Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 20:02
Behavioral task
behavioral1
Sample
2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe
Resource
win10v2004-20240426-en
General
-
Target
2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe
-
Size
576KB
-
MD5
c6d93ca21e9d07f7afee7a0d1e2a6ed5
-
SHA1
7971d487e1cd227f61cc1ca2e5b93430ef4ccc09
-
SHA256
2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a
-
SHA512
24f3953fd998d1da00275d044854882c9a5772757e79f2f577a191f855d90b7437c0ba3de9e4265bb99e7bd8aecdb65fabcb092a8eafc0b68006724b3f0e1553
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSY:+NWPkHlUfBgpuPdWzyuDTifgyWlp
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 30 IoCs
Processes:
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x00000000007C8000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\mcsft.exe UPX behavioral1/memory/2684-46-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral1/memory/2924-44-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral1/memory/2544-57-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-56-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2684-55-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral1/memory/2544-58-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-59-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-54-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-63-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-62-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-61-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-60-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-51-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-64-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-66-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-67-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-68-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-69-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-70-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-71-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-72-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-73-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-74-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-75-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-76-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-77-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-78-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2544-79-0x0000000000400000-0x00000000004B5000-memory.dmp UPX -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 2684 mcsft.exe 2544 mcsft.exe -
Loads dropped DLL 6 IoCs
Processes:
2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exemcsft.exepid process 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe 2684 mcsft.exe -
Processes:
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mcsft.exe upx behavioral1/memory/2684-46-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2924-45-0x0000000003940000-0x0000000003D08000-memory.dmp upx behavioral1/memory/2924-44-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2544-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2684-55-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2544-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2544-79-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 2684 set thread context of 2544 2684 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 2544 mcsft.exe Token: SeSecurityPrivilege 2544 mcsft.exe Token: SeTakeOwnershipPrivilege 2544 mcsft.exe Token: SeLoadDriverPrivilege 2544 mcsft.exe Token: SeSystemProfilePrivilege 2544 mcsft.exe Token: SeSystemtimePrivilege 2544 mcsft.exe Token: SeProfSingleProcessPrivilege 2544 mcsft.exe Token: SeIncBasePriorityPrivilege 2544 mcsft.exe Token: SeCreatePagefilePrivilege 2544 mcsft.exe Token: SeBackupPrivilege 2544 mcsft.exe Token: SeRestorePrivilege 2544 mcsft.exe Token: SeShutdownPrivilege 2544 mcsft.exe Token: SeDebugPrivilege 2544 mcsft.exe Token: SeSystemEnvironmentPrivilege 2544 mcsft.exe Token: SeChangeNotifyPrivilege 2544 mcsft.exe Token: SeRemoteShutdownPrivilege 2544 mcsft.exe Token: SeUndockPrivilege 2544 mcsft.exe Token: SeManageVolumePrivilege 2544 mcsft.exe Token: SeImpersonatePrivilege 2544 mcsft.exe Token: SeCreateGlobalPrivilege 2544 mcsft.exe Token: 33 2544 mcsft.exe Token: 34 2544 mcsft.exe Token: 35 2544 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exemcsft.exemcsft.exepid process 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe 2684 mcsft.exe 2544 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.execmd.exemcsft.exedescription pid process target process PID 2924 wrote to memory of 2876 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe cmd.exe PID 2924 wrote to memory of 2876 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe cmd.exe PID 2924 wrote to memory of 2876 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe cmd.exe PID 2924 wrote to memory of 2876 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe cmd.exe PID 2876 wrote to memory of 2568 2876 cmd.exe reg.exe PID 2876 wrote to memory of 2568 2876 cmd.exe reg.exe PID 2876 wrote to memory of 2568 2876 cmd.exe reg.exe PID 2876 wrote to memory of 2568 2876 cmd.exe reg.exe PID 2924 wrote to memory of 2684 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe mcsft.exe PID 2924 wrote to memory of 2684 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe mcsft.exe PID 2924 wrote to memory of 2684 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe mcsft.exe PID 2924 wrote to memory of 2684 2924 2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe PID 2684 wrote to memory of 2544 2684 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe"C:\Users\Admin\AppData\Local\Temp\2eaa11604d593c1f1a7493f0e9d5e0523c156b5c53c5dccd6c5e2f925309cd2a.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\lIXfW.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
PID:2568 -
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lIXfW.batFilesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
C:\Users\Admin\AppData\Roaming\mcsft.exeFilesize
576KB
MD5fbede359be9d473035e51f4ab9b01063
SHA1825ea8c1af75179d4b9b555061f4a7f4de67c89b
SHA256c095b30b9458a0739d6534aab7c30b9105c660bb8a3a84d7d7c3af02c48c5089
SHA512039a7f8adc6aa9d1f3b832510ad835252f889f149532299013f7c2c756edab17859f4c3c4415d9e52f503df7c0632827a9d7af6904362a9cb180a8ea0b96b479
-
memory/2544-71-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-79-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-51-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-64-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-57-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-78-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-58-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-59-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-54-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-63-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-62-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-61-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-60-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-77-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-76-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-75-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-66-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-67-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-68-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-69-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-70-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-74-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-72-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2544-73-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2684-46-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2684-55-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2924-0-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2924-65-0x0000000003940000-0x0000000003D08000-memory.dmpFilesize
3.8MB
-
memory/2924-45-0x0000000003940000-0x0000000003D08000-memory.dmpFilesize
3.8MB
-
memory/2924-44-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB