 36 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe Token: SeIncreaseQuotaPrivilege 3856 svchost.exe Token: SeSecurityPrivilege 3856 svchost.exe Token: SeTakeOwnershipPrivilege 3856 svchost.exe Token: SeLoadDriverPrivilege 3856 svchost.exe Token: SeSystemProfilePrivilege 3856 svchost.exe Token: SeSystemtimePrivilege 3856 svchost.exe Token: SeProfSingleProcessPrivilege 3856 svchost.exe Token: SeIncBasePriorityPrivilege 3856 svchost.exe Token: SeCreatePagefilePrivilege 3856 svchost.exe Token: SeBackupPrivilege 3856 svchost.exe Token: SeRestorePrivilege 3856 svchost.exe Token: SeShutdownPrivilege 3856 svchost.exe Token: SeDebugPrivilege 3856 svchost.exe Token: SeSystemEnvironmentPrivilege 3856 svchost.exe Token: SeChangeNotifyPrivilege 3856 svchost.exe Token: SeRemoteShutdownPrivilege 3856 svchost.exe Token: SeUndockPrivilege 3856 svchost.exe Token: SeManageVolumePrivilege 3856 svchost.exe Token: SeImpersonatePrivilege 3856 svchost.exe Token: SeCreateGlobalPrivilege 3856 svchost.exe Token: 33 3856 svchost.exe Token: 34 3856 svchost.exe Token: 35 3856 svchost.exe Token: 36 3856 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 3080 iexplore.exe 3080 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEsvchost.exepid process 3080 iexplore.exe 3080 iexplore.exe 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3080 iexplore.exe 3080 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 3856 svchost.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exeiexplore.exec76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.execmd.execmd.exesvchost.exesvchost.exedescription pid process target process PID 4076 wrote to memory of 3080 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 4076 wrote to memory of 3080 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 4076 wrote to memory of 3080 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 4076 wrote to memory of 3080 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 4076 wrote to memory of 3080 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 4076 wrote to memory of 3080 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe iexplore.exe PID 4076 wrote to memory of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 4076 wrote to memory of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 4076 wrote to memory of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 4076 wrote to memory of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 4076 wrote to memory of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 4076 wrote to memory of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 4076 wrote to memory of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 4076 wrote to memory of 1544 4076 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe PID 3080 wrote to memory of 3040 3080 iexplore.exe IEXPLORE.EXE PID 3080 wrote to memory of 3040 3080 iexplore.exe IEXPLORE.EXE PID 3080 wrote to memory of 3040 3080 iexplore.exe IEXPLORE.EXE PID 1544 wrote to memory of 4440 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1544 wrote to memory of 4440 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1544 wrote to memory of 4440 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1544 wrote to memory of 2968 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1544 wrote to memory of 2968 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 1544 wrote to memory of 2968 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe cmd.exe PID 4440 wrote to memory of 2564 4440 cmd.exe attrib.exe PID 4440 wrote to memory of 2564 4440 cmd.exe attrib.exe PID 4440 wrote to memory of 2564 4440 cmd.exe attrib.exe PID 2968 wrote to memory of 2684 2968 cmd.exe attrib.exe PID 2968 wrote to memory of 2684 2968 cmd.exe attrib.exe PID 2968 wrote to memory of 2684 2968 cmd.exe attrib.exe PID 1544 wrote to memory of 1072 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe svchost.exe PID 1544 wrote to memory of 1072 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe svchost.exe PID 1544 wrote to memory of 1072 1544 c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe svchost.exe PID 1072 wrote to memory of 4912 1072 svchost.exe iexplore.exe PID 1072 wrote to memory of 4912 1072 svchost.exe iexplore.exe PID 1072 wrote to memory of 4912 1072 svchost.exe iexplore.exe PID 1072 wrote to memory of 4912 1072 svchost.exe iexplore.exe PID 1072 wrote to memory of 4912 1072 svchost.exe iexplore.exe PID 1072 wrote to memory of 4912 1072 svchost.exe iexplore.exe PID 3080 wrote to memory of 1676 3080 iexplore.exe IEXPLORE.EXE PID 3080 wrote to memory of 1676 3080 iexplore.exe IEXPLORE.EXE PID 3080 wrote to memory of 1676 3080 iexplore.exe IEXPLORE.EXE PID 1072 wrote to memory of 3856 1072 svchost.exe svchost.exe PID 1072 wrote to memory of 3856 1072 svchost.exe svchost.exe PID 1072 wrote to memory of 3856 1072 svchost.exe svchost.exe PID 1072 wrote to memory of 3856 1072 svchost.exe svchost.exe PID 1072 wrote to memory of 3856 1072 svchost.exe svchost.exe PID 1072 wrote to memory of 3856 1072 svchost.exe svchost.exe PID 1072 wrote to memory of 3856 1072 svchost.exe svchost.exe PID 1072 wrote to memory of 3856 1072 svchost.exe svchost.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe PID 3856 wrote to memory of 4836 3856 svchost.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" svchost.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2564 attrib.exe 2684 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe"C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3080 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3080 CREDAT:82948 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exeC:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\svchost.exeFilesize
377KB
MD5a1f0d356df081f4cde159183f402ee93
SHA13c71aedd2eda2d572fd0cb575fa13e7e74b6cefd
SHA256c76dc27b6ffba36d451ef02c8f1680dfa40408ec2f1c476a0eb3aadbb30e4aff
SHA51247442e3b227fde91498ac2096d6eda15b65817c0a9cd192cf787eccadd67973e87c1d8d9b47812e812e03ec74548b998173f25fc255fb8c97631ac5cbd70a833
-
C:\Users\Admin\AppData\Roaming\InstallDir\help.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1072-143-0x0000000000000000-mapping.dmp
-
memory/1544-138-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1544-135-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1544-133-0x0000000000000000-mapping.dmp
-
memory/1544-147-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1544-134-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1544-137-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1544-136-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/2564-141-0x0000000000000000-mapping.dmp
-
memory/2684-142-0x0000000000000000-mapping.dmp
-
memory/2968-140-0x0000000000000000-mapping.dmp
-
memory/3856-148-0x0000000000000000-mapping.dmp
-
memory/3856-152-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/3856-153-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/3856-155-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/3856-156-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/3856-157-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/4076-132-0x00000000020F0000-0x00000000020F4000-memory.dmpFilesize
16KB
-
memory/4440-139-0x0000000000000000-mapping.dmp
-
memory/4836-154-0x0000000000000000-mapping.dmp