cd0772a4089bfa360622ba94a52ccce9ffcf82064aa23862073dad58423cadde

Resubmissions

31/05/2023, 15:21

230531-srdyxagb71 5

31/05/2023, 14:46

230531-r5g22sfe98 7

Analysis

max time kernel
134s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2023, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mcafe.exe
Size

638KB
MD5

76166c4ad30e3da0060f41fe59e465f1
SHA1

31d887a689a2a6fab9723589bd02d5c15ec09924
SHA256

908d00c0d3a8fe68b7cb0da154143ac81e357b1ca043ff25ac3581d2186defcb
SHA512

e0ed4e2af54add6d449d9b4ac0ac291ed9195a96d55a44c956fd7d32f7144ef432d9da14a5d6ff00fb3e94e79df8a7278338f3c475936b62a5da3848ab538f47
SSDEEP

3072:FgXpJozm2lkCsuYDbM2ZZQ4MGGfviMQYTQbrEQ:IpC62lkCMcGGHikTk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Mcafe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\devobj.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\ucrtbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\wbemprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\DXCore.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\user32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\UxTheme.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\shcore.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_mono_x64.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\devobj.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\rsaenh.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\ucrtbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\setupapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\sechost.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\rsaenh.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\msvcp_win.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\Amsi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\dbghelp.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\version.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\d3d10warp.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\glu32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\wbemprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\version.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\cryptbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\Windows.Storage.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\powrprof.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\bcrypt.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\psapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\CLBCatQ.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\DLL\audioses.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\Windows.Storage.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\DXCore.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\winhttp.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\ResourcePolicyClient.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\shlwapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\crypt32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\Kernel.Appcore.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\MMDevAPI.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\cfgmgr32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\bcrypt.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\gdi32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\CoreUIComponents.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\dwmapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\glu32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\profapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\dxgi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\Amsi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\cryptbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\setupapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\msctf.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\shell32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\crypt32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\bcryptprimitives.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\Windows.Storage.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\msctf.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\wbemsvc.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\cfgmgr32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\oleaut32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\iphlpapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\dxgi.pdb	Mcafe.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\symbols\dll\ucrtbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\Kernel.Appcore.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\bcryptprimitives.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\WLDP.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\d3d11.pdb	Mcafe.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\devobj.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\ole32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\gdi32full.pdb	Mcafe.exe
File opened for modification	C:\Windows\msvcrt.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\sechost.pdb	Mcafe.exe
File opened for modification	C:\Windows\devobj.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\CoreMessaging.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\imm32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\Windows.Storage.pdb	Mcafe.exe
File opened for modification	C:\Windows\WLDP.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\wbemsvc.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\winhttp.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\CLBCatQ.pdb	Mcafe.exe
File opened for modification	C:\Windows\setupapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\d3d11.pdb	Mcafe.exe
File opened for modification	C:\Windows\Amsi.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\wbemprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\ucrtbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\gdi32full.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\msvcp_win.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\bcrypt.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\Windows.Storage.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\ws2_32.pdb	Mcafe.exe
File opened for modification	C:\Windows\bcryptprimitives.pdb	Mcafe.exe
File opened for modification	C:\Windows\dbghelp.pdb	Mcafe.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_mono_x64.pdb	Mcafe.exe
File opened for modification	C:\Windows\cfgmgr32.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\advapi32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\dxgi.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	Mcafe.exe
File opened for modification	C:\Windows\win32u.pdb	Mcafe.exe
File opened for modification	C:\Windows\psapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\d3d10warp.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\fastprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	Mcafe.exe
File opened for modification	C:\Windows\ntmarta.pdb	Mcafe.exe
File opened for modification	C:\Windows\msvcp_win.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\setupapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\glu32.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\TextInputFramework.pdb	Mcafe.exe
File opened for modification	C:\Windows\ntdll.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\wbemprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\CoreMessaging.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\DLL\psapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\oleaut32.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\glu32.pdb	Mcafe.exe
File opened for modification	C:\Windows\DLL\audioses.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\cryptsp.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\user32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\setupapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\profapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\wbemsvc.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\UMPDC.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\rsaenh.pdb	Mcafe.exe
File opened for modification	C:\Windows\gdi32.pdb	Mcafe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1120	3756	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4100	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3756	Mcafe.exe

C:\Users\Admin\AppData\Local\Temp\Mcafe.exe
"C:\Users\Admin\AppData\Local\Temp\Mcafe.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3756 -s 2420
  2⤵
  - Program crash
  PID:1120

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x3f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 3756 -ip 3756
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3756-133-0x0000021A070A0000-0x0000021A070B0000-memory.dmp

Filesize
64KB

Download
memory/3756-134-0x0000021A07080000-0x0000021A07090000-memory.dmp

Filesize
64KB

Download
memory/3756-135-0x0000021BCC760000-0x0000021BCC780000-memory.dmp

Filesize
128KB

Download
memory/3756-136-0x0000021BEE1C0000-0x0000021BEE1D0000-memory.dmp

Filesize
64KB

Download
memory/3756-137-0x0000021BEE1E0000-0x0000021BEE1F0000-memory.dmp

Filesize
64KB

Download
memory/3756-138-0x0000021BEE1F0000-0x0000021BEE200000-memory.dmp

Filesize
64KB

Download
memory/3756-139-0x0000021BECA60000-0x0000021BECA70000-memory.dmp

Filesize
64KB

Download
memory/3756-140-0x0000021BECA70000-0x0000021BECA80000-memory.dmp

Filesize
64KB

Download
memory/3756-142-0x0000021C0F520000-0x0000021C0F530000-memory.dmp

Filesize
64KB

Download
memory/3756-143-0x0000021C10520000-0x0000021C10530000-memory.dmp

Filesize
64KB

Download
memory/3756-145-0x0000021C10570000-0x0000021C10580000-memory.dmp

Filesize
64KB

Download
memory/3756-141-0x0000021C0E540000-0x0000021C0E550000-memory.dmp

Filesize
64KB

Download
memory/3756-150-0x0000021C105A0000-0x0000021C105B0000-memory.dmp

Filesize
64KB

Download
memory/3756-152-0x0000021BCC760000-0x0000021BCC780000-memory.dmp

Filesize
128KB

Download
memory/3756-153-0x0000021BEE1C0000-0x0000021BEE1D0000-memory.dmp

Filesize
64KB

Download
memory/3756-159-0x0000021C0F520000-0x0000021C0F530000-memory.dmp

Filesize
64KB

Download
memory/3756-158-0x0000021BECA70000-0x0000021BECA80000-memory.dmp

Filesize
64KB

Download
memory/3756-157-0x0000021BEE1F0000-0x0000021BEE200000-memory.dmp

Filesize
64KB

Download
memory/3756-156-0x0000021C0E540000-0x0000021C0E550000-memory.dmp

Filesize
64KB

Download
memory/3756-155-0x0000021BECA60000-0x0000021BECA70000-memory.dmp

Filesize
64KB

Download
memory/3756-154-0x0000021BEE1E0000-0x0000021BEE1F0000-memory.dmp

Filesize
64KB

Download
memory/3756-151-0x0000021C105B0000-0x0000021C105C0000-memory.dmp

Filesize
64KB

Download
memory/3756-149-0x0000021A07080000-0x0000021A07090000-memory.dmp

Filesize
64KB

Download
memory/3756-148-0x0000021C10580000-0x0000021C10590000-memory.dmp

Filesize
64KB

Download
memory/3756-147-0x0000021A070A0000-0x0000021A070B0000-memory.dmp

Filesize
64KB

Download