60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0

General

Target

60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exe
Size

724KB
MD5

c147ba02443132bcacfc2ba4ffc9af3a
SHA1

8dbde866273a66ebe9670d6fb6f6a7eaa0405d62
SHA256

60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0
SHA512

a41e1ccb47e22269dbd91d6a0637280a62031f915192015cc8a44836b11444000315d88f4197f861a7d6a6c064295202dda05cdb38b83fe01160ee8271d1f116
SSDEEP

12288:aNIQAPGsAqY9IMVYd38sJdpQHlGlY8KfT4F4+CpENqTScb++ycb/l9TXQCrv:HPGSY91VwNJcFMqTePNqT7ZycbdVXlrv

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

Charles.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Charles.exe
Executes dropped EXE 1 IoCs

Processes:

Charles.exe

pid process

1876 Charles.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Charles.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Charles.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	Charles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Charles = "\"C:\\Users\\Admin\\AppData\\Roaming\\Charles.exe\""	Charles.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Charles.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Charles.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Charles.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Charles.exe

pid	process
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe
1876	Charles.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exeCharles.exe

pid	process
3672	60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exe
3672	60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exe
1876	Charles.exe
1876	Charles.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exeCharles.exe

description	pid	process	target process
PID 3672 wrote to memory of 1876	3672	60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exe	Charles.exe
PID 3672 wrote to memory of 1876	3672	60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exe	Charles.exe
PID 3672 wrote to memory of 1876	3672	60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exe	Charles.exe
PID 1876 wrote to memory of 5108	1876	Charles.exe	schtasks.exe
PID 1876 wrote to memory of 5108	1876	Charles.exe	schtasks.exe
PID 1876 wrote to memory of 5108	1876	Charles.exe	schtasks.exe
PID 1876 wrote to memory of 4712	1876	Charles.exe	schtasks.exe
PID 1876 wrote to memory of 4712	1876	Charles.exe	schtasks.exe
PID 1876 wrote to memory of 4712	1876	Charles.exe	schtasks.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

Charles.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Charles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Charles.exe

C:\Users\Admin\AppData\Local\Temp\60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exe
"C:\Users\Admin\AppData\Local\Temp\60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Roaming\Charles.exe
C:\Users\Admin\AppData\Roaming\Charles.exe
2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1876

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /TN GoogleUpdateTaskMachineCore /F
3⤵
PID:5108

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /TN GoogleUpdateTaskMachineUA /F
3⤵
PID:4712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Charles.exe
Filesize
724KB

MD5
c147ba02443132bcacfc2ba4ffc9af3a

SHA1
8dbde866273a66ebe9670d6fb6f6a7eaa0405d62

SHA256
60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0

SHA512
a41e1ccb47e22269dbd91d6a0637280a62031f915192015cc8a44836b11444000315d88f4197f861a7d6a6c064295202dda05cdb38b83fe01160ee8271d1f116

Download Submit
C:\Users\Admin\AppData\Roaming\Charles.exe
Filesize
724KB

MD5
c147ba02443132bcacfc2ba4ffc9af3a

SHA1
8dbde866273a66ebe9670d6fb6f6a7eaa0405d62

SHA256
60111203bea5231ae089cde35cb1da64af8df3a57b9893f0c6b3f1517d6b1da0

SHA512
a41e1ccb47e22269dbd91d6a0637280a62031f915192015cc8a44836b11444000315d88f4197f861a7d6a6c064295202dda05cdb38b83fe01160ee8271d1f116

Download Submit
memory/1876-132-0x0000000000000000-mapping.dmp

Download
memory/4712-136-0x0000000000000000-mapping.dmp

Download
memory/5108-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads