Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/03/2024, 13:48
Behavioral task
behavioral1
Sample
virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe
Resource
win7-20240221-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe
- Size 2.1MB
- Sample240303-q4dgsscb63
- SHA256 a41bab7fb95257d41fdb3752f0e1bfc12ad3eee48720ece55f481241c058eebc
- MD5 fa607622a3622c50cf9c3477434a4a6e
- SHA1 ab4c45db7e3a99798153a4a6a1fdddf358c6ec5d
- SHA512 307349ea6d119b701358c42e3affc7b7862d7c957c34539d80cbd422f7cfa89e522604a90d62aec5cdaa6927144dea43d835b308a74cf72ec8f3226ab40d540e
- SSDEEP 49152:UOIg4pLvkClgmTkuhCTStpoX70kJQiAxmLg8J78U8x:Ig4pAkvAYi4fDxmHJ78U
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Blockade cheater
C2
-
kodgta5.ddns.net:1604
Mutex
-
DC_MUTEX-BJKN3NZ
Attributes
-
InstallPath
MSDCSC\Microsoft.exe
-
gencode
dKnUt40ZCRxk
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Microsoft
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\Microsoft.exe" virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe - Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Microsoft.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Microsoft.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" Microsoft.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" Microsoft.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Microsoft.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Microsoft.exe - UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral2/memory/4856-0-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/files/0x00090000000226e5-18.dat UPX behavioral2/files/0x00090000000226e5-72.dat UPX behavioral2/memory/3936-74-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/4856-77-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-80-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-82-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-84-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-86-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-88-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-90-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-92-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-94-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-96-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-98-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-100-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-102-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-104-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-106-0x0000000000400000-0x0000000000966000-memory.dmp UPX behavioral2/memory/3936-108-0x0000000000400000-0x0000000000966000-memory.dmp UPX - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Microsoft.exe - Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4864 attrib.exe 2176 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe - Deletes itself 1 IoCs
pid Process 2936 notepad.exe - Executes dropped EXE 2 IoCs
pid Process 4820 BLOCKADEHACK_V9.2.EXE 3936 Microsoft.exe -
resource yara_rule behavioral2/memory/4856-0-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/files/0x00090000000226e5-18.dat upx behavioral2/files/0x00090000000226e5-72.dat upx behavioral2/memory/3936-74-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/4856-77-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-80-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-82-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-84-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-86-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-88-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-90-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-92-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-94-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-96-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-98-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-100-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-102-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-104-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-106-0x0000000000400000-0x0000000000966000-memory.dmp upx behavioral2/memory/3936-108-0x0000000000400000-0x0000000000966000-memory.dmp upx -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Microsoft.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Microsoft.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\Documents\\MSDCSC\\Microsoft.exe" virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\Documents\\MSDCSC\\Microsoft.exe" Microsoft.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE 4820 BLOCKADEHACK_V9.2.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3936 Microsoft.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeSecurityPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeTakeOwnershipPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeLoadDriverPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeSystemProfilePrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeSystemtimePrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeProfSingleProcessPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeIncBasePriorityPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeCreatePagefilePrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeBackupPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeRestorePrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeShutdownPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeDebugPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeSystemEnvironmentPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeChangeNotifyPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeRemoteShutdownPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeUndockPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeManageVolumePrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeImpersonatePrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeCreateGlobalPrivilege 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: 33 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: 34 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: 35 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: 36 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe Token: SeIncreaseQuotaPrivilege 3936 Microsoft.exe Token: SeSecurityPrivilege 3936 Microsoft.exe Token: SeTakeOwnershipPrivilege 3936 Microsoft.exe Token: SeLoadDriverPrivilege 3936 Microsoft.exe Token: SeSystemProfilePrivilege 3936 Microsoft.exe Token: SeSystemtimePrivilege 3936 Microsoft.exe Token: SeProfSingleProcessPrivilege 3936 Microsoft.exe Token: SeIncBasePriorityPrivilege 3936 Microsoft.exe Token: SeCreatePagefilePrivilege 3936 Microsoft.exe Token: SeBackupPrivilege 3936 Microsoft.exe Token: SeRestorePrivilege 3936 Microsoft.exe Token: SeShutdownPrivilege 3936 Microsoft.exe Token: SeDebugPrivilege 3936 Microsoft.exe Token: SeSystemEnvironmentPrivilege 3936 Microsoft.exe Token: SeChangeNotifyPrivilege 3936 Microsoft.exe Token: SeRemoteShutdownPrivilege 3936 Microsoft.exe Token: SeUndockPrivilege 3936 Microsoft.exe Token: SeManageVolumePrivilege 3936 Microsoft.exe Token: SeImpersonatePrivilege 3936 Microsoft.exe Token: SeCreateGlobalPrivilege 3936 Microsoft.exe Token: 33 3936 Microsoft.exe Token: 34 3936 Microsoft.exe Token: 35 3936 Microsoft.exe Token: 36 3936 Microsoft.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4820 BLOCKADEHACK_V9.2.EXE 3936 Microsoft.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4856 wrote to memory of 2412 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 89 PID 4856 wrote to memory of 2412 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 89 PID 4856 wrote to memory of 2412 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 89 PID 4856 wrote to memory of 1616 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 90 PID 4856 wrote to memory of 1616 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 90 PID 4856 wrote to memory of 1616 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 90 PID 4856 wrote to memory of 4820 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 93 PID 4856 wrote to memory of 4820 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 93 PID 4856 wrote to memory of 4820 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 93 PID 1616 wrote to memory of 4864 1616 cmd.exe 94 PID 1616 wrote to memory of 4864 1616 cmd.exe 94 PID 1616 wrote to memory of 4864 1616 cmd.exe 94 PID 2412 wrote to memory of 2176 2412 cmd.exe 95 PID 2412 wrote to memory of 2176 2412 cmd.exe 95 PID 2412 wrote to memory of 2176 2412 cmd.exe 95 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 2936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 97 PID 4856 wrote to memory of 3936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 98 PID 4856 wrote to memory of 3936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 98 PID 4856 wrote to memory of 3936 4856 virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe 98 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 PID 3936 wrote to memory of 3500 3936 Microsoft.exe 99 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion Microsoft.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern Microsoft.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" Microsoft.exe - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2176 attrib.exe 4864 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\virussign.com_fa607622a3622c50cf9c3477434a4a6e.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2176
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4864
-
-
-
C:\Users\Admin\AppData\Local\Temp\BLOCKADEHACK_V9.2.EXE"C:\Users\Admin\AppData\Local\Temp\BLOCKADEHACK_V9.2.EXE"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4820
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:2936
-
-
C:\Users\Admin\Documents\MSDCSC\Microsoft.exe"C:\Users\Admin\Documents\MSDCSC\Microsoft.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3936 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:3500
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BLOCKADEHACK_V9.2.EXE
- Size 4.7MB
- SHA256 cd3f99f175bd6bbdff5911a4932b12379ef6b640c96127ed59c21ae6b6f4f1f6
- MD5 0f370749d0f3b074bb876352f5780503
- SHA1 b2c7abe9d375f7f77c0a06ffe58f5475b62380d9
- SHA512 e2689e9bc128aab2cf102dbf11f0f129ea1fe309e7831e73eff2e144ad19beb1065fba52bf2afb24dce482ae299b25fcec5e229030fc40756b56c4b571eba7bb
- SSDEEP 49152:sWY+v0SKdkZWSmp/jMtyBnYH+/0ujySja6dLcFNhsNJTuTEkxtTFoXjsvb6FN3ES:R0Sup79nZ0ujyaoFNh1TFOjF0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\MSDCSC\Microsoft.exe
- Size 2.1MB
- SHA256 a41bab7fb95257d41fdb3752f0e1bfc12ad3eee48720ece55f481241c058eebc
- MD5 fa607622a3622c50cf9c3477434a4a6e
- SHA1 ab4c45db7e3a99798153a4a6a1fdddf358c6ec5d
- SHA512 307349ea6d119b701358c42e3affc7b7862d7c957c34539d80cbd422f7cfa89e522604a90d62aec5cdaa6927144dea43d835b308a74cf72ec8f3226ab40d540e
- SSDEEP 49152:UOIg4pLvkClgmTkuhCTStpoX70kJQiAxmLg8J78U8x:Ig4pAkvAYi4fDxmHJ78U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\MSDCSC\Microsoft.exe
- Size 382KB
- SHA256 fef3d06094cbd2358b256f2593c90c8ac015be5a4016f7e49a16da0e13e6e699
- MD5 9d96a4d48c742eb612d074ad51b427de
- SHA1 caaf0caefd6ca1586fd7571faf80795d2f37cc26
- SHA512 d0838e3fcd6cd9abe017f257de45c9061d039334b14844ee11222680b12e24786eb5844460ac68f53b261f36c1cdd81984c94711b442e614446f45d6047386a6
- SSDEEP 6144:RcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0P7bgvSYZ1u2f4siBi/bDvUgqm:RcWkbgTYWnYnt/IDYhPf9YjvwsA8UOfd
- MD5 SHA1 SHA512 SSDEEP