5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c

General

Target

5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
Size

124KB
MD5

923ed39defa9bc52ad0214d12e512e19
SHA1

630aa65f760175eb89688dd4c2945cb4034f79d0
SHA256

5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c
SHA512

6247a821450f73ebaeecfe9cf26f199017fc61bac638ecf63870a34281468a07c9e1c72c4daf8ea354a42f56fe10ff14fe0f21f62ade4216106e36d6cc1d2177
SSDEEP

1536:OXgcShcuUoTvNPLTVVIJQ95/5l/Cy+YPu4wJ0D:lUoBPLJVIJQT2RMuVJ0D

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\scssrr.exe"	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\scssrr.exe	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
File opened for modification	C:\Windows\scssrr.exe	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1060	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
1084	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1168 wrote to memory of 1084	1168	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	27
PID 1084 wrote to memory of 1724	1084	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	28
PID 1084 wrote to memory of 1724	1084	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	28
PID 1084 wrote to memory of 1724	1084	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	28
PID 1084 wrote to memory of 1724	1084	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	28
PID 1724 wrote to memory of 1060	1724	cmd.exe	30
PID 1724 wrote to memory of 1060	1724	cmd.exe	30
PID 1724 wrote to memory of 1060	1724	cmd.exe	30
PID 1724 wrote to memory of 1060	1724	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
"C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
  "C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-56-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1084-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1084-59-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1084-61-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1084-66-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1084-69-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads