59e2454cb93265e4ada59e8c3beec5abae5ea3833879cd90995365f9f89351eb

Analysis

max time kernel
142s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2023 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mcafe.exe
Size

638KB
MD5

76166c4ad30e3da0060f41fe59e465f1
SHA1

31d887a689a2a6fab9723589bd02d5c15ec09924
SHA256

908d00c0d3a8fe68b7cb0da154143ac81e357b1ca043ff25ac3581d2186defcb
SHA512

e0ed4e2af54add6d449d9b4ac0ac291ed9195a96d55a44c956fd7d32f7144ef432d9da14a5d6ff00fb3e94e79df8a7278338f3c475936b62a5da3848ab538f47
SSDEEP

3072:FgXpJozm2lkCsuYDbM2ZZQ4MGGfviMQYTQbrEQ:IpC62lkCMcGGHikTk

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\gdi32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\glu32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\msctf.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\dbghelp.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\TextInputFramework.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\crypt32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\fastprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\oleaut32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\ResourcePolicyClient.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\XInput9_1_0.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\version.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\hid.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\gdi32full.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\advapi32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\ucrtbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\ole32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\shlwapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\shcore.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\crypt32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\winhttp.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\msctf.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\rsaenh.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\WLDP.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\dxgi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\wbemcomn.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\powrprof.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\ws2_32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\CoreUIComponents.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\sspicli.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\wbemsvc.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dbghelp.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_mono_x64.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\version.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\DXCore.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\wbemprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\powrprof.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\rpcrt4.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\msvcrt.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\shcore.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\winhttp.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\glu32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\gdi32full.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\bcrypt.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\winmm.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\wbemsvc.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\ntmarta.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\sechost.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\imm32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\bcryptprimitives.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\oleaut32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\cryptsp.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\gdi32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\rpcrt4.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\opengl32.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\cryptbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\sspicli.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\rsaenh.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\shlwapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\bcryptprimitives.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\symbols\dll\UxTheme.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\shcore.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\dll\profapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\system32\WinTypes.pdb	Mcafe.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bcryptprimitives.pdb	Mcafe.exe
File opened for modification	C:\Windows\WLDP.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\CLBCatQ.pdb	Mcafe.exe
File opened for modification	C:\Windows\TextInputFramework.pdb	Mcafe.exe
File opened for modification	C:\Windows\CoreUIComponents.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\version.pdb	Mcafe.exe
File opened for modification	C:\Windows\winhttp.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\msctf.pdb	Mcafe.exe
File opened for modification	C:\Windows\MMDevAPI.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\UMPDC.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\ResourcePolicyClient.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\cryptbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\msvcp_win.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\shcore.pdb	Mcafe.exe
File opened for modification	C:\Windows\Windows.Storage.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\dbghelp.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\XInput9_1_0.pdb	Mcafe.exe
File opened for modification	C:\Windows\CoreMessaging.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\shlwapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\DLL\hid.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\winmm.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\d3d10warp.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\MMDevAPI.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\WinTypes.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\cfgmgr32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\cfgmgr32.pdb	Mcafe.exe
File opened for modification	C:\Windows\version.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\DXCore.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\cryptsp.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\ucrtbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\sechost.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\crypt32.pdb	Mcafe.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_mono_x64.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\dbghelp.pdb	Mcafe.exe
File opened for modification	C:\Windows\fastprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\msvcp_win.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\bcrypt.pdb	Mcafe.exe
File opened for modification	C:\Windows\devobj.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\combase.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\msvcrt.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\cryptbase.pdb	Mcafe.exe
File opened for modification	C:\Windows\sspicli.pdb	Mcafe.exe
File opened for modification	C:\Windows\wbemcomn.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\powrprof.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\wbemsvc.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\CoreUIComponents.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\winmm.pdb	Mcafe.exe
File opened for modification	C:\Windows\wbemprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\shell32.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\shell32.pdb	Mcafe.exe
File opened for modification	C:\Windows\sechost.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\Kernel.Appcore.pdb	Mcafe.exe
File opened for modification	C:\Windows\iphlpapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\gdi32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\gdi32full.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\rsaenh.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\user32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\oleaut32.pdb	Mcafe.exe
File opened for modification	C:\Windows\symbols\dll\Windows.Storage.pdb	Mcafe.exe
File opened for modification	C:\Windows\profapi.pdb	Mcafe.exe
File opened for modification	C:\Windows\dll\wbemprox.pdb	Mcafe.exe
File opened for modification	C:\Windows\kernel32.pdb	Mcafe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4940	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
520	Mcafe.exe

C:\Users\Admin\AppData\Local\Temp\Mcafe.exe
"C:\Users\Admin\AppData\Local\Temp\Mcafe.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:520

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x4cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-0-0x00000256C16B0000-0x00000256C16C0000-memory.dmp

Filesize
64KB

Download
memory/520-1-0x00000256A13E0000-0x00000256A13F0000-memory.dmp

Filesize
64KB

Download
memory/520-2-0x0000025865150000-0x0000025865170000-memory.dmp

Filesize
128KB

Download
memory/520-3-0x0000025886BD0000-0x0000025886BE0000-memory.dmp

Filesize
64KB

Download
memory/520-4-0x00000258863D0000-0x00000258863E0000-memory.dmp

Filesize
64KB

Download
memory/520-5-0x00000258863E0000-0x00000258863F0000-memory.dmp

Filesize
64KB

Download
memory/520-6-0x0000025886440000-0x0000025886450000-memory.dmp

Filesize
64KB

Download
memory/520-7-0x0000025886650000-0x0000025886660000-memory.dmp

Filesize
64KB

Download
memory/520-8-0x00000258A6F50000-0x00000258A6F60000-memory.dmp

Filesize
64KB

Download
memory/520-9-0x00000258A6F60000-0x00000258A6F70000-memory.dmp

Filesize
64KB

Download
memory/520-10-0x00000256C16B0000-0x00000256C16C0000-memory.dmp

Filesize
64KB

Download
memory/520-11-0x00000256A13E0000-0x00000256A13F0000-memory.dmp

Filesize
64KB

Download
memory/520-12-0x00000258A7F80000-0x00000258A7F90000-memory.dmp

Filesize
64KB

Download
memory/520-13-0x00000258A8F70000-0x00000258A8F80000-memory.dmp

Filesize
64KB

Download
memory/520-14-0x00000258A8F60000-0x00000258A8F70000-memory.dmp

Filesize
64KB

Download
memory/520-16-0x00000258A9010000-0x00000258A9020000-memory.dmp

Filesize
64KB

Download
memory/520-15-0x0000025865150000-0x0000025865170000-memory.dmp

Filesize
128KB

Download
memory/520-17-0x00000256A13E0000-0x00000256A13F0000-memory.dmp

Filesize
64KB

Download
memory/520-18-0x0000025886BD0000-0x0000025886BE0000-memory.dmp

Filesize
64KB

Download
memory/520-19-0x00000258863D0000-0x00000258863E0000-memory.dmp

Filesize
64KB

Download
memory/520-20-0x00000258863E0000-0x00000258863F0000-memory.dmp

Filesize
64KB

Download
memory/520-21-0x00000258A6F60000-0x00000258A6F70000-memory.dmp

Filesize
64KB

Download
memory/520-22-0x0000025886440000-0x0000025886450000-memory.dmp

Filesize
64KB

Download
memory/520-23-0x0000025886650000-0x0000025886660000-memory.dmp

Filesize
64KB

Download
memory/520-24-0x00000258A6F50000-0x00000258A6F60000-memory.dmp

Filesize
64KB

Download
memory/520-27-0x00000256C16B0000-0x00000256C16C0000-memory.dmp

Filesize
64KB

Download
memory/520-26-0x00000258A8F70000-0x00000258A8F80000-memory.dmp

Filesize
64KB

Download
memory/520-25-0x00000258A9010000-0x00000258A9020000-memory.dmp

Filesize
64KB

Download