afe94e4b048e0030099c67010dce2fd79461eb050dcf1a441b3d5486ce8821ca

General

Target

tasks_200.vir.exe
Size

327KB
MD5

804bedbfe6ecd3d1e07b2b19ba6db60c
SHA1

9d37abde24f9781638bc7de50b484389804bd728
SHA256

afe94e4b048e0030099c67010dce2fd79461eb050dcf1a441b3d5486ce8821ca
SHA512

eb45fa0e60ca37466493333d9cfaf8c2502ef9c120000e9e91510775fffb16b76cafa1d649887f5d41a65df966198bb805be44307586e46653a8f31df3713b3f

Score

8^/10

persistence evasion trojan

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

uvxopex.exe

pid process

1096 uvxopex.exe
1096 uvxopex.exe
JavaScript code in executable 1 IoCs

Processes:

yara_rule

js
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
Drops file in Windows directory 1 IoCs

Processes:

tasks_200.vir.exe

description ioc process

File created C:\Windows\Tasks\Security Center Update - 4101946163.job tasks_200.vir.exe
Executes dropped EXE 3 IoCs

Processes:

winsec32.exeuvxopex.exeuvxopex.exe

pid process

1292 winsec32.exe
1552 uvxopex.exe
1096 uvxopex.exe
Loads dropped DLL 1 IoCs

Processes:

tasks_200.vir.exe

pid process

880 tasks_200.vir.exe

pid	process
1096	uvxopex.exe
1096	uvxopex.exe

yara_rule
js

pid	process
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE

description	ioc	process
File created	C:\Windows\Tasks\Security Center Update - 4101946163.job	tasks_200.vir.exe

pid	process
1292	winsec32.exe
1552	uvxopex.exe
1096	uvxopex.exe

pid	process
880	tasks_200.vir.exe

Suspicious behavior: EnumeratesProcesses 83 IoCs

Processes:

uvxopex.exeuvxopex.exe

pid	process
1552	uvxopex.exe
1552	uvxopex.exe
1552	uvxopex.exe
1552	uvxopex.exe
1552	uvxopex.exe
1552	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe
1096	uvxopex.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1092 cmd.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE

pid	process
1092	cmd.exe

pid	process
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE

Drops file in System32 directory 2 IoCs

Processes:

tasks_200.vir.exe

description	ioc	process
File created	C:\Windows\SysWOW64\winsec32.exe	tasks_200.vir.exe
File opened for modification	C:\Windows\SysWOW64\winsec32.exe	tasks_200.vir.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

uvxopex.exewinsec32.exeExplorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Odrewedoyfe = "C:\\Users\\Admin\\AppData\\Roaming\\Ehroxaih\\uvxopex.exe"	uvxopex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winsec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Odrewedoyfe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ehroxaih\\uvxopex.exe\""	winsec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Odrewedoyfe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ehroxaih\\uvxopex.exe\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	uvxopex.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Odrewedoyfe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ehroxaih\\uvxopex.exe\""	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Odrewedoyfe = "C:\\Users\\Admin\\AppData\\Roaming\\Ehroxaih\\uvxopex.exe"	uvxopex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	uvxopex.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

uvxopex.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main uvxopex.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	uvxopex.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

uvxopex.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	uvxopex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	uvxopex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	uvxopex.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

tasks_200.vir.exeuvxopex.exeuvxopex.exe

description	pid	process	target process
PID 880 wrote to memory of 1552	880	tasks_200.vir.exe	uvxopex.exe
PID 880 wrote to memory of 1552	880	tasks_200.vir.exe	uvxopex.exe
PID 880 wrote to memory of 1552	880	tasks_200.vir.exe	uvxopex.exe
PID 880 wrote to memory of 1552	880	tasks_200.vir.exe	uvxopex.exe
PID 1552 wrote to memory of 1296	1552	uvxopex.exe	Explorer.EXE
PID 1552 wrote to memory of 1296	1552	uvxopex.exe	Explorer.EXE
PID 1552 wrote to memory of 1296	1552	uvxopex.exe	Explorer.EXE
PID 1552 wrote to memory of 1296	1552	uvxopex.exe	Explorer.EXE
PID 1552 wrote to memory of 1296	1552	uvxopex.exe	Explorer.EXE
PID 1552 wrote to memory of 1296	1552	uvxopex.exe	Explorer.EXE
PID 1552 wrote to memory of 1296	1552	uvxopex.exe	Explorer.EXE
PID 1552 wrote to memory of 1096	1552	uvxopex.exe	uvxopex.exe
PID 1552 wrote to memory of 1096	1552	uvxopex.exe	uvxopex.exe
PID 1552 wrote to memory of 1096	1552	uvxopex.exe	uvxopex.exe
PID 1552 wrote to memory of 1096	1552	uvxopex.exe	uvxopex.exe
PID 880 wrote to memory of 1092	880	tasks_200.vir.exe	cmd.exe
PID 880 wrote to memory of 1092	880	tasks_200.vir.exe	cmd.exe
PID 880 wrote to memory of 1092	880	tasks_200.vir.exe	cmd.exe
PID 880 wrote to memory of 1092	880	tasks_200.vir.exe	cmd.exe
PID 1096 wrote to memory of 1240	1096	uvxopex.exe	ctfmon.exe
PID 1096 wrote to memory of 1240	1096	uvxopex.exe	ctfmon.exe
PID 1096 wrote to memory of 1240	1096	uvxopex.exe	ctfmon.exe
PID 1096 wrote to memory of 1240	1096	uvxopex.exe	ctfmon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Explorer.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
- Adds Run key to start application
- Checks whether UAC is enabled
PID:1296

C:\Users\Admin\AppData\Local\Temp\tasks_200.vir.exe
"C:\Users\Admin\AppData\Local\Temp\tasks_200.vir.exe"
2⤵
- Drops file in Windows directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:880

C:\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe
"C:\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1552

C:\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe
"C:\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe" -child
4⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
5⤵
PID:1240

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5894a07f.bat"
3⤵
- Deletes itself
PID:1092

C:\Windows\SysWOW64\winsec32.exe
"C:\Windows\SysWOW64\winsec32.exe" -service "C:\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5894a07f.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\126KOADW.txt

Download Submit
C:\Windows\SysWOW64\winsec32.exe

Download Submit
C:\Windows\SysWOW64\winsec32.exe

Download Submit
\Users\Admin\AppData\Roaming\Ehroxaih\uvxopex.exe

Download Submit
memory/1092-14-0x0000000000000000-mapping.dmp

Download
memory/1096-12-0x0000000000000000-mapping.dmp

Download
memory/1240-16-0x0000000000000000-mapping.dmp

Download
memory/1296-6-0x0000000006080000-0x0000000006081000-memory.dmp

Filesize
4KB

Download
memory/1552-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads