a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118

General

Target

a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe
Size

548KB
MD5

fe66d941e06ed5c6129fceb1c4706489
SHA1

e512ae2dbbf2c96d8919a0d130c3dd4aa6840121
SHA256

a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118
SHA512

ccb77c9eedae56a4b8f4cb6f267e12ef883f4e288022e5250c3b43da26903158f921bb72fa5f5bcefaf68e44cd629ce18696f1cac8bc00909d2fd5449e3eb1f7
SSDEEP

12288:lCTI2IO6X4ySHD8ONO3rO5pndlTI2IO6X4Y:lCEm6XGD8OCC3nzEm6XP

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28
PID 1720 wrote to memory of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28
PID 1720 wrote to memory of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28
PID 1720 wrote to memory of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28
PID 1720 wrote to memory of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28
PID 1720 wrote to memory of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28
PID 1720 wrote to memory of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28
PID 1720 wrote to memory of 1100	1720	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	28

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

C:\Users\Admin\AppData\Local\Temp\a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe
"C:\Users\Admin\AppData\Local\Temp\a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1720
- C:\Users\Admin\AppData\Local\Temp\a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe"
  2⤵
  PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1100-59-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1100-60-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1100-61-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads