Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 16:55
Static task
static1
Behavioral task
behavioral1
Sample
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe
Resource
win7-20220812-en
General
-
Target
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe
-
Size
2.5MB
-
MD5
b85bd40c70b5913df16cac41feae9949
-
SHA1
88139dbe95928614ab375ef0e3257a925dff0bb7
-
SHA256
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
-
SHA512
4c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
SSDEEP
49152:7JZoQrbTFZY1iaJag33A46NOBLtCaW/sXdkWQe9D+nwOWYcu2I7RTp/PwWUlLmY6:7trbTA19as3l8OBL+I7D+nwcP3tY6
Malware Config
Extracted
darkcomet
Victime
shytoos.ddns.net:1604
DC_MUTEX-Z8X4H3R
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
JJ52hfcLdTnD
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Executes dropped EXE 4 IoCs
Processes:
bnd.exemsdcsc.exebnd.exemsdcsc.exepid process 4656 bnd.exe 3548 msdcsc.exe 960 bnd.exe 720 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3792 attrib.exe 2148 attrib.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exemsdcsc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exemsdcsc.exedescription pid process target process PID 2412 set thread context of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 3548 set thread context of 720 3548 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeSecurityPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeTakeOwnershipPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeLoadDriverPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeSystemProfilePrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeSystemtimePrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeProfSingleProcessPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeIncBasePriorityPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeCreatePagefilePrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeBackupPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeRestorePrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeShutdownPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeDebugPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeSystemEnvironmentPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeChangeNotifyPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeRemoteShutdownPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeUndockPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeManageVolumePrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeImpersonatePrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeCreateGlobalPrivilege 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: 33 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: 34 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: 35 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: 36 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeIncreaseQuotaPrivilege 720 msdcsc.exe Token: SeSecurityPrivilege 720 msdcsc.exe Token: SeTakeOwnershipPrivilege 720 msdcsc.exe Token: SeLoadDriverPrivilege 720 msdcsc.exe Token: SeSystemProfilePrivilege 720 msdcsc.exe Token: SeSystemtimePrivilege 720 msdcsc.exe Token: SeProfSingleProcessPrivilege 720 msdcsc.exe Token: SeIncBasePriorityPrivilege 720 msdcsc.exe Token: SeCreatePagefilePrivilege 720 msdcsc.exe Token: SeBackupPrivilege 720 msdcsc.exe Token: SeRestorePrivilege 720 msdcsc.exe Token: SeShutdownPrivilege 720 msdcsc.exe Token: SeDebugPrivilege 720 msdcsc.exe Token: SeSystemEnvironmentPrivilege 720 msdcsc.exe Token: SeChangeNotifyPrivilege 720 msdcsc.exe Token: SeRemoteShutdownPrivilege 720 msdcsc.exe Token: SeUndockPrivilege 720 msdcsc.exe Token: SeManageVolumePrivilege 720 msdcsc.exe Token: SeImpersonatePrivilege 720 msdcsc.exe Token: SeCreateGlobalPrivilege 720 msdcsc.exe Token: 33 720 msdcsc.exe Token: 34 720 msdcsc.exe Token: 35 720 msdcsc.exe Token: 36 720 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 720 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.execmd.execmd.exemsdcsc.exedescription pid process target process PID 2412 wrote to memory of 4656 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe bnd.exe PID 2412 wrote to memory of 4656 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe bnd.exe PID 2412 wrote to memory of 4656 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe bnd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 2412 wrote to memory of 1284 2412 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1284 wrote to memory of 236 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1284 wrote to memory of 236 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1284 wrote to memory of 236 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1284 wrote to memory of 220 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1284 wrote to memory of 220 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1284 wrote to memory of 220 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1284 wrote to memory of 364 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 236 wrote to memory of 3792 236 cmd.exe attrib.exe PID 236 wrote to memory of 3792 236 cmd.exe attrib.exe PID 236 wrote to memory of 3792 236 cmd.exe attrib.exe PID 220 wrote to memory of 2148 220 cmd.exe attrib.exe PID 220 wrote to memory of 2148 220 cmd.exe attrib.exe PID 220 wrote to memory of 2148 220 cmd.exe attrib.exe PID 1284 wrote to memory of 3548 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe msdcsc.exe PID 1284 wrote to memory of 3548 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe msdcsc.exe PID 1284 wrote to memory of 3548 1284 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe msdcsc.exe PID 3548 wrote to memory of 960 3548 msdcsc.exe bnd.exe PID 3548 wrote to memory of 960 3548 msdcsc.exe bnd.exe PID 3548 wrote to memory of 960 3548 msdcsc.exe bnd.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe PID 3548 wrote to memory of 720 3548 msdcsc.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3792 attrib.exe 2148 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe"C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bnd.exe"C:\Users\Admin\AppData\Local\Temp\bnd.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe"C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bnd.exe"C:\Users\Admin\AppData\Local\Temp\bnd.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
C:\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
C:\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
C:\Users\Admin\AppData\Local\Temp\sse.pngFilesize
659KB
MD5506319032d04373381f748aa2af026f8
SHA1a0822f9afd1d1feeb3240d0e7414ec3f76d4c704
SHA2568834285f04a20ce9bd17e1e6c69250c7b14ad1d217fa77f510a11084396a6077
SHA5122d89e307151241f325bd2677ece48072e679be93945cb31db194fae64a31e25ff11e32c698d87dc68b5885f0dc8ae17fde09312ffef0252364721eb50f705010
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
memory/220-146-0x0000000000000000-mapping.dmp
-
memory/236-145-0x0000000000000000-mapping.dmp
-
memory/364-147-0x0000000000000000-mapping.dmp
-
memory/720-157-0x0000000000000000-mapping.dmp
-
memory/720-161-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/720-164-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/720-163-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-154-0x0000000000000000-mapping.dmp
-
memory/1284-144-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1284-149-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1284-141-0x0000000000000000-mapping.dmp
-
memory/1284-143-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1284-142-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2148-150-0x0000000000000000-mapping.dmp
-
memory/2948-162-0x0000000000000000-mapping.dmp
-
memory/3548-151-0x0000000000000000-mapping.dmp
-
memory/3792-148-0x0000000000000000-mapping.dmp
-
memory/4656-136-0x00000000056F0000-0x000000000578C000-memory.dmpFilesize
624KB
-
memory/4656-137-0x0000000005D40000-0x00000000062E4000-memory.dmpFilesize
5.6MB
-
memory/4656-138-0x0000000005830000-0x00000000058C2000-memory.dmpFilesize
584KB
-
memory/4656-135-0x0000000000D40000-0x0000000000D7A000-memory.dmpFilesize
232KB
-
memory/4656-139-0x00000000057B0000-0x00000000057BA000-memory.dmpFilesize
40KB
-
memory/4656-132-0x0000000000000000-mapping.dmp
-
memory/4656-140-0x00000000059C0000-0x0000000005A16000-memory.dmpFilesize
344KB