Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 01:20
Behavioral task
behavioral1
Sample
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe
Resource
win10v2004-20240508-en
General
-
Target
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe
-
Size
576KB
-
MD5
3efacdc5d8b08bded895cc7c19006c49
-
SHA1
e36ffbcbaa744cd1c13b2ed09ee109f03bb7eae1
-
SHA256
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e
-
SHA512
bf813a15eec83b58c21932bbd04127d78d4045b7b1a03f6eaaf8b032f7220e307821b4e0604e801e3d185d57ea9b47f77e628a3d5fa4462f7d2bcb84e0e0e39c
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSP:+NWPkHlUfBgpuPdWzyuDTifgyWlI
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 29 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-0-0x0000000000400000-0x00000000007C8000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\mcsft.exe UPX behavioral1/memory/2192-47-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral1/memory/2612-52-0x0000000002C00000-0x0000000002FC8000-memory.dmp UPX behavioral1/memory/2920-56-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2612-58-0x0000000000400000-0x00000000007C8000-memory.dmp UPX behavioral1/memory/2920-53-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-59-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-61-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-60-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-62-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-64-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-63-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-65-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-66-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-67-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-68-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-69-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-70-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-71-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-72-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-73-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-74-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-75-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-76-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-77-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-78-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-79-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral1/memory/2920-80-0x0000000000400000-0x00000000004B5000-memory.dmp UPX -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 2612 mcsft.exe 2920 mcsft.exe -
Loads dropped DLL 6 IoCs
Processes:
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exemcsft.exepid process 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe 2612 mcsft.exe -
Processes:
resource yara_rule behavioral1/memory/2192-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mcsft.exe upx behavioral1/memory/2192-47-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2612-52-0x0000000002C00000-0x0000000002FC8000-memory.dmp upx behavioral1/memory/2920-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2612-58-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2920-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-79-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-80-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 2612 set thread context of 2920 2612 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 2920 mcsft.exe Token: SeSecurityPrivilege 2920 mcsft.exe Token: SeTakeOwnershipPrivilege 2920 mcsft.exe Token: SeLoadDriverPrivilege 2920 mcsft.exe Token: SeSystemProfilePrivilege 2920 mcsft.exe Token: SeSystemtimePrivilege 2920 mcsft.exe Token: SeProfSingleProcessPrivilege 2920 mcsft.exe Token: SeIncBasePriorityPrivilege 2920 mcsft.exe Token: SeCreatePagefilePrivilege 2920 mcsft.exe Token: SeBackupPrivilege 2920 mcsft.exe Token: SeRestorePrivilege 2920 mcsft.exe Token: SeShutdownPrivilege 2920 mcsft.exe Token: SeDebugPrivilege 2920 mcsft.exe Token: SeSystemEnvironmentPrivilege 2920 mcsft.exe Token: SeChangeNotifyPrivilege 2920 mcsft.exe Token: SeRemoteShutdownPrivilege 2920 mcsft.exe Token: SeUndockPrivilege 2920 mcsft.exe Token: SeManageVolumePrivilege 2920 mcsft.exe Token: SeImpersonatePrivilege 2920 mcsft.exe Token: SeCreateGlobalPrivilege 2920 mcsft.exe Token: 33 2920 mcsft.exe Token: 34 2920 mcsft.exe Token: 35 2920 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exemcsft.exemcsft.exepid process 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe 2612 mcsft.exe 2920 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.execmd.exemcsft.exedescription pid process target process PID 2192 wrote to memory of 2292 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe cmd.exe PID 2192 wrote to memory of 2292 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe cmd.exe PID 2192 wrote to memory of 2292 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe cmd.exe PID 2192 wrote to memory of 2292 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe cmd.exe PID 2292 wrote to memory of 2564 2292 cmd.exe reg.exe PID 2292 wrote to memory of 2564 2292 cmd.exe reg.exe PID 2292 wrote to memory of 2564 2292 cmd.exe reg.exe PID 2292 wrote to memory of 2564 2292 cmd.exe reg.exe PID 2192 wrote to memory of 2612 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe mcsft.exe PID 2192 wrote to memory of 2612 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe mcsft.exe PID 2192 wrote to memory of 2612 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe mcsft.exe PID 2192 wrote to memory of 2612 2192 ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe PID 2612 wrote to memory of 2920 2612 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe"C:\Users\Admin\AppData\Local\Temp\ead5b40f50442f6a9a9360192332535e4b2bd1507005e24d78ff3e354210c00e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\USrMk.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\USrMk.batFilesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
C:\Users\Admin\AppData\Roaming\mcsft.exeFilesize
576KB
MD58638f0d1eecc2089a5cf465dedd30925
SHA1f1263030ca84e9c8bd661712f2772071c9660007
SHA256289fc5dc827d8e1876f31bb58a67abf0efaad32e70178f31baeb930c65e9b485
SHA512abcc3fed2b0b1e6bc56c8d90f40fc0371c48248b66049baea50de1762fa2468d1d4ef25b0ba1951ef4be3ac5910982a46c97607906d1701e5cdd1b9c71052f15
-
memory/2192-42-0x0000000003270000-0x0000000003638000-memory.dmpFilesize
3.8MB
-
memory/2192-43-0x0000000003270000-0x0000000003638000-memory.dmpFilesize
3.8MB
-
memory/2192-44-0x0000000003270000-0x0000000003638000-memory.dmpFilesize
3.8MB
-
memory/2192-47-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2192-0-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2612-58-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2612-52-0x0000000002C00000-0x0000000002FC8000-memory.dmpFilesize
3.8MB
-
memory/2920-63-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-68-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-59-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-61-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-60-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-62-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-64-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-65-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-66-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-67-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-53-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-69-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-70-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-71-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-72-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-73-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-74-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-75-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-76-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-77-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-78-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-79-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2920-80-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB