cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a

General

Target

cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
Size

152KB
MD5

a2b85a6ffe8860bd14e22239d6790133
SHA1

17d4bb76001f745d034e255264427792267f4ca9
SHA256

cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a
SHA512

7faf4f111896a01d20f6c81aca974ad2c28531569b25adaa33ff30c0ba8d1c445146b8a76aec24b7e623f25b994ba3de6d24a61888a76adeb603ddca6825cf6b
SSDEEP

1536:D3wo0rK5iX/3PjPozbSdHjWTMHPf+3AAuOsIdCH/NYJXLhA5Eq26g4SEx857Zp4y:D3wnrK5i371O3jO5i6g4SESBQTqj5

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinSocketA.dll	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
File opened for modification	C:\Windows\SysWOW64\WinSocketA.dll	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
652	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
Token: SeLoadDriverPrivilege	1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4248	1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe	85
PID 1824 wrote to memory of 4248	1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe	85
PID 1824 wrote to memory of 4248	1824	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe	85

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe

C:\Users\Admin\AppData\Local\Temp\cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe
"C:\Users\Admin\AppData\Local\Temp\cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a.exe"
  2⤵
  PID:4248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WinSocketA.dll

Filesize
74KB

MD5
714b43b051b283b47631f20cb5938a07

SHA1
92d68beaeaf77874e2eed2fb9b8ff1fd9c70b030

SHA256
80b624af653caad200d35f753b5a5c37f1258efa2f09b07f8fd1679a5dc670c1

SHA512
7d6e1eeccec576c61dc9411af183cae4799da3851f30ad9cf56f285b5f4d08e98ad3a0c4d8ee201a61c48b400efefc3c019e22a52acd835e87924dc25a609c55

Download Submit
memory/1824-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1824-135-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4248-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads