868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6

General

Target

868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe
Size

422KB
MD5

0f426b169cf65efe8430595fb1fbbde2
SHA1

f9e4ee4933b2740cc4a1c6d0f6cd40b2e76dd33e
SHA256

868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6
SHA512

870034627fdade85e064380f098eec2c51306eb79f455cf435af4ce3b2719395647fc2ebfbcef610d15dd03ba76c7907971c52a62e16847bd2e29fa068367e72
SSDEEP

12288:+MMpRkh0QECbX/+jondecdiCIwCj0TfDjyApTa9:2kizCz/+geTwCjsDjyApTa

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe
Token: SeDebugPrivilege	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe
Token: SeDebugPrivilege	1732	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1732	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28
PID 1644 wrote to memory of 1732	1644	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe	28

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe

C:\Users\Admin\AppData\Local\Temp\868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe
"C:\Users\Admin\AppData\Local\Temp\868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe"
1⤵
- UAC bypass
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1644
- C:\Users\Admin\AppData\Local\Temp\868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe
  "C:\Users\Admin\AppData\Local\Temp\868bb422aa264b238ef5494ba35d6f43a9885ba762be7937dbf5c541adca52d6.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-70-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/1644-55-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/1644-56-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/1644-57-0x00000000001B5000-0x00000000001C6000-memory.dmp

Filesize
68KB

Download
memory/1644-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1644-71-0x00000000001B5000-0x00000000001C6000-memory.dmp

Filesize
68KB

Download
memory/1732-58-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1732-62-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1732-63-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1732-66-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1732-68-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1732-61-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1732-59-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1732-72-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/1732-73-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads