Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 00:05
Behavioral task
behavioral1
Sample
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe
Resource
win10v2004-20240508-en
General
-
Target
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe
-
Size
576KB
-
MD5
0e15cecaaca7ac6bd759d843e6250308
-
SHA1
bd8cc1af7c9fa3347ca25bb010490957a7e8852a
-
SHA256
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322
-
SHA512
318cf88c5e097d4a0cffb58440327dca8668ad3d5d06111ad336064f27ee9a2ae056973aa48084cda25248b077a2e9685b2748979d84f7f4438e2fb1fc555d24
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSS:+NWPkHlUfBgpuPdWzyuDTifgyWlt
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 30 IoCs
Processes:
resource yara_rule behavioral1/memory/2212-0-0x0000000000400000-0x00000000007C8000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\mcsft.exe UPX behavioral1/memory/2212-48-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral1/memory/2744-46-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral1/memory/2840-56-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-55-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-53-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-65-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-64-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-63-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-62-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-61-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-60-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-59-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2744-58-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral1/memory/2840-66-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-67-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-68-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-69-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-70-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-71-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-72-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-73-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-74-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-75-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-76-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-77-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-78-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-79-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2840-80-0x0000000000400000-0x00000000004B5000-memory.dmp UPX -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 2744 mcsft.exe 2840 mcsft.exe -
Loads dropped DLL 6 IoCs
Processes:
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exemcsft.exepid process 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe 2744 mcsft.exe -
Processes:
resource yara_rule behavioral1/memory/2212-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mcsft.exe upx behavioral1/memory/2212-48-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2744-46-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2840-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2744-58-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2840-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-79-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2840-80-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 2744 set thread context of 2840 2744 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 2840 mcsft.exe Token: SeSecurityPrivilege 2840 mcsft.exe Token: SeTakeOwnershipPrivilege 2840 mcsft.exe Token: SeLoadDriverPrivilege 2840 mcsft.exe Token: SeSystemProfilePrivilege 2840 mcsft.exe Token: SeSystemtimePrivilege 2840 mcsft.exe Token: SeProfSingleProcessPrivilege 2840 mcsft.exe Token: SeIncBasePriorityPrivilege 2840 mcsft.exe Token: SeCreatePagefilePrivilege 2840 mcsft.exe Token: SeBackupPrivilege 2840 mcsft.exe Token: SeRestorePrivilege 2840 mcsft.exe Token: SeShutdownPrivilege 2840 mcsft.exe Token: SeDebugPrivilege 2840 mcsft.exe Token: SeSystemEnvironmentPrivilege 2840 mcsft.exe Token: SeChangeNotifyPrivilege 2840 mcsft.exe Token: SeRemoteShutdownPrivilege 2840 mcsft.exe Token: SeUndockPrivilege 2840 mcsft.exe Token: SeManageVolumePrivilege 2840 mcsft.exe Token: SeImpersonatePrivilege 2840 mcsft.exe Token: SeCreateGlobalPrivilege 2840 mcsft.exe Token: 33 2840 mcsft.exe Token: 34 2840 mcsft.exe Token: 35 2840 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exemcsft.exemcsft.exepid process 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe 2744 mcsft.exe 2840 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.execmd.exemcsft.exedescription pid process target process PID 2212 wrote to memory of 2780 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe cmd.exe PID 2212 wrote to memory of 2780 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe cmd.exe PID 2212 wrote to memory of 2780 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe cmd.exe PID 2212 wrote to memory of 2780 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe cmd.exe PID 2780 wrote to memory of 2648 2780 cmd.exe reg.exe PID 2780 wrote to memory of 2648 2780 cmd.exe reg.exe PID 2780 wrote to memory of 2648 2780 cmd.exe reg.exe PID 2780 wrote to memory of 2648 2780 cmd.exe reg.exe PID 2212 wrote to memory of 2744 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe mcsft.exe PID 2212 wrote to memory of 2744 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe mcsft.exe PID 2212 wrote to memory of 2744 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe mcsft.exe PID 2212 wrote to memory of 2744 2212 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe PID 2744 wrote to memory of 2840 2744 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe"C:\Users\Admin\AppData\Local\Temp\659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\oeMkG.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\oeMkG.batFilesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
C:\Users\Admin\AppData\Roaming\mcsft.exeFilesize
576KB
MD5f9c750f0b0dd97118209ef908abd9635
SHA1b2ce290d13a81de4843e2ac3b82323285768ed8f
SHA25642800d224ebbd19127a02de869a258f0144c619e18b86559f8e199155855128e
SHA51200a4ec0cdeaecd1893767322b6fb8b4c9bb5e6a04b489eb2ccba86dfb88202f43eaa66ccdb68991fe7afef6d63475f5785feda7070a71244c75355c1bdcc4aac
-
memory/2212-0-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2212-43-0x0000000003B60000-0x0000000003F28000-memory.dmpFilesize
3.8MB
-
memory/2212-48-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2212-45-0x0000000003B60000-0x0000000003F28000-memory.dmpFilesize
3.8MB
-
memory/2212-44-0x0000000003B60000-0x0000000003F28000-memory.dmpFilesize
3.8MB
-
memory/2744-46-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2744-58-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2840-60-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-69-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-65-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-64-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-63-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-62-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-61-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-55-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-59-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-66-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-67-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-68-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-53-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-70-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-71-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-72-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-73-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-74-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-75-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-76-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-77-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-78-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-79-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2840-80-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB