54ba16ee475e85dc51410512b03a202b3e9baf2654ac977d9ef8c363c7c83863

Analysis

max time kernel
1s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 13:30

Target

54ba16ee475e85dc51410512b03a202b3e9baf2654ac977d9ef8c363c7c83863.exe
Size

95KB
MD5

4f99bc4dddf896fe16e693c675ce8c00
SHA1

0f69750a0c6f133b00d8b22c9ef4d1a985f6d1fb
SHA256

54ba16ee475e85dc51410512b03a202b3e9baf2654ac977d9ef8c363c7c83863
SHA512

e9c0534a8ad540cc11d5ce99a82ff39a2c3db4606a314fc1bc0e22b6c1288839049eb03e26eadca7a9fe6b9ae7979eda557af9912a577c81af00e738bba67a0c
SSDEEP

1536:rd8TICuBckF9o8qrgLNmF2jbxWGq6emF2jbxWGq6n:rd81kDo8U2NS2jbxWGqrS2jbxWGq0

Score

6^/10

evasion trojan

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	54ba16ee475e85dc51410512b03a202b3e9baf2654ac977d9ef8c363c7c83863.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 648	5004	54ba16ee475e85dc51410512b03a202b3e9baf2654ac977d9ef8c363c7c83863.exe	83
PID 5004 wrote to memory of 648	5004	54ba16ee475e85dc51410512b03a202b3e9baf2654ac977d9ef8c363c7c83863.exe	83
PID 5004 wrote to memory of 648	5004	54ba16ee475e85dc51410512b03a202b3e9baf2654ac977d9ef8c363c7c83863.exe	83

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact