Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 16:33
Static task
static1
Behavioral task
behavioral1
Sample
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe
Resource
win10v2004-20220812-en
General
-
Target
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe
-
Size
292KB
-
MD5
99c4e136a26726a185b33254800dbbdf
-
SHA1
a1e30ac3e313cd345bc764b944c58c941f21e67e
-
SHA256
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311
-
SHA512
d8ccca69a051df889beff4714a4c168767662e3c3080209dd7b8b2909913e152b5754c1d0c72d76caebd3323f8b6c17e54cd666dd721f19faff1541439f94d4d
-
SSDEEP
3072:ZKT0SCy4QDMT/1BvOeA7WTe7FLljBaPNr7varwVbUZUev2b+:Z/vX/1m37FPkNlTeO
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{485F2867-D07C-A855-8641-1ADFE6AE5FA4} = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\UProof\\TRACERT.EXE" 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exeunlodctr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 unlodctr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString unlodctr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz unlodctr.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
Processes:
unlodctr.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" unlodctr.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
unlodctr.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" unlodctr.exe -
Processes:
unlodctr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main unlodctr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exepid process 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
unlodctr.exeCameraSettingsUIHost.exedescription pid process Token: SeDebugPrivilege 2912 unlodctr.exe Token: SeDebugPrivilege 1784 CameraSettingsUIHost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exeunlodctr.exedescription pid process target process PID 2688 wrote to memory of 2912 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe unlodctr.exe PID 2688 wrote to memory of 2912 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe unlodctr.exe PID 2688 wrote to memory of 2912 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe unlodctr.exe PID 2688 wrote to memory of 2912 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe unlodctr.exe PID 2688 wrote to memory of 2912 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe unlodctr.exe PID 2688 wrote to memory of 2912 2688 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe unlodctr.exe PID 2912 wrote to memory of 1784 2912 unlodctr.exe CameraSettingsUIHost.exe PID 2912 wrote to memory of 1784 2912 unlodctr.exe CameraSettingsUIHost.exe PID 2912 wrote to memory of 1784 2912 unlodctr.exe CameraSettingsUIHost.exe PID 2912 wrote to memory of 1784 2912 unlodctr.exe CameraSettingsUIHost.exe PID 2912 wrote to memory of 1784 2912 unlodctr.exe CameraSettingsUIHost.exe PID 2912 wrote to memory of 1784 2912 unlodctr.exe CameraSettingsUIHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe"C:\Users\Admin\AppData\Local\Temp\2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unlodctr.exeC:\Windows\System32\unlodctr.exe2⤵
- Checks processor information in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CameraSettingsUIHost.exeC:\Windows\System32\CameraSettingsUIHost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\TRACERT.EXEFilesize
292KB
MD599c4e136a26726a185b33254800dbbdf
SHA1a1e30ac3e313cd345bc764b944c58c941f21e67e
SHA2562096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311
SHA512d8ccca69a051df889beff4714a4c168767662e3c3080209dd7b8b2909913e152b5754c1d0c72d76caebd3323f8b6c17e54cd666dd721f19faff1541439f94d4d
-
memory/1784-165-0x00000000006F0000-0x0000000000738000-memory.dmpFilesize
288KB
-
memory/1784-163-0x00000000006F0000-0x0000000000738000-memory.dmpFilesize
288KB
-
memory/1784-160-0x00000000006F0000-0x0000000000738000-memory.dmpFilesize
288KB
-
memory/1784-159-0x0000000000000000-mapping.dmp
-
memory/2688-132-0x0000000000490000-0x00000000004A0000-memory.dmpFilesize
64KB
-
memory/2688-133-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2688-134-0x00000000020A0000-0x00000000020E8000-memory.dmpFilesize
288KB
-
memory/2688-135-0x00000000020A0000-0x00000000020E8000-memory.dmpFilesize
288KB
-
memory/2688-139-0x00000000020A0000-0x00000000020E8000-memory.dmpFilesize
288KB
-
memory/2912-151-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/2912-157-0x00000000012C0000-0x0000000001308000-memory.dmpFilesize
288KB
-
memory/2912-148-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/2912-152-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/2912-153-0x0000000077120000-0x0000000077335000-memory.dmpFilesize
2.1MB
-
memory/2912-154-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/2912-155-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/2912-150-0x0000000077120000-0x0000000077335000-memory.dmpFilesize
2.1MB
-
memory/2912-156-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/2912-146-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/2912-145-0x0000000077120000-0x0000000077335000-memory.dmpFilesize
2.1MB
-
memory/2912-143-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/2912-140-0x00000000012C0000-0x0000000001308000-memory.dmpFilesize
288KB
-
memory/2912-164-0x00000000012C0000-0x0000000001308000-memory.dmpFilesize
288KB
-
memory/2912-138-0x0000000000000000-mapping.dmp