3da8fa82f62835bcf35377d5376e002aeccff9228bd65650bbb95a6a222808af

General

Target

new po.exe
Size

3.7MB
MD5

db7c5591589c1bc7be457ad87d8fff0e
SHA1

065fbdf5b64cc5c9cf4f983f229a89d7252f62a6
SHA256

3da8fa82f62835bcf35377d5376e002aeccff9228bd65650bbb95a6a222808af
SHA512

17d5604178dc9789e107a17d07cc43132676d51ff29205f802f59a2b2c0d09dc72b87099be6d2ec1975999ee5ff88ffda9d168d44ad429745999a42e3758d2dc

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

new po.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	new po.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	new po.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

new po.exe

description pid process target process

PID 292 set thread context of 1740 292 new po.exe new po.exe

description	pid	process	target process
PID 292 set thread context of 1740	292	new po.exe	new po.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

new po.exe

description	pid	process	target process
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe
PID 292 wrote to memory of 1740	292	new po.exe	new po.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

new po.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	new po.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	new po.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	new po.exe

C:\Users\Admin\AppData\Local\Temp\new po.exe
"C:\Users\Admin\AppData\Local\Temp\new po.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:292

C:\Users\Admin\AppData\Local\Temp\new po.exe
"{path}"
2⤵
- Checks whether UAC is enabled
- System policy modification
PID:1740

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/292-3-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/292-5-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/292-6-0x00000000004F0000-0x00000000004FE000-memory.dmp

Filesize
56KB

Download
memory/292-7-0x0000000009C00000-0x0000000009F99000-memory.dmp

Filesize
3.6MB

Download
memory/1740-8-0x0000000000400000-0x00000000007B5000-memory.dmp

Filesize
3.7MB

Download
memory/1740-9-0x0000000000688844-mapping.dmp

Download
memory/1740-10-0x0000000076861000-0x0000000076863000-memory.dmp

Filesize
8KB

Download
memory/1740-11-0x0000000000400000-0x00000000007B5000-memory.dmp

Filesize
3.7MB

Download
memory/1740-12-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads