4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6

General

Target

4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe
Size

118KB
MD5

b2a783306993be4df58e0bdf5f40f5e4
SHA1

ff0daa080adc166de359d40b387711910ee277a8
SHA256

4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6
SHA512

522f6e672f69f6e328b9152b8b0caea4943a3936eed1accdb21f7cccd06a990f0b79b85853cd835dd1607aaf9156a7efa925e19fa37043dc4c350a8cd53f7208

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Drops startup file 2 IoCs

Processes:

4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.exe	4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.exe	4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1712 reg.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe

pid process

800 4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe

description pid process

Token: SeDebugPrivilege 800 4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe

pid	process
1712	reg.exe

pid	process
800	4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe

description	pid	process
Token: SeDebugPrivilege	800	4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.execmd.exe

description	pid	process	target process
PID 800 wrote to memory of 1208	800	4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe	cmd.exe
PID 800 wrote to memory of 1208	800	4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe	cmd.exe
PID 800 wrote to memory of 1208	800	4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe	cmd.exe
PID 800 wrote to memory of 1208	800	4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe	cmd.exe
PID 1208 wrote to memory of 1712	1208	cmd.exe	reg.exe
PID 1208 wrote to memory of 1712	1208	cmd.exe	reg.exe
PID 1208 wrote to memory of 1712	1208	cmd.exe	reg.exe
PID 1208 wrote to memory of 1712	1208	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe
"C:\Users\Admin\AppData\Local\Temp\4342092be0d494e067341332e3831f9f8c6051286e3adec975e88cd3d524beb6.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:1712

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-54-0x0000000001290000-0x00000000012B4000-memory.dmp

Filesize
144KB

Download
memory/800-55-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/1208-56-0x0000000000000000-mapping.dmp

Download
memory/1712-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing