Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe
Resource
win10v2004-20240709-en
General
-
Target
b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe
-
Size
3.8MB
-
MD5
6ee7644aad712e9299421bda9d6ca7ad
-
SHA1
dec188b06083094dcdb33ea292b1e9695e367734
-
SHA256
b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b
-
SHA512
61977d03965278ddcd7016d4ba7eda1011dca090ecb22297809c082428f98430ba04d513e341a6ab76671f315974955244705b75609cb68dd5489bbeba79cfe2
-
SSDEEP
98304:ki4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/qu:ki4hTLOMtHDMlANqnfVGPyhcMYg4lSiQ
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe -
Executes dropped EXE 2 IoCs
pid Process 4536 mcsft.exe 3916 mcsft.exe -
resource yara_rule behavioral2/memory/3916-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3916-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4536 set thread context of 3916 4536 mcsft.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3916 mcsft.exe Token: SeSecurityPrivilege 3916 mcsft.exe Token: SeTakeOwnershipPrivilege 3916 mcsft.exe Token: SeLoadDriverPrivilege 3916 mcsft.exe Token: SeSystemProfilePrivilege 3916 mcsft.exe Token: SeSystemtimePrivilege 3916 mcsft.exe Token: SeProfSingleProcessPrivilege 3916 mcsft.exe Token: SeIncBasePriorityPrivilege 3916 mcsft.exe Token: SeCreatePagefilePrivilege 3916 mcsft.exe Token: SeBackupPrivilege 3916 mcsft.exe Token: SeRestorePrivilege 3916 mcsft.exe Token: SeShutdownPrivilege 3916 mcsft.exe Token: SeDebugPrivilege 3916 mcsft.exe Token: SeSystemEnvironmentPrivilege 3916 mcsft.exe Token: SeChangeNotifyPrivilege 3916 mcsft.exe Token: SeRemoteShutdownPrivilege 3916 mcsft.exe Token: SeUndockPrivilege 3916 mcsft.exe Token: SeManageVolumePrivilege 3916 mcsft.exe Token: SeImpersonatePrivilege 3916 mcsft.exe Token: SeCreateGlobalPrivilege 3916 mcsft.exe Token: 33 3916 mcsft.exe Token: 34 3916 mcsft.exe Token: 35 3916 mcsft.exe Token: 36 3916 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4916 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 4536 mcsft.exe 3916 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4916 wrote to memory of 2348 4916 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 87 PID 4916 wrote to memory of 2348 4916 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 87 PID 4916 wrote to memory of 2348 4916 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 87 PID 2348 wrote to memory of 1284 2348 cmd.exe 90 PID 2348 wrote to memory of 1284 2348 cmd.exe 90 PID 2348 wrote to memory of 1284 2348 cmd.exe 90 PID 4916 wrote to memory of 4536 4916 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 91 PID 4916 wrote to memory of 4536 4916 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 91 PID 4916 wrote to memory of 4536 4916 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 91 PID 4536 wrote to memory of 3916 4536 mcsft.exe 92 PID 4536 wrote to memory of 3916 4536 mcsft.exe 92 PID 4536 wrote to memory of 3916 4536 mcsft.exe 92 PID 4536 wrote to memory of 3916 4536 mcsft.exe 92 PID 4536 wrote to memory of 3916 4536 mcsft.exe 92 PID 4536 wrote to memory of 3916 4536 mcsft.exe 92 PID 4536 wrote to memory of 3916 4536 mcsft.exe 92 PID 4536 wrote to memory of 3916 4536 mcsft.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe"C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pored.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
PID:1284
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3916
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
3.8MB
MD5cd8cba2a8090011010c7be6de55a1f69
SHA1c85b0a2a253949cfef78e1bd62c6eb1538335990
SHA256daa10f2edddedf6f98950831dde48f87f6dbdcee17266936eebb104dad735c0c
SHA512875806fed0e4203941e3b0edf380b3edfadeb2452367d8d6747975110607769df3e6553e70c7a1c3291763b72585a811c9c6bf4e57880fd0142611db1692499f