Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-12-2024 07:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe
Resource
win7-20240903-en
windows7-x64
24 signatures
120 seconds
General
-
Target
2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe
-
Size
911KB
-
MD5
c6124a942c55b07895302856e06a9d90
-
SHA1
792dcfe853839096cd815020cc084c00efea3eef
-
SHA256
2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418
-
SHA512
a79dee40098c9293de69fdf8564231a1d8cef29e0cb85b7b182e9ae4c5746467c660c6eba7395b04497b7839e6cfd66874697bfb532f479c199e08ffbbf62c1a
-
SSDEEP
12288:GJd7xDyNZHN32RDRua9FZzrGHQTMDPnA46X3/aeSGxF10mhXWty7Xy5mQmkR/zEC:6dtuNtN32rRLZqQyp4HSGxZhXWO5C
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
efosa94949.no-ip.biz:1604
Mutex
DC_MUTEX-7SCGJWM
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
k0FWSrLTENGX
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2720 attrib.exe -
Deletes itself 1 IoCs
pid Process 2228 notepad.exe -
Executes dropped EXE 2 IoCs
pid Process 2932 msdcsc.exe 2232 msdcsc.exe -
Loads dropped DLL 3 IoCs
pid Process 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 2932 msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1940 set thread context of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 2932 set thread context of 2232 2932 msdcsc.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PPT_Test.Application 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB} 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PPT_Test.Application\CLSID 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PPT_Test.Application\CLSID\ = "{DE7CBE17-0368-40E2-8357-1639DA027BAB}" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\ProgID\ = "PPT_Test.Application" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\InprocHandler32 msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PPT_Test.Application\ = "PPT_Test.Application" 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\ = "PPT_Test.Application" 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\ProgID 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\InprocHandler32 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\InprocHandler32\ = "ole32.dll" 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\LocalServer32 msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\LocalServer32\ = "C:\\Users\\Admin\\DOCUME~1\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2D8D55~1.EXE" 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\InprocHandler32\ = "ole32.dll" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PPT_Test.Application\CLSID\ = "{DE7CBE17-0368-40E2-8357-1639DA027BAB}" 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\ProgID\ = "PPT_Test.Application" 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\LocalServer32 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PPT_Test.Application\CLSID msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE7CBE17-0368-40E2-8357-1639DA027BAB}\ProgID msdcsc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 2932 msdcsc.exe 2932 msdcsc.exe 2932 msdcsc.exe 2932 msdcsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2232 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeSecurityPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeTakeOwnershipPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeLoadDriverPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeSystemProfilePrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeSystemtimePrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeProfSingleProcessPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeIncBasePriorityPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeCreatePagefilePrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeBackupPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeRestorePrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeShutdownPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeDebugPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeSystemEnvironmentPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeChangeNotifyPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeRemoteShutdownPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeUndockPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeManageVolumePrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeImpersonatePrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeCreateGlobalPrivilege 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: 33 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: 34 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: 35 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe Token: SeIncreaseQuotaPrivilege 2232 msdcsc.exe Token: SeSecurityPrivilege 2232 msdcsc.exe Token: SeTakeOwnershipPrivilege 2232 msdcsc.exe Token: SeLoadDriverPrivilege 2232 msdcsc.exe Token: SeSystemProfilePrivilege 2232 msdcsc.exe Token: SeSystemtimePrivilege 2232 msdcsc.exe Token: SeProfSingleProcessPrivilege 2232 msdcsc.exe Token: SeIncBasePriorityPrivilege 2232 msdcsc.exe Token: SeCreatePagefilePrivilege 2232 msdcsc.exe Token: SeBackupPrivilege 2232 msdcsc.exe Token: SeRestorePrivilege 2232 msdcsc.exe Token: SeShutdownPrivilege 2232 msdcsc.exe Token: SeDebugPrivilege 2232 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2232 msdcsc.exe Token: SeChangeNotifyPrivilege 2232 msdcsc.exe Token: SeRemoteShutdownPrivilege 2232 msdcsc.exe Token: SeUndockPrivilege 2232 msdcsc.exe Token: SeManageVolumePrivilege 2232 msdcsc.exe Token: SeImpersonatePrivilege 2232 msdcsc.exe Token: SeCreateGlobalPrivilege 2232 msdcsc.exe Token: 33 2232 msdcsc.exe Token: 34 2232 msdcsc.exe Token: 35 2232 msdcsc.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 2932 msdcsc.exe 2932 msdcsc.exe 2232 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 1940 wrote to memory of 808 1940 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 30 PID 808 wrote to memory of 3016 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 32 PID 808 wrote to memory of 3016 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 32 PID 808 wrote to memory of 3016 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 32 PID 808 wrote to memory of 3016 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 32 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 808 wrote to memory of 2228 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 34 PID 3016 wrote to memory of 2720 3016 cmd.exe 35 PID 3016 wrote to memory of 2720 3016 cmd.exe 35 PID 3016 wrote to memory of 2720 3016 cmd.exe 35 PID 3016 wrote to memory of 2720 3016 cmd.exe 35 PID 808 wrote to memory of 2932 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 36 PID 808 wrote to memory of 2932 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 36 PID 808 wrote to memory of 2932 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 36 PID 808 wrote to memory of 2932 808 2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe 36 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2932 wrote to memory of 2232 2932 msdcsc.exe 37 PID 2232 wrote to memory of 2648 2232 msdcsc.exe 38 PID 2232 wrote to memory of 2648 2232 msdcsc.exe 38 PID 2232 wrote to memory of 2648 2232 msdcsc.exe 38 PID 2232 wrote to memory of 2648 2232 msdcsc.exe 38 PID 2232 wrote to memory of 2648 2232 msdcsc.exe 38 PID 2232 wrote to memory of 2648 2232 msdcsc.exe 38 PID 2232 wrote to memory of 2648 2232 msdcsc.exe 38 PID 2232 wrote to memory of 2648 2232 msdcsc.exe 38 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2720 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe"C:\Users\Admin\AppData\Local\Temp\2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exeC:\Users\Admin\AppData\Local\Temp\2d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418N.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2720
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2228
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeC:\Users\Admin\Documents\MSDCSC\msdcsc.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵
- System Location Discovery: System Language Discovery
PID:2648
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
911KB
MD5c6124a942c55b07895302856e06a9d90
SHA1792dcfe853839096cd815020cc084c00efea3eef
SHA2562d8d55b1a2040a041c217333c1fff62f927bf29b3049963a815e29934f3f8418
SHA512a79dee40098c9293de69fdf8564231a1d8cef29e0cb85b7b182e9ae4c5746467c660c6eba7395b04497b7839e6cfd66874697bfb532f479c199e08ffbbf62c1a