Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 00:05
Behavioral task
behavioral1
Sample
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe
Resource
win10v2004-20240508-en
General
-
Target
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe
-
Size
576KB
-
MD5
0e15cecaaca7ac6bd759d843e6250308
-
SHA1
bd8cc1af7c9fa3347ca25bb010490957a7e8852a
-
SHA256
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322
-
SHA512
318cf88c5e097d4a0cffb58440327dca8668ad3d5d06111ad336064f27ee9a2ae056973aa48084cda25248b077a2e9685b2748979d84f7f4438e2fb1fc555d24
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSS:+NWPkHlUfBgpuPdWzyuDTifgyWlt
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-0-0x0000000000400000-0x00000000007C8000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\mcsft.txt UPX behavioral2/memory/1604-29-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral2/memory/5048-32-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-35-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-39-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1176-38-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral2/memory/5048-36-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-40-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-43-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-42-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-41-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-44-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-45-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-46-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-47-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-48-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-49-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-50-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-51-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-52-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-53-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-54-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-55-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-56-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-57-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-58-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/5048-59-0x0000000000400000-0x00000000004B5000-memory.dmp UPX -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 1176 mcsft.exe 5048 mcsft.exe -
Processes:
resource yara_rule behavioral2/memory/1604-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mcsft.txt upx behavioral2/memory/1604-29-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/5048-32-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1176-38-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/5048-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5048-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 1176 set thread context of 5048 1176 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 5048 mcsft.exe Token: SeSecurityPrivilege 5048 mcsft.exe Token: SeTakeOwnershipPrivilege 5048 mcsft.exe Token: SeLoadDriverPrivilege 5048 mcsft.exe Token: SeSystemProfilePrivilege 5048 mcsft.exe Token: SeSystemtimePrivilege 5048 mcsft.exe Token: SeProfSingleProcessPrivilege 5048 mcsft.exe Token: SeIncBasePriorityPrivilege 5048 mcsft.exe Token: SeCreatePagefilePrivilege 5048 mcsft.exe Token: SeBackupPrivilege 5048 mcsft.exe Token: SeRestorePrivilege 5048 mcsft.exe Token: SeShutdownPrivilege 5048 mcsft.exe Token: SeDebugPrivilege 5048 mcsft.exe Token: SeSystemEnvironmentPrivilege 5048 mcsft.exe Token: SeChangeNotifyPrivilege 5048 mcsft.exe Token: SeRemoteShutdownPrivilege 5048 mcsft.exe Token: SeUndockPrivilege 5048 mcsft.exe Token: SeManageVolumePrivilege 5048 mcsft.exe Token: SeImpersonatePrivilege 5048 mcsft.exe Token: SeCreateGlobalPrivilege 5048 mcsft.exe Token: 33 5048 mcsft.exe Token: 34 5048 mcsft.exe Token: 35 5048 mcsft.exe Token: 36 5048 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exemcsft.exemcsft.exepid process 1604 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe 1176 mcsft.exe 5048 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.execmd.exemcsft.exedescription pid process target process PID 1604 wrote to memory of 4644 1604 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe cmd.exe PID 1604 wrote to memory of 4644 1604 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe cmd.exe PID 1604 wrote to memory of 4644 1604 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe cmd.exe PID 4644 wrote to memory of 1336 4644 cmd.exe reg.exe PID 4644 wrote to memory of 1336 4644 cmd.exe reg.exe PID 4644 wrote to memory of 1336 4644 cmd.exe reg.exe PID 1604 wrote to memory of 1176 1604 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe mcsft.exe PID 1604 wrote to memory of 1176 1604 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe mcsft.exe PID 1604 wrote to memory of 1176 1604 659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe mcsft.exe PID 1176 wrote to memory of 5048 1176 mcsft.exe mcsft.exe PID 1176 wrote to memory of 5048 1176 mcsft.exe mcsft.exe PID 1176 wrote to memory of 5048 1176 mcsft.exe mcsft.exe PID 1176 wrote to memory of 5048 1176 mcsft.exe mcsft.exe PID 1176 wrote to memory of 5048 1176 mcsft.exe mcsft.exe PID 1176 wrote to memory of 5048 1176 mcsft.exe mcsft.exe PID 1176 wrote to memory of 5048 1176 mcsft.exe mcsft.exe PID 1176 wrote to memory of 5048 1176 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe"C:\Users\Admin\AppData\Local\Temp\659dd6e2496712db5654e3fa91076a3b909770a1ae1a73575a8be87e8b6da322.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Axhgp.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Axhgp.txtFilesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
C:\Users\Admin\AppData\Roaming\mcsft.txtFilesize
576KB
MD57d18699745549266fbb740cace158baf
SHA16ad276fdc186834f423a815b6247ab494330a583
SHA256686f66db55131c544f72e70c0c8e9031d1cda75ac6587071574e38b8b5926b30
SHA512d8e9668367cdd240cc1f1f1c2748b86e42c064db98a0b87c7e0e79c20956f2012c3382dea4ad4a1498b3f3b3039e17e0e65a6f48e41f828746b9c1ac3a11f1ef
-
memory/1176-38-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/1604-29-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/1604-0-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/5048-45-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-47-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-35-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-36-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-40-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-43-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-42-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-41-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-44-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-32-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-46-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-39-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-48-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-49-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-50-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-51-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-52-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-53-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-54-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-55-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-57-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-58-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5048-59-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB