darkcomet | 70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2023 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO21019612.exe
Size

2.0MB
MD5

72729cee30402c13712d1522aef2974b
SHA1

5e24a49c70260a8cb42469dc41bb6b5f2557ec50
SHA256

70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11
SHA512

16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178
SSDEEP

49152:FXQBFvAF1FMSNqZVIx9RcRK1HsWYnowZm:FeFIFCG9RcRK2Pntm

Score

10^/10

darkcomet nanocore march 2023 evasion keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

darkcomet

Botnet

MARCH 2023

mjosh6995.ddns.net:1754

Mutex

DC_MUTEX-D2P1SDG

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
vlwkQZyi3NSt
install
true
offline_keylogger
true
persistence
true
reg_key
chrome

Extracted

Family

nanocore

Version

1.2.2.0

mjosh6995.ddns.net:2023

lisajennyjohn.ddns.net:2023

Mutex

a7795112-1a95-404c-bdfa-d35dc6f40a46

Attributes

activate_away_mode
false
backup_connection_host
lisajennyjohn.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-12-22T21:54:57.028602236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2023
default_group
MARCH 2023
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
a7795112-1a95-404c-bdfa-d35dc6f40a46
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
mjosh6995.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

PO21019612.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	PO21019612.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4248 attrib.exe
4528 attrib.exe

pid	process
4248	attrib.exe
4528	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msdcsc.exePO21019612.exePO21019612.exemsdcsc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	PO21019612.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	PO21019612.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	msdcsc.exe

Executes dropped EXE 4 IoCs

Processes:

MARCH STUB.EXEmsdcsc.exemsdcsc.exeMARCH STUB.EXE

pid process

1384 MARCH STUB.EXE
4532 msdcsc.exe
2212 msdcsc.exe
3540 MARCH STUB.EXE

pid	process
1384	MARCH STUB.EXE
4532	msdcsc.exe
2212	msdcsc.exe
3540	MARCH STUB.EXE

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MARCH STUB.EXEmsdcsc.exePO21019612.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAT Service = "C:\\Program Files (x86)\\NAT Service\\natsvc.exe"	MARCH STUB.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	PO21019612.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

MARCH STUB.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MARCH STUB.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MARCH STUB.EXE

Suspicious use of SetThreadContext 2 IoCs

Processes:

PO21019612.exemsdcsc.exe

description	pid	process	target process
PID 4988 set thread context of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4532 set thread context of 2212	4532	msdcsc.exe	msdcsc.exe

Drops file in Program Files directory 2 IoCs

Processes:

MARCH STUB.EXE

description	ioc	process
File created	C:\Program Files (x86)\NAT Service\natsvc.exe	MARCH STUB.EXE
File opened for modification	C:\Program Files (x86)\NAT Service\natsvc.exe	MARCH STUB.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4132 schtasks.exe
4988 schtasks.exe
Modifies registry class 1 IoCs

Processes:

PO21019612.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ PO21019612.exe

pid	process
4132	schtasks.exe
4988	schtasks.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	PO21019612.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

PO21019612.exepowershell.exepowershell.exeMARCH STUB.EXEmsdcsc.exepowershell.exepowershell.exe

pid	process
4988	PO21019612.exe
4988	PO21019612.exe
4988	PO21019612.exe
4988	PO21019612.exe
4988	PO21019612.exe
4988	PO21019612.exe
4988	PO21019612.exe
4988	PO21019612.exe
4988	PO21019612.exe
1512	powershell.exe
3164	powershell.exe
4988	PO21019612.exe
1512	powershell.exe
3164	powershell.exe
1384	MARCH STUB.EXE
1384	MARCH STUB.EXE
1384	MARCH STUB.EXE
1384	MARCH STUB.EXE
4532	msdcsc.exe
4532	msdcsc.exe
4532	msdcsc.exe
4532	msdcsc.exe
4532	msdcsc.exe
4532	msdcsc.exe
4532	msdcsc.exe
4532	msdcsc.exe
4868	powershell.exe
3756	powershell.exe
4868	powershell.exe
3756	powershell.exe
4532	msdcsc.exe
4532	msdcsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MARCH STUB.EXE

pid process

1384 MARCH STUB.EXE

pid	process
1384	MARCH STUB.EXE

Suspicious use of AdjustPrivilegeToken 55 IoCs

Processes:

PO21019612.exepowershell.exepowershell.exePO21019612.exeMARCH STUB.EXEmsdcsc.exepowershell.exepowershell.exemsdcsc.exe

description	pid	process
Token: SeDebugPrivilege	4988	PO21019612.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeIncreaseQuotaPrivilege	1328	PO21019612.exe
Token: SeSecurityPrivilege	1328	PO21019612.exe
Token: SeTakeOwnershipPrivilege	1328	PO21019612.exe
Token: SeLoadDriverPrivilege	1328	PO21019612.exe
Token: SeSystemProfilePrivilege	1328	PO21019612.exe
Token: SeSystemtimePrivilege	1328	PO21019612.exe
Token: SeProfSingleProcessPrivilege	1328	PO21019612.exe
Token: SeIncBasePriorityPrivilege	1328	PO21019612.exe
Token: SeCreatePagefilePrivilege	1328	PO21019612.exe
Token: SeBackupPrivilege	1328	PO21019612.exe
Token: SeRestorePrivilege	1328	PO21019612.exe
Token: SeShutdownPrivilege	1328	PO21019612.exe
Token: SeDebugPrivilege	1328	PO21019612.exe
Token: SeSystemEnvironmentPrivilege	1328	PO21019612.exe
Token: SeChangeNotifyPrivilege	1328	PO21019612.exe
Token: SeRemoteShutdownPrivilege	1328	PO21019612.exe
Token: SeUndockPrivilege	1328	PO21019612.exe
Token: SeManageVolumePrivilege	1328	PO21019612.exe
Token: SeImpersonatePrivilege	1328	PO21019612.exe
Token: SeCreateGlobalPrivilege	1328	PO21019612.exe
Token: 33	1328	PO21019612.exe
Token: 34	1328	PO21019612.exe
Token: 35	1328	PO21019612.exe
Token: 36	1328	PO21019612.exe
Token: SeDebugPrivilege	1384	MARCH STUB.EXE
Token: SeDebugPrivilege	4532	msdcsc.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeIncreaseQuotaPrivilege	2212	msdcsc.exe
Token: SeSecurityPrivilege	2212	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2212	msdcsc.exe
Token: SeLoadDriverPrivilege	2212	msdcsc.exe
Token: SeSystemProfilePrivilege	2212	msdcsc.exe
Token: SeSystemtimePrivilege	2212	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2212	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2212	msdcsc.exe
Token: SeCreatePagefilePrivilege	2212	msdcsc.exe
Token: SeBackupPrivilege	2212	msdcsc.exe
Token: SeRestorePrivilege	2212	msdcsc.exe
Token: SeShutdownPrivilege	2212	msdcsc.exe
Token: SeDebugPrivilege	2212	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2212	msdcsc.exe
Token: SeChangeNotifyPrivilege	2212	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2212	msdcsc.exe
Token: SeUndockPrivilege	2212	msdcsc.exe
Token: SeManageVolumePrivilege	2212	msdcsc.exe
Token: SeImpersonatePrivilege	2212	msdcsc.exe
Token: SeCreateGlobalPrivilege	2212	msdcsc.exe
Token: 33	2212	msdcsc.exe
Token: 34	2212	msdcsc.exe
Token: 35	2212	msdcsc.exe
Token: 36	2212	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2212 msdcsc.exe

pid	process
2212	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

PO21019612.exePO21019612.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 4988 wrote to memory of 3164	4988	PO21019612.exe	powershell.exe
PID 4988 wrote to memory of 3164	4988	PO21019612.exe	powershell.exe
PID 4988 wrote to memory of 3164	4988	PO21019612.exe	powershell.exe
PID 4988 wrote to memory of 1512	4988	PO21019612.exe	powershell.exe
PID 4988 wrote to memory of 1512	4988	PO21019612.exe	powershell.exe
PID 4988 wrote to memory of 1512	4988	PO21019612.exe	powershell.exe
PID 4988 wrote to memory of 4132	4988	PO21019612.exe	schtasks.exe
PID 4988 wrote to memory of 4132	4988	PO21019612.exe	schtasks.exe
PID 4988 wrote to memory of 4132	4988	PO21019612.exe	schtasks.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 4988 wrote to memory of 1328	4988	PO21019612.exe	PO21019612.exe
PID 1328 wrote to memory of 1044	1328	PO21019612.exe	cmd.exe
PID 1328 wrote to memory of 1044	1328	PO21019612.exe	cmd.exe
PID 1328 wrote to memory of 1044	1328	PO21019612.exe	cmd.exe
PID 1328 wrote to memory of 1264	1328	PO21019612.exe	cmd.exe
PID 1328 wrote to memory of 1264	1328	PO21019612.exe	cmd.exe
PID 1328 wrote to memory of 1264	1328	PO21019612.exe	cmd.exe
PID 1328 wrote to memory of 1384	1328	PO21019612.exe	MARCH STUB.EXE
PID 1328 wrote to memory of 1384	1328	PO21019612.exe	MARCH STUB.EXE
PID 1328 wrote to memory of 1384	1328	PO21019612.exe	MARCH STUB.EXE
PID 1044 wrote to memory of 4248	1044	cmd.exe	attrib.exe
PID 1044 wrote to memory of 4248	1044	cmd.exe	attrib.exe
PID 1044 wrote to memory of 4248	1044	cmd.exe	attrib.exe
PID 1264 wrote to memory of 4528	1264	cmd.exe	attrib.exe
PID 1264 wrote to memory of 4528	1264	cmd.exe	attrib.exe
PID 1264 wrote to memory of 4528	1264	cmd.exe	attrib.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 2112	1328	PO21019612.exe	notepad.exe
PID 1328 wrote to memory of 4532	1328	PO21019612.exe	msdcsc.exe
PID 1328 wrote to memory of 4532	1328	PO21019612.exe	msdcsc.exe
PID 1328 wrote to memory of 4532	1328	PO21019612.exe	msdcsc.exe
PID 4532 wrote to memory of 4868	4532	msdcsc.exe	powershell.exe
PID 4532 wrote to memory of 4868	4532	msdcsc.exe	powershell.exe
PID 4532 wrote to memory of 4868	4532	msdcsc.exe	powershell.exe
PID 4532 wrote to memory of 3756	4532	msdcsc.exe	powershell.exe
PID 4532 wrote to memory of 3756	4532	msdcsc.exe	powershell.exe
PID 4532 wrote to memory of 3756	4532	msdcsc.exe	powershell.exe
PID 4532 wrote to memory of 4988	4532	msdcsc.exe	schtasks.exe
PID 4532 wrote to memory of 4988	4532	msdcsc.exe	schtasks.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4248 attrib.exe
4528 attrib.exe

pid	process
4248	attrib.exe
4528	attrib.exe

C:\Users\Admin\AppData\Local\Temp\PO21019612.exe
"C:\Users\Admin\AppData\Local\Temp\PO21019612.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO21019612.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SZSALrLiZcPqvl.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SZSALrLiZcPqvl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4C6A.tmp"
2⤵
- Creates scheduled task(s)
PID:4132

C:\Users\Admin\AppData\Local\Temp\PO21019612.exe
"C:\Users\Admin\AppData\Local\Temp\PO21019612.exe"
2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\PO21019612.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\PO21019612.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4248

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4528

C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
"C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:2112

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SZSALrLiZcPqvl.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SZSALrLiZcPqvl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3795.tmp"
4⤵
- Creates scheduled task(s)
PID:4988

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2212

C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
"C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE"
5⤵
- Executes dropped EXE
PID:3540

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:4784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
35b3413a0229d396ccb902113a3bdc65

SHA1
68e541fe674b4800eba6a026e0f8d53b235ea697

SHA256
6cd7334364a7b746bc4548e3d9bbfc9af893b0760fd21594b5f04265d377cb8b

SHA512
82157ae783e12e01561edb157711c703e3eaf5a7f30295ae1339bdac9a60996c6fcc3280e3fd6ade1af4c7398526e59f655e3aa6511c964fccb965b594d0539a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
35b3413a0229d396ccb902113a3bdc65

SHA1
68e541fe674b4800eba6a026e0f8d53b235ea697

SHA256
6cd7334364a7b746bc4548e3d9bbfc9af893b0760fd21594b5f04265d377cb8b

SHA512
82157ae783e12e01561edb157711c703e3eaf5a7f30295ae1339bdac9a60996c6fcc3280e3fd6ade1af4c7398526e59f655e3aa6511c964fccb965b594d0539a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
abddd94c56865fae5f5effa356191351

SHA1
931eaa5fe9f30729900d35fae79b66e79f5ac55f

SHA256
9cce1dc9eada773bd003523b316e840972a437f8b8c5acfa045c5c2c85b74058

SHA512
3b05d3cd1fd61160eac35cbee5a37a0f0e0cd2e13e3eb280083ac08ea04cec78a0aa2b0f13a31b56ecebc5ded5238ab1dacdfae6dd1b9f0f822d5fd44a232d88

Download Submit
C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nmlnc12i.sgl.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3795.tmp
Filesize
1KB

MD5
6e48d3f11670805752a0349bf7521755

SHA1
cd51679ad0d3e9e40412aef41873ddb5416903b1

SHA256
2276989004bc426b641a46f32a9bda222f44e6533214b82b48f9e189212dc4d4

SHA512
e7a541895272e61a11f78d96e09dc2f31e8c80424d0a39d531ce846b02ceb2e52e7892941d96d5599a2dae08afa411c0a36a72e4418dadd9b2b990b5a29cc3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C6A.tmp
Filesize
1KB

MD5
6e48d3f11670805752a0349bf7521755

SHA1
cd51679ad0d3e9e40412aef41873ddb5416903b1

SHA256
2276989004bc426b641a46f32a9bda222f44e6533214b82b48f9e189212dc4d4

SHA512
e7a541895272e61a11f78d96e09dc2f31e8c80424d0a39d531ce846b02ceb2e52e7892941d96d5599a2dae08afa411c0a36a72e4418dadd9b2b990b5a29cc3b4

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
memory/1328-185-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/1328-172-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1328-173-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1328-175-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1328-282-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1328-180-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1384-294-0x0000000000D50000-0x0000000000D60000-memory.dmp

Filesize
64KB

Download
memory/1384-293-0x0000000000D50000-0x0000000000D60000-memory.dmp

Filesize
64KB

Download
memory/1384-242-0x0000000000D50000-0x0000000000D60000-memory.dmp

Filesize
64KB

Download
memory/1384-240-0x0000000000D50000-0x0000000000D60000-memory.dmp

Filesize
64KB

Download
memory/1512-285-0x0000000007240000-0x000000000724E000-memory.dmp

Filesize
56KB

Download
memory/1512-256-0x00000000062C0000-0x00000000062DE000-memory.dmp

Filesize
120KB

Download
memory/1512-150-0x0000000004CD0000-0x0000000004D36000-memory.dmp

Filesize
408KB

Download
memory/1512-153-0x00000000056A0000-0x0000000005706000-memory.dmp

Filesize
408KB

Download
memory/1512-151-0x0000000004880000-0x0000000004890000-memory.dmp

Filesize
64KB

Download
memory/1512-283-0x0000000007290000-0x0000000007326000-memory.dmp

Filesize
600KB

Download
memory/1512-178-0x0000000005D10000-0x0000000005D2E000-memory.dmp

Filesize
120KB

Download
memory/1512-243-0x0000000004880000-0x0000000004890000-memory.dmp

Filesize
64KB

Download
memory/1512-152-0x0000000004880000-0x0000000004890000-memory.dmp

Filesize
64KB

Download
memory/1512-245-0x00000000713E0000-0x000000007142C000-memory.dmp

Filesize
304KB

Download
memory/1512-280-0x000000007F3D0000-0x000000007F3E0000-memory.dmp

Filesize
64KB

Download
memory/1512-287-0x0000000007330000-0x0000000007338000-memory.dmp

Filesize
32KB

Download
memory/1512-278-0x0000000007080000-0x000000000708A000-memory.dmp

Filesize
40KB

Download
memory/1512-276-0x0000000007650000-0x0000000007CCA000-memory.dmp

Filesize
6.5MB

Download
memory/2112-189-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/2212-329-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2212-325-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2212-322-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/2212-323-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2212-352-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2212-320-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2212-353-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2212-362-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/3164-144-0x0000000002A90000-0x0000000002AC6000-memory.dmp

Filesize
216KB

Download
memory/3164-277-0x00000000076C0000-0x00000000076DA000-memory.dmp

Filesize
104KB

Download
memory/3164-241-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/3164-147-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/3164-148-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/3164-244-0x0000000006990000-0x00000000069C2000-memory.dmp

Filesize
200KB

Download
memory/3164-246-0x00000000713E0000-0x000000007142C000-memory.dmp

Filesize
304KB

Download
memory/3164-145-0x00000000055D0000-0x0000000005BF8000-memory.dmp

Filesize
6.2MB

Download
memory/3164-149-0x0000000005300000-0x0000000005322000-memory.dmp

Filesize
136KB

Download
memory/3164-286-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Filesize
104KB

Download
memory/3164-279-0x000000007F420000-0x000000007F430000-memory.dmp

Filesize
64KB

Download
memory/3540-354-0x0000000000F80000-0x0000000000F90000-memory.dmp

Filesize
64KB

Download
memory/3756-328-0x0000000002670000-0x0000000002680000-memory.dmp

Filesize
64KB

Download
memory/3756-341-0x0000000070DD0000-0x0000000070E1C000-memory.dmp

Filesize
304KB

Download
memory/3756-327-0x0000000002670000-0x0000000002680000-memory.dmp

Filesize
64KB

Download
memory/3756-356-0x0000000002670000-0x0000000002680000-memory.dmp

Filesize
64KB

Download
memory/4532-281-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/4532-295-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/4784-351-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/4868-324-0x0000000004760000-0x0000000004770000-memory.dmp

Filesize
64KB

Download
memory/4868-331-0x0000000070DD0000-0x0000000070E1C000-memory.dmp

Filesize
304KB

Download
memory/4868-326-0x0000000004760000-0x0000000004770000-memory.dmp

Filesize
64KB

Download
memory/4868-357-0x000000007F6F0000-0x000000007F700000-memory.dmp

Filesize
64KB

Download
memory/4868-355-0x0000000004760000-0x0000000004770000-memory.dmp

Filesize
64KB

Download
memory/4988-135-0x0000000004C80000-0x0000000004D12000-memory.dmp

Filesize
584KB

Download
memory/4988-137-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4988-136-0x0000000004C60000-0x0000000004C6A000-memory.dmp

Filesize
40KB

Download
memory/4988-138-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4988-133-0x00000000000B0000-0x00000000002AA000-memory.dmp

Filesize
2.0MB

Download
memory/4988-134-0x0000000005230000-0x00000000057D4000-memory.dmp

Filesize
5.6MB

Download
memory/4988-139-0x00000000069D0000-0x0000000006A6C000-memory.dmp

Filesize
624KB

Download