1889bdec2ab0bf7ed1b38ba33ad4415671bc564dc87fcd27ed5765f9285ca011

Analysis

max time kernel
91s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2022 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TeleportUltraPortable/App/Teleport Ultra/ultra.exe
Size

1.1MB
MD5

2676ee7742d32fe0f7cba6e31a948c02
SHA1

439083c1912b310c129711c8516b4726ca620a35
SHA256

db6ff4b9f66141de70472d7f63f7ca331d9deb9bc4d8a98c99a56be257c1acd5
SHA512

bbbe1c12032d289ba825721d9c65829eef9c2ac9c6ac0c2652e238371b39455447bbf14a9de4cbfe3693f16caf5a84518dab57189344dd3baed62a8f1893aff3
SSDEEP

12288:5shF/1eBGwnxZed2GavAS+m4KXcj2JezY26Pr+cof4IIUJMiS6B:5s7/+GGqsx4S+m4Ky2AcucQ0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

ultra.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\MenuExt\Add to &Teleport	ultra.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Add to &Teleport\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeleportUltraPortable\\App\\Teleport Ultra\\teleport.htm"	ultra.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Add to &Teleport\Contexts = ff000000	ultra.exe

Modifies registry class 10 IoCs

Processes:

ultra.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tpu\ = "ultra.Document"	ultra.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Once\Twice = "1664968516"	ultra.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ultra.Document\shell\open	ultra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ultra.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TELEPO~1\\App\\TELEPO~1\\ultra.exe \"%1\""	ultra.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ultra.Document\shell\open\command	ultra.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ultra.Document\shell	ultra.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tpu	ultra.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Once	ultra.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ultra.Document	ultra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ultra.Document\ = "Teleport Ultra Project"	ultra.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ultra.exe

pid process

1436 ultra.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ultra.exe

pid process

1436 ultra.exe
1436 ultra.exe

pid	process
1436	ultra.exe

pid	process
1436	ultra.exe
1436	ultra.exe

C:\Users\Admin\AppData\Local\Temp\TeleportUltraPortable\App\Teleport Ultra\ultra.exe
"C:\Users\Admin\AppData\Local\Temp\TeleportUltraPortable\App\Teleport Ultra\ultra.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads