5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c

Analysis

max time kernel
161s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
Size

124KB
MD5

923ed39defa9bc52ad0214d12e512e19
SHA1

630aa65f760175eb89688dd4c2945cb4034f79d0
SHA256

5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c
SHA512

6247a821450f73ebaeecfe9cf26f199017fc61bac638ecf63870a34281468a07c9e1c72c4daf8ea354a42f56fe10ff14fe0f21f62ade4216106e36d6cc1d2177
SSDEEP

1536:OXgcShcuUoTvNPLTVVIJQ95/5l/Cy+YPu4wJ0D:lUoBPLJVIJQT2RMuVJ0D

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\scssrr.exe"	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\scssrr.exe	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
File opened for modification	C:\Windows\scssrr.exe	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4696	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
4544	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81
PID 1920 wrote to memory of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81
PID 1920 wrote to memory of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81
PID 1920 wrote to memory of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81
PID 1920 wrote to memory of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81
PID 1920 wrote to memory of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81
PID 1920 wrote to memory of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81
PID 1920 wrote to memory of 4544	1920	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	81
PID 4544 wrote to memory of 3080	4544	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	82
PID 4544 wrote to memory of 3080	4544	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	82
PID 4544 wrote to memory of 3080	4544	5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe	82
PID 3080 wrote to memory of 4696	3080	cmd.exe	84
PID 3080 wrote to memory of 4696	3080	cmd.exe	84
PID 3080 wrote to memory of 4696	3080	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
"C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
  "C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4544-135-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4544-141-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4544-142-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads