b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116

General

Target

b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
Size

149KB
MD5

efbaaae70b768e7ed24df13408838d58
SHA1

58694531ee8c56f5c73544569c438a7ec736b792
SHA256

b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116
SHA512

666627dba166b5deab13ed153bfd664b66d71be8b64ba826e23f643a9fc513146c23bd3fac2fcfcc6c2798d3f81d123dc37537012679f7e88cc9eda66b3cc51f
SSDEEP

3072:Z3ZwD6zHkYXGnoGpeZiIkUCJuPa/Xf0IL0R7:ZpwDeHkYXGoGp9NDf10h

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
1492	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
1492	cmd.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
460	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1492	1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe	28
PID 1620 wrote to memory of 1492	1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe	28
PID 1620 wrote to memory of 1492	1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe	28
PID 1620 wrote to memory of 1492	1620	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe	28

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe

C:\Users\Admin\AppData\Local\Temp\b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe
"C:\Users\Admin\AppData\Local\Temp\b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\b5fd08fc4c65cb3d840cd8edbfa43031a9bb5bf23ac492e21260728ddeb4d116.exe"
  2⤵
  - Deletes itself
  - Loads dropped DLL
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WinSocketA.dll

Filesize
92KB

MD5
f70cfa2010198fbf3b013d85af837fa0

SHA1
0e73aeee28e0f30092fcf9e0a1892654745296b5

SHA256
53b9c1d118efd5ef041a230d1b094ed506bad74c68536f41291cecb9b26928fc

SHA512
4f1cf560fa51dc7233738f3ae46c03b165e7d3d72868e91af94bfe599324915661e3b60abacf64f195e01f9fc898d128717bfd93310f6c3956b346c5b0178a45

Download Submit
\Users\Admin\AppData\Local\Temp\WinSocketA.dll

Filesize
92KB

MD5
f70cfa2010198fbf3b013d85af837fa0

SHA1
0e73aeee28e0f30092fcf9e0a1892654745296b5

SHA256
53b9c1d118efd5ef041a230d1b094ed506bad74c68536f41291cecb9b26928fc

SHA512
4f1cf560fa51dc7233738f3ae46c03b165e7d3d72868e91af94bfe599324915661e3b60abacf64f195e01f9fc898d128717bfd93310f6c3956b346c5b0178a45

Download Submit
\Users\Admin\AppData\Local\Temp\WinSocketA.dll

Filesize
92KB

MD5
f70cfa2010198fbf3b013d85af837fa0

SHA1
0e73aeee28e0f30092fcf9e0a1892654745296b5

SHA256
53b9c1d118efd5ef041a230d1b094ed506bad74c68536f41291cecb9b26928fc

SHA512
4f1cf560fa51dc7233738f3ae46c03b165e7d3d72868e91af94bfe599324915661e3b60abacf64f195e01f9fc898d128717bfd93310f6c3956b346c5b0178a45

Download Submit
memory/1492-56-0x0000000000000000-mapping.dmp

Download
memory/1620-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads