a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250

Analysis

max time kernel
202s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe
Size

469KB
MD5

36b93b280d17dec60af247b71db2ec8a
SHA1

689b8d50ab54d5e81ffd3422863c0df20aee721c
SHA256

a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250
SHA512

4e38e1ce8d04912dd40c96dc7d1d28f58ef96e2a47b11e6365027c81e6dec7376f979b05369988d945b500c4315337c1b50bfd4a5ad6cff387976a600237a6a8
SSDEEP

6144:XG377xS2Vp2CeiorXdwTBgWx46jCdJ9/BrU8TNK/bLIxI53FpcCJJvHK:Wr7xS2Vp6RwTyCbjU/BXKbLBbJJvHK

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

Loads dropped DLL 4 IoCs

Processes:

a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

pid	process
4808	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe
4808	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe
4808	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe
4808	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4808	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe
Token: SeBackupPrivilege	2308	vssvc.exe
Token: SeRestorePrivilege	2308	vssvc.exe
Token: SeAuditPrivilege	2308	vssvc.exe
Token: SeDebugPrivilege	4808	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

pid	process
4808	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe
4808	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe

C:\Users\Admin\AppData\Local\Temp\a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe
"C:\Users\Admin\AppData\Local\Temp\a0994e9a9eed1ff9a8323a47ec8eadd45fca88e098d5cb74a40174afea1f6250.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cmsetac.dll

Filesize
33KB

MD5
d83cd68d5f7d261fcea09e7227b09be9

SHA1
9c3b7feb02e144589898e8fefc55972951633eb2

SHA256
9f35dd896b0ef8365545fb03cbe5b29460bb541a0aa395965f11895e74174d5c

SHA512
18a74ce7af84b247d92520f5a7040cec326597adb566e259845460bb1690cdde39b0bfc99362c72fa3d28054e74ead42309f0aac7b443afc43062d77c585789a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmsetac.dll

Filesize
33KB

MD5
d83cd68d5f7d261fcea09e7227b09be9

SHA1
9c3b7feb02e144589898e8fefc55972951633eb2

SHA256
9f35dd896b0ef8365545fb03cbe5b29460bb541a0aa395965f11895e74174d5c

SHA512
18a74ce7af84b247d92520f5a7040cec326597adb566e259845460bb1690cdde39b0bfc99362c72fa3d28054e74ead42309f0aac7b443afc43062d77c585789a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/4808-136-0x00000000028E0000-0x00000000028EE000-memory.dmp

Filesize
56KB

Download