947ae5e40254363d6bdf8007a5aaffe43a8fc43c5ae4608192c9ea248459baca

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bea95bebec95e0893a845f62e832d7cf.exe
Size

100KB
MD5

bea95bebec95e0893a845f62e832d7cf
SHA1

5f1f00e5ec9f2749bd0a9b86d15c16c1060f6325
SHA256

4de43073c112cf665ab5c3c930fedb747c435625c93b3775a4b2da5f7e736733
SHA512

8c29f6535faaccf0a2fbd7f649fc01006ea673b3b12a3e50f97aafa9313ae5371e11be9b545c6a768270abe63fb865c52ba0944730b741186b721c9bf0a08e8a
SSDEEP

1536:6pgpHzb9dZVX9fHMvG0D3XJcMZxshYdgOzLXehOTJHCyScYFwv5SZUsZMegnT8:4gXdZt9P6D3XJcMXhWaJi7maRgo

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

mcwsazmq.exemcwsazmq.exe

pid process

3992 mcwsazmq.exe
3652 mcwsazmq.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral2/memory/3652-15-0x0000000072E00000-0x0000000072E0B000-memory.dmp upx

pid	process
3992	mcwsazmq.exe
3652	mcwsazmq.exe

resource	yara_rule
behavioral2/memory/3652-15-0x0000000072E00000-0x0000000072E0B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mcwsazmq.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{3398CC3F-7169-82F8-80F6-99CF04D9BC58} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mcwsazmq.exe"	mcwsazmq.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

mcwsazmq.exe

description pid process target process

PID 3992 set thread context of 3652 3992 mcwsazmq.exe mcwsazmq.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 3992 set thread context of 3652	3992	mcwsazmq.exe	mcwsazmq.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0B9279FE-3754-11EF-B9F7-D6C6679D10A6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3785647210"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f2f6f260cbda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000403add65864f884c8e6a6ea933601ba800000000020000000000106600000001000020000000d04871d172d0df8b0192a127073b8caa7dbb87efc3a806468f4c485be1af9888000000000e8000000002000020000000f41a5ef05e0b709c66803210f824f24c8d7cbbccba0c8a5cdff300f7d7532b97200000009effdfcb6da633270bdc1a3de201f655e5743b556da1e077cd370e702f6a57e8400000009925c5349837befe93903c06a62caf3181cec92567d7886cce8d4939a3493c0ad49ea9da852619096e3bde260277a9f970d6f22bb8748596b29e011ea4103744	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b476f460cbda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3894085452"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3785647210"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116128"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000403add65864f884c8e6a6ea933601ba8000000000200000000001066000000010000200000000cd7b66bdd33bebcf769aecd26f6ed969e2fa1fbf02c3a0d4e3478405c11f53d000000000e8000000002000020000000b5edf06fb574377ced31f26b415e194748c885fa915fb50be19e9063e3390b2c20000000ed21321967cd5b7576920b57491640220fe0d68d108218d4c18759e28d1ce03940000000780bda2ec21c87d3312ce99f2af28e1b7cc7c13b7fa4c38db39fca1184208eca655dadf16b85f8db2e5eaed3d7784eff9592ef0597bbc2671d013d445b2e9927	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116128"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116128"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426566952"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

mcwsazmq.exe

pid process

3652 mcwsazmq.exe
3652 mcwsazmq.exe
3652 mcwsazmq.exe
3652 mcwsazmq.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2900 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

mcwsazmq.exeiexplore.exeIEXPLORE.EXE

pid process

3992 mcwsazmq.exe
2900 iexplore.exe
2900 iexplore.exe
2044 IEXPLORE.EXE
2044 IEXPLORE.EXE
2044 IEXPLORE.EXE
2044 IEXPLORE.EXE

pid	process
3652	mcwsazmq.exe
3652	mcwsazmq.exe
3652	mcwsazmq.exe
3652	mcwsazmq.exe

pid	process
2900	iexplore.exe

pid	process
3992	mcwsazmq.exe
2900	iexplore.exe
2900	iexplore.exe
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

bea95bebec95e0893a845f62e832d7cf.exemcwsazmq.exeiexplore.exe

description	pid	process	target process
PID 2332 wrote to memory of 3992	2332	bea95bebec95e0893a845f62e832d7cf.exe	mcwsazmq.exe
PID 2332 wrote to memory of 3992	2332	bea95bebec95e0893a845f62e832d7cf.exe	mcwsazmq.exe
PID 2332 wrote to memory of 3992	2332	bea95bebec95e0893a845f62e832d7cf.exe	mcwsazmq.exe
PID 3992 wrote to memory of 3652	3992	mcwsazmq.exe	mcwsazmq.exe
PID 3992 wrote to memory of 3652	3992	mcwsazmq.exe	mcwsazmq.exe
PID 3992 wrote to memory of 3652	3992	mcwsazmq.exe	mcwsazmq.exe
PID 3992 wrote to memory of 3652	3992	mcwsazmq.exe	mcwsazmq.exe
PID 3992 wrote to memory of 3652	3992	mcwsazmq.exe	mcwsazmq.exe
PID 3992 wrote to memory of 3652	3992	mcwsazmq.exe	mcwsazmq.exe
PID 3992 wrote to memory of 3652	3992	mcwsazmq.exe	mcwsazmq.exe
PID 3992 wrote to memory of 3652	3992	mcwsazmq.exe	mcwsazmq.exe
PID 2900 wrote to memory of 2044	2900	iexplore.exe	IEXPLORE.EXE
PID 2900 wrote to memory of 2044	2900	iexplore.exe	IEXPLORE.EXE
PID 2900 wrote to memory of 2044	2900	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\bea95bebec95e0893a845f62e832d7cf.exe
"C:\Users\Admin\AppData\Local\Temp\bea95bebec95e0893a845f62e832d7cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Users\Admin\AppData\Local\Temp\mcwsazmq.exe
C:\Users\Admin\AppData\Local\Temp\mcwsazmq.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992

C:\Users\Admin\AppData\Local\Temp\mcwsazmq.exe
C:\Users\Admin\AppData\Local\Temp\mcwsazmq.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3652

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:2796

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
4002e8b12817dfbab01588c4f44e6ee3

SHA1
cd4af5e44b05b1af7218bc8b2a002f471c480fa6

SHA256
cc39772f0b25c3383b5f2e37ff9b29bdbc27193366d8d6422a8f0b81801d6ab9

SHA512
b42ef3ac0dddb2563e6c4d5d49042d9da7a5f03718cbcc59d2025b842efd0b64fda490571459fdcfb49acc0b80f15edee68a510598fe60b0ae9151c01c615404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
dac89d0f61a575464346f0340e9d38e4

SHA1
f3bd1b19e31e676afa398a214770c13791a1cdbe

SHA256
d575cb0b2ab9f3c53bf734bfb50c9e979ffbc48795e3f3c7483e0e338ca0855f

SHA512
1ff57eec775bd09425d326c2e8e7229f43b5180f11a52ee1a2ca1897e664a561bfa7757460e63e984d7b065b12b73563f169be5f810a15920d2b7217f935e3d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\mcwsazmq.exe
Filesize
52KB

MD5
0873780720fd754eaf235d73916adb56

SHA1
49144dbbe672b2eb5ad37690889e9fa50e486497

SHA256
c44a22c3498393a89472f0cbc49d65813ce190da040f41b66acd042669652e5f

SHA512
91dd10488f78a4d2bfbca27522e47d2ca346dd5faf6cc3b39421a0d23a573ecb2ecae9e89857e0bbae2f31c6ca8ba84a0c413217bd31fbc915f058fd47444ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.dat
Filesize
54KB

MD5
89014244c43985ce562336ec434795f9

SHA1
8306c161468d7f90c4f3bea74f7d657402873dcc

SHA256
c952718bbecb9506a2ac3069f32b7ed399701f6a279788e001bc14876d4a9ee3

SHA512
76d5574ca271c23a0a3028a116c87f138dfcafec067e70ba79beab0e0b4cf0f43a3943e0600948cc8516af44d80016f478551018a88fab2d4e36c539293a8221

Download Submit
memory/3652-15-0x0000000072E00000-0x0000000072E0B000-memory.dmp

Filesize
44KB

Download
memory/3652-17-0x0000000074420000-0x000000007443C000-memory.dmp

Filesize
112KB

Download
memory/3652-21-0x0000000074420000-0x000000007443C000-memory.dmp

Filesize
112KB

Download
memory/3652-13-0x0000000074420000-0x000000007443C000-memory.dmp

Filesize
112KB

Download
memory/3652-12-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3652-41-0x0000000074420000-0x000000007443C000-memory.dmp

Filesize
112KB

Download
memory/3652-47-0x0000000074420000-0x000000007443C000-memory.dmp

Filesize
112KB

Download
memory/3652-7-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3652-63-0x0000000074420000-0x000000007443C000-memory.dmp

Filesize
112KB

Download
memory/3652-67-0x0000000074420000-0x000000007443C000-memory.dmp

Filesize
112KB

Download