Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 01:20
Behavioral task
behavioral1
Sample
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe
Resource
win10v2004-20240508-en
General
-
Target
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe
-
Size
576KB
-
MD5
3efacdc5d8b08bded895cc7c19006c49
-
SHA1
e36ffbcbaa744cd1c13b2ed09ee109f03bb7eae1
-
SHA256
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e
-
SHA512
bf813a15eec83b58c21932bbd04127d78d4045b7b1a03f6eaaf8b032f7220e307821b4e0604e801e3d185d57ea9b47f77e628a3d5fa4462f7d2bcb84e0e0e39c
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSP:+NWPkHlUfBgpuPdWzyuDTifgyWlI
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral2/memory/2796-0-0x0000000000400000-0x00000000007C8000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\mcsft.txt UPX behavioral2/memory/2796-29-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral2/memory/3840-30-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral2/memory/1672-33-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-36-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3840-39-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral2/memory/1672-38-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-40-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-41-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-45-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-44-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-43-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-42-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-46-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-47-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-48-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-49-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-50-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-51-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-52-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-53-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-54-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-55-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-56-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-57-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-58-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/1672-59-0x0000000000400000-0x00000000004B5000-memory.dmp UPX -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 3840 mcsft.exe 1672 mcsft.exe -
Processes:
resource yara_rule behavioral2/memory/2796-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mcsft.txt upx behavioral2/memory/2796-29-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/3840-30-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/1672-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3840-39-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/1672-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1672-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 3840 set thread context of 1672 3840 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 1672 mcsft.exe Token: SeSecurityPrivilege 1672 mcsft.exe Token: SeTakeOwnershipPrivilege 1672 mcsft.exe Token: SeLoadDriverPrivilege 1672 mcsft.exe Token: SeSystemProfilePrivilege 1672 mcsft.exe Token: SeSystemtimePrivilege 1672 mcsft.exe Token: SeProfSingleProcessPrivilege 1672 mcsft.exe Token: SeIncBasePriorityPrivilege 1672 mcsft.exe Token: SeCreatePagefilePrivilege 1672 mcsft.exe Token: SeBackupPrivilege 1672 mcsft.exe Token: SeRestorePrivilege 1672 mcsft.exe Token: SeShutdownPrivilege 1672 mcsft.exe Token: SeDebugPrivilege 1672 mcsft.exe Token: SeSystemEnvironmentPrivilege 1672 mcsft.exe Token: SeChangeNotifyPrivilege 1672 mcsft.exe Token: SeRemoteShutdownPrivilege 1672 mcsft.exe Token: SeUndockPrivilege 1672 mcsft.exe Token: SeManageVolumePrivilege 1672 mcsft.exe Token: SeImpersonatePrivilege 1672 mcsft.exe Token: SeCreateGlobalPrivilege 1672 mcsft.exe Token: 33 1672 mcsft.exe Token: 34 1672 mcsft.exe Token: 35 1672 mcsft.exe Token: 36 1672 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exemcsft.exemcsft.exepid process 2796 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe 3840 mcsft.exe 1672 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.execmd.exemcsft.exedescription pid process target process PID 2796 wrote to memory of 4016 2796 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe cmd.exe PID 2796 wrote to memory of 4016 2796 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe cmd.exe PID 2796 wrote to memory of 4016 2796 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe cmd.exe PID 4016 wrote to memory of 4204 4016 cmd.exe reg.exe PID 4016 wrote to memory of 4204 4016 cmd.exe reg.exe PID 4016 wrote to memory of 4204 4016 cmd.exe reg.exe PID 2796 wrote to memory of 3840 2796 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe mcsft.exe PID 2796 wrote to memory of 3840 2796 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe mcsft.exe PID 2796 wrote to memory of 3840 2796 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe mcsft.exe PID 3840 wrote to memory of 1672 3840 mcsft.exe mcsft.exe PID 3840 wrote to memory of 1672 3840 mcsft.exe mcsft.exe PID 3840 wrote to memory of 1672 3840 mcsft.exe mcsft.exe PID 3840 wrote to memory of 1672 3840 mcsft.exe mcsft.exe PID 3840 wrote to memory of 1672 3840 mcsft.exe mcsft.exe PID 3840 wrote to memory of 1672 3840 mcsft.exe mcsft.exe PID 3840 wrote to memory of 1672 3840 mcsft.exe mcsft.exe PID 3840 wrote to memory of 1672 3840 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe"C:\Users\Admin\AppData\Local\Temp\ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKJTS.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
PID:4204 -
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
576KB
MD51d3b573c49df666e3a2c92e44c634b80
SHA1d68b3a6d969a65d08d2ed151caf638804e85c1a4
SHA256692337ba1866b695fee4edd102f3561a1e553092650fe962f5db6665281421c8
SHA51228a5ad1f71fadb63e118f1b952a5fc56e34ac123e10b56d95a8beb260a1c1f64f2527a4096497a67eb2ab8a8b6cb7c0cc91c281f2c25960e1ab3e23f4e01033d