Analysis

  • max time kernel
    236s
  • max time network
    240s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 12:16

Errors

Reason
Machine shutdown

General

  • Target

    Mocq Epic.exe

  • Size

    306KB

  • MD5

    fa26fae9f733a63cfcdf6fcc3127bb84

  • SHA1

    273e9e1928f10e1bbba028bd52ca21304a96f613

  • SHA256

    0ffdb148ab9c816bf4a643a727e02640878e2c98d4ff2b059e1bb7c3a9dcb48a

  • SHA512

    148d035f0eb05e5f5417ca92a0d7d136e3ad84f58971547757b058fcc7f948a77a6b6666818e5ab093106341688719e19385a5e0749798b8970df8af1be12f32

  • SSDEEP

    6144:mKuAN92+b1/2C5WxGojEydZ9CjuRDi2AyDf8QjT/LPK8/p+upNnVW4XyS3A8:juANX1eCPojEy79CjEDi2AyDf8QjDLPZ

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mocq Epic.exe
    "C:\Users\Admin\AppData\Local\Temp\Mocq Epic.exe"
    1⤵
      PID:2236
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x2fc 0x390
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1796
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1768
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3903055 /state1:0x41c64e6d
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4688

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1768-20-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-16-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-8-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-10-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-14-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-15-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-17-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-18-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-19-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/1768-9-0x0000021ADDDC0000-0x0000021ADDDC1000-memory.dmp
      Filesize

      4KB

    • memory/2236-5-0x00007FFCFA0A3000-0x00007FFCFA0A5000-memory.dmp
      Filesize

      8KB

    • memory/2236-21-0x00007FFCFA0A0000-0x00007FFCFAB61000-memory.dmp
      Filesize

      10.8MB

    • memory/2236-0-0x00007FFCFA0A3000-0x00007FFCFA0A5000-memory.dmp
      Filesize

      8KB

    • memory/2236-2-0x0000000000F10000-0x0000000000F24000-memory.dmp
      Filesize

      80KB

    • memory/2236-7-0x00007FFCFA0A0000-0x00007FFCFAB61000-memory.dmp
      Filesize

      10.8MB

    • memory/2236-6-0x00007FFCFA0A0000-0x00007FFCFAB61000-memory.dmp
      Filesize

      10.8MB

    • memory/2236-1-0x0000000000710000-0x0000000000764000-memory.dmp
      Filesize

      336KB

    • memory/2236-4-0x00007FFCFA0A0000-0x00007FFCFAB61000-memory.dmp
      Filesize

      10.8MB

    • memory/2236-3-0x00007FFCFA0A0000-0x00007FFCFAB61000-memory.dmp
      Filesize

      10.8MB