422c3df285fbd86303eb0448583550d7584a330095c60ada442cb1beb97cf670

General

Target

PPPPPPPPPPPPPPP.exe
Size

60KB
MD5

94406fab156e3ed962899d6a473683c5
SHA1

08ef787ee7264e87abdb1933102ae94a8056a587
SHA256

422c3df285fbd86303eb0448583550d7584a330095c60ada442cb1beb97cf670
SHA512

c5ae7834d4722e7ca702258203f718a00403d76455cfe5e75743f116a4bd0c37ec33dcf89c6f779e8247519ae65e12523fe6bc7aede28a360fbf4687e1b2bba2
SSDEEP

768:DlH3iOcmCQkUF7Q3n8Q37RGC5fBPcKX0hT6tUTNtg3333rIX72s2H3eI2:DlHyOcmCD27c8oN5JPcQQhg3333rdX9

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

PPPPPPPPPPPPPPP.exePPPPPPPPPPPPPPP.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	PPPPPPPPPPPPPPP.exe

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

k4.exek4.exek4.exek4.exe

pid process

1264 k4.exe
3312 k4.exe
1264 k4.exe
3312 k4.exe

pid	process
1264	k4.exe
3312	k4.exe
1264	k4.exe
3312	k4.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

PPPPPPPPPPPPPPP.exePPPPPPPPPPPPPPP.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	PPPPPPPPPPPPPPP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

PPPPPPPPPPPPPPP.exePPPPPPPPPPPPPPP.exe

pid process

4984 PPPPPPPPPPPPPPP.exe
4984 PPPPPPPPPPPPPPP.exe

pid	process
4984	PPPPPPPPPPPPPPP.exe
4984	PPPPPPPPPPPPPPP.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

PPPPPPPPPPPPPPP.exePPPPPPPPPPPPPPP.exe

description	pid	process	target process
PID 4984 wrote to memory of 1264	4984	PPPPPPPPPPPPPPP.exe	k4.exe
PID 4984 wrote to memory of 1264	4984	PPPPPPPPPPPPPPP.exe	k4.exe
PID 4984 wrote to memory of 3312	4984	PPPPPPPPPPPPPPP.exe	k4.exe
PID 4984 wrote to memory of 3312	4984	PPPPPPPPPPPPPPP.exe	k4.exe
PID 4984 wrote to memory of 3052	4984	PPPPPPPPPPPPPPP.exe	cmd.exe
PID 4984 wrote to memory of 3052	4984	PPPPPPPPPPPPPPP.exe	cmd.exe
PID 4984 wrote to memory of 3052	4984	PPPPPPPPPPPPPPP.exe	cmd.exe
PID 4984 wrote to memory of 1264	4984	PPPPPPPPPPPPPPP.exe	k4.exe
PID 4984 wrote to memory of 1264	4984	PPPPPPPPPPPPPPP.exe	k4.exe
PID 4984 wrote to memory of 3312	4984	PPPPPPPPPPPPPPP.exe	k4.exe
PID 4984 wrote to memory of 3312	4984	PPPPPPPPPPPPPPP.exe	k4.exe
PID 4984 wrote to memory of 3052	4984	PPPPPPPPPPPPPPP.exe	cmd.exe
PID 4984 wrote to memory of 3052	4984	PPPPPPPPPPPPPPP.exe	cmd.exe
PID 4984 wrote to memory of 3052	4984	PPPPPPPPPPPPPPP.exe	cmd.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

PPPPPPPPPPPPPPP.exePPPPPPPPPPPPPPP.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	PPPPPPPPPPPPPPP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	PPPPPPPPPPPPPPP.exe

C:\Users\Admin\AppData\Local\Temp\PPPPPPPPPPPPPPP.exe
"C:\Users\Admin\AppData\Local\Temp\PPPPPPPPPPPPPPP.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4984

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe
2⤵
- Executes dropped EXE
PID:1264

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe /D
2⤵
- Executes dropped EXE
PID:3312

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /t /im k4.exe
2⤵
PID:3052

C:\Users\Admin\AppData\Local\Temp\PPPPPPPPPPPPPPP.exe
"C:\Users\Admin\AppData\Local\Temp\PPPPPPPPPPPPPPP.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4984

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe
2⤵
- Executes dropped EXE
PID:1264

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe /D
2⤵
- Executes dropped EXE
PID:3312

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /t /im k4.exe
2⤵
PID:3052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
memory/1264-132-0x0000000000000000-mapping.dmp

Download
memory/1264-132-0x0000000000000000-mapping.dmp

Download
memory/3052-137-0x0000000000000000-mapping.dmp

Download
memory/3052-137-0x0000000000000000-mapping.dmp

Download
memory/3312-135-0x0000000000000000-mapping.dmp

Download
memory/3312-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads