a93b48b98f7fcfcc05240187ef098cdb33b8905cebb50386f56a68f5cc08edc7

General

Target

sample.exe
Size

158KB
MD5

56f67d720e83f2cff38f2ea1d9c8f9ff
SHA1

9c9cd7cd4fef7452eed6c4aba14ead4c389a8d78
SHA256

5b9fee8a999bd50608b7204a499770f8070bec7af20b3607af29ff3ed768639c
SHA512

527623d086597f54691e624a6c91fbe86958a78738c507b9c0097337262bb72a728a75f828dd173d2b9ea7861c5968232dc7e5d36a83d4ee3d7b5bbf42a79e3f

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Admin.exe"	sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Shockwave Flash = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sample.exe"	sample.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

1444 reg.exe
1600 reg.exe
1644 reg.exe

pid	process
1444	reg.exe
1600	reg.exe
1644	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sample.exe

pid	process
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe
1048	sample.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

sample.exe

description pid process

Token: SeDebugPrivilege 1048 sample.exe

description	pid	process
Token: SeDebugPrivilege	1048	sample.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

sample.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1048 wrote to memory of 1964	1048	sample.exe	cmd.exe
PID 1048 wrote to memory of 1964	1048	sample.exe	cmd.exe
PID 1048 wrote to memory of 1964	1048	sample.exe	cmd.exe
PID 1048 wrote to memory of 1284	1048	sample.exe	cmd.exe
PID 1048 wrote to memory of 1284	1048	sample.exe	cmd.exe
PID 1048 wrote to memory of 1284	1048	sample.exe	cmd.exe
PID 1048 wrote to memory of 1728	1048	sample.exe	cmd.exe
PID 1048 wrote to memory of 1728	1048	sample.exe	cmd.exe
PID 1048 wrote to memory of 1728	1048	sample.exe	cmd.exe
PID 1964 wrote to memory of 1444	1964	cmd.exe	reg.exe
PID 1964 wrote to memory of 1444	1964	cmd.exe	reg.exe
PID 1964 wrote to memory of 1444	1964	cmd.exe	reg.exe
PID 1728 wrote to memory of 1644	1728	cmd.exe	reg.exe
PID 1728 wrote to memory of 1644	1728	cmd.exe	reg.exe
PID 1728 wrote to memory of 1644	1728	cmd.exe	reg.exe
PID 1284 wrote to memory of 1600	1284	cmd.exe	reg.exe
PID 1284 wrote to memory of 1600	1284	cmd.exe	reg.exe
PID 1284 wrote to memory of 1600	1284	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\system32\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:1444

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm / v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\system32\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm / v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:1600

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\system32\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:1644

C:\Users\Admin\Desktop\Admin.exe
"C:\Users\Admin\Desktop\Admin.exe"
1⤵
PID:828

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
2⤵
PID:1372

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm / v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
2⤵
PID:1860

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
PID:1712

C:\Users\Admin\Desktop\Admin.exe
"C:\Users\Admin\Desktop\Admin.exe"
1⤵
PID:884

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
PID:1576

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm / v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
2⤵
PID:672

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
2⤵
PID:528

C:\Users\Admin\Desktop\Admin.exe
"C:\Users\Admin\Desktop\Admin.exe"
1⤵
PID:1712

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
PID:2024

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Systemm / v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
2⤵
PID:1824

C:\Windows\system32\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
2⤵
PID:1228

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Admin.exe
MD5
56f67d720e83f2cff38f2ea1d9c8f9ff

SHA1
9c9cd7cd4fef7452eed6c4aba14ead4c389a8d78

SHA256
5b9fee8a999bd50608b7204a499770f8070bec7af20b3607af29ff3ed768639c

SHA512
527623d086597f54691e624a6c91fbe86958a78738c507b9c0097337262bb72a728a75f828dd173d2b9ea7861c5968232dc7e5d36a83d4ee3d7b5bbf42a79e3f

Download Submit
C:\Users\Admin\Desktop\Admin.exe
MD5
56f67d720e83f2cff38f2ea1d9c8f9ff

SHA1
9c9cd7cd4fef7452eed6c4aba14ead4c389a8d78

SHA256
5b9fee8a999bd50608b7204a499770f8070bec7af20b3607af29ff3ed768639c

SHA512
527623d086597f54691e624a6c91fbe86958a78738c507b9c0097337262bb72a728a75f828dd173d2b9ea7861c5968232dc7e5d36a83d4ee3d7b5bbf42a79e3f

Download Submit
C:\Users\Admin\Desktop\Admin.exe
MD5
56f67d720e83f2cff38f2ea1d9c8f9ff

SHA1
9c9cd7cd4fef7452eed6c4aba14ead4c389a8d78

SHA256
5b9fee8a999bd50608b7204a499770f8070bec7af20b3607af29ff3ed768639c

SHA512
527623d086597f54691e624a6c91fbe86958a78738c507b9c0097337262bb72a728a75f828dd173d2b9ea7861c5968232dc7e5d36a83d4ee3d7b5bbf42a79e3f

Download Submit
C:\Users\Admin\Desktop\Admin.exe
MD5
56f67d720e83f2cff38f2ea1d9c8f9ff

SHA1
9c9cd7cd4fef7452eed6c4aba14ead4c389a8d78

SHA256
5b9fee8a999bd50608b7204a499770f8070bec7af20b3607af29ff3ed768639c

SHA512
527623d086597f54691e624a6c91fbe86958a78738c507b9c0097337262bb72a728a75f828dd173d2b9ea7861c5968232dc7e5d36a83d4ee3d7b5bbf42a79e3f

Download Submit
memory/528-82-0x0000000000000000-mapping.dmp

Download
memory/672-83-0x0000000000000000-mapping.dmp

Download
memory/828-77-0x000000001B040000-0x000000001B042000-memory.dmp

Filesize
8KB

Download
memory/828-72-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/828-78-0x000000001B046000-0x000000001B065000-memory.dmp

Filesize
124KB

Download
memory/884-86-0x000000001B206000-0x000000001B225000-memory.dmp

Filesize
124KB

Download
memory/884-85-0x000000001B200000-0x000000001B202000-memory.dmp

Filesize
8KB

Download
memory/1048-66-0x000000001B216000-0x000000001B235000-memory.dmp

Filesize
124KB

Download
memory/1048-60-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/1048-62-0x000000001B210000-0x000000001B212000-memory.dmp

Filesize
8KB

Download
memory/1228-92-0x0000000000000000-mapping.dmp

Download
memory/1284-64-0x0000000000000000-mapping.dmp

Download
memory/1372-74-0x0000000000000000-mapping.dmp

Download
memory/1444-67-0x0000000000000000-mapping.dmp

Download
memory/1576-84-0x0000000000000000-mapping.dmp

Download
memory/1600-69-0x0000000000000000-mapping.dmp

Download
memory/1644-68-0x0000000000000000-mapping.dmp

Download
memory/1712-76-0x0000000000000000-mapping.dmp

Download
memory/1712-91-0x000000001B2C6000-0x000000001B2E5000-memory.dmp

Filesize
124KB

Download
memory/1712-90-0x000000001B2C0000-0x000000001B2C2000-memory.dmp

Filesize
8KB

Download
memory/1728-65-0x0000000000000000-mapping.dmp

Download
memory/1824-93-0x0000000000000000-mapping.dmp

Download
memory/1860-75-0x0000000000000000-mapping.dmp

Download
memory/1964-63-0x0000000000000000-mapping.dmp

Download
memory/2024-94-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads