Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 09:38
Static task
static1
Behavioral task
behavioral1
Sample
a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe
Resource
win10v2004-20221111-en
General
-
Target
a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe
-
Size
452KB
-
MD5
95338d4bf0749e280fb3dd156c173e65
-
SHA1
18e760995c269c6f052c476cda1e981df13828ec
-
SHA256
a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2
-
SHA512
a4cccd475eebba68bb2a36d819435bf83fabd7d6741dd51a794879dad88594e676a7d5542e7be0c04ee4476d1bb2743fd3238c1227b207e1dcd3dcf09c442533
-
SSDEEP
6144:fcV+uhsCuKQ+FD+TG1hPApaKYoCG9+ExwPIGFGZgH/Rgy/eQq3EK42Nlw3Zp/7US:fyTuKQyD+TKSBwA2ZgbQqAH4G2htZm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 2 IoCs
Processes:
vbc.exemsdcsc.exepid process 2680 vbc.exe 4804 msdcsc.exe -
Processes:
resource yara_rule behavioral2/memory/2680-138-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral2/memory/2680-140-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral2/memory/2680-135-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral2/memory/2680-143-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral2/memory/2680-144-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral2/memory/2680-145-0x0000000000400000-0x00000000004F9000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exedescription pid process target process PID 1824 set thread context of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2680 vbc.exe Token: SeSecurityPrivilege 2680 vbc.exe Token: SeTakeOwnershipPrivilege 2680 vbc.exe Token: SeLoadDriverPrivilege 2680 vbc.exe Token: SeSystemProfilePrivilege 2680 vbc.exe Token: SeSystemtimePrivilege 2680 vbc.exe Token: SeProfSingleProcessPrivilege 2680 vbc.exe Token: SeIncBasePriorityPrivilege 2680 vbc.exe Token: SeCreatePagefilePrivilege 2680 vbc.exe Token: SeBackupPrivilege 2680 vbc.exe Token: SeRestorePrivilege 2680 vbc.exe Token: SeShutdownPrivilege 2680 vbc.exe Token: SeDebugPrivilege 2680 vbc.exe Token: SeSystemEnvironmentPrivilege 2680 vbc.exe Token: SeChangeNotifyPrivilege 2680 vbc.exe Token: SeRemoteShutdownPrivilege 2680 vbc.exe Token: SeUndockPrivilege 2680 vbc.exe Token: SeManageVolumePrivilege 2680 vbc.exe Token: SeImpersonatePrivilege 2680 vbc.exe Token: SeCreateGlobalPrivilege 2680 vbc.exe Token: 33 2680 vbc.exe Token: 34 2680 vbc.exe Token: 35 2680 vbc.exe Token: 36 2680 vbc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exevbc.exedescription pid process target process PID 1824 wrote to memory of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe PID 1824 wrote to memory of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe PID 1824 wrote to memory of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe PID 1824 wrote to memory of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe PID 1824 wrote to memory of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe PID 1824 wrote to memory of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe PID 1824 wrote to memory of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe PID 1824 wrote to memory of 2680 1824 a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe vbc.exe PID 2680 wrote to memory of 4804 2680 vbc.exe msdcsc.exe PID 2680 wrote to memory of 4804 2680 vbc.exe msdcsc.exe PID 2680 wrote to memory of 4804 2680 vbc.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe"C:\Users\Admin\AppData\Local\Temp\a975c97d72bbaf38dd2500653721ec7a6d85153ddb6cba2a33cd6a009dad1ab2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/1824-142-0x0000000075410000-0x00000000759C1000-memory.dmpFilesize
5.7MB
-
memory/1824-139-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1824-132-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1824-133-0x0000000075410000-0x00000000759C1000-memory.dmpFilesize
5.7MB
-
memory/2680-140-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2680-135-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2680-143-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2680-138-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2680-144-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2680-145-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2680-134-0x0000000000000000-mapping.dmp
-
memory/4804-146-0x0000000000000000-mapping.dmp