426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139

General

Target

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
Size

492KB
MD5

5073ed321d5785152d161af3a3764d8f
SHA1

213d24b9017a309f0f3a25023c0299e4d44ab0bb
SHA256

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139
SHA512

64bd8aba777de85ad5488cc5b0ae412a38c36b811909318557659a4f9e7910247b6aab13d33da8e55a213780cea807071cb4fb8076645b2dcc21105b928ab8bb
SSDEEP

768:u4mLYD9j5l0SzffhROPMDpTrCS6fvImSrVKRt3TGgJHWf5u9d3vo+VWQs7xO2inh:dmD7tej+v

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	pid	process	target process
PID 1316 set thread context of 260	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description pid process

Token: SeBackupPrivilege 1316 426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

pid process

1316 426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	pid	process
Token: SeBackupPrivilege	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

pid	process
1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	pid	process	target process
PID 1316 wrote to memory of 260	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
PID 1316 wrote to memory of 260	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
PID 1316 wrote to memory of 260	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
PID 1316 wrote to memory of 260	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
PID 1316 wrote to memory of 260	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
PID 1316 wrote to memory of 260	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
PID 1316 wrote to memory of 260	1316	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe

C:\Users\Admin\AppData\Local\Temp\426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
"C:\Users\Admin\AppData\Local\Temp\426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1316

C:\Users\Admin\AppData\Local\Temp\426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
C:\Users\Admin\AppData\Local\Temp\426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139.exe
2⤵
PID:260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-134-0x0000000000000000-mapping.dmp

Download
memory/260-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/260-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/260-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads