559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0

General

Target

559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe
Size

3.4MB
MD5

190a6ae730a81c5a672e2d8498e230ff
SHA1

1e2457b2a56aafd15424a420813a13f52cda6287
SHA256

559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0
SHA512

946e6b2793e8fa8fb57b16f889b8ba2bf9b8a48d5c2fedd0806db81086d59ff7fd5bce67a623e715329263569b3757442aba49d614a1954cdc998cbc68ea50ec
SSDEEP

49152:7r1c7Kvf8e9HTgXHXayMSTQ5c1ztH9rDDQvOJRg05T0Oa/rm2ho8IucxzrurVloF:QKvfd94XayMT5sH9M0aS8o9uWyUhHy0

Score

9^/10

discovery evasion trojan upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

sshUSOPrivate-type7.8.1.7.exesshUSOPrivate-type7.8.1.7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sshUSOPrivate-type7.8.1.7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sshUSOPrivate-type7.8.1.7.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sshUSOPrivate-type7.8.1.7.exesshUSOPrivate-type7.8.1.7.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sshUSOPrivate-type7.8.1.7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sshUSOPrivate-type7.8.1.7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sshUSOPrivate-type7.8.1.7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sshUSOPrivate-type7.8.1.7.exe

Executes dropped EXE 2 IoCs

Processes:

sshUSOPrivate-type7.8.1.7.exesshUSOPrivate-type7.8.1.7.exe

pid process

2976 sshUSOPrivate-type7.8.1.7.exe
2184 sshUSOPrivate-type7.8.1.7.exe
Modifies file permissions 1 TTPs 3 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

4764 icacls.exe
4932 icacls.exe
1740 icacls.exe

pid	process
2976	sshUSOPrivate-type7.8.1.7.exe
2184	sshUSOPrivate-type7.8.1.7.exe

pid	process
4764	icacls.exe
4932	icacls.exe
1740	icacls.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe	upx
C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe	upx
behavioral1/memory/2976-152-0x00007FF645220000-0x00007FF64573F000-memory.dmp	upx
behavioral1/memory/2976-153-0x00007FF645220000-0x00007FF64573F000-memory.dmp	upx
behavioral1/memory/2976-154-0x00007FF645220000-0x00007FF64573F000-memory.dmp	upx
C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe	upx
behavioral1/memory/2184-156-0x00007FF645220000-0x00007FF64573F000-memory.dmp	upx
behavioral1/memory/2184-158-0x00007FF645220000-0x00007FF64573F000-memory.dmp	upx
behavioral1/memory/2184-159-0x00007FF645220000-0x00007FF64573F000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

sshUSOPrivate-type7.8.1.7.exesshUSOPrivate-type7.8.1.7.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sshUSOPrivate-type7.8.1.7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sshUSOPrivate-type7.8.1.7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe

description	pid	process	target process
PID 3440 set thread context of 3448	3440	559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

368 schtasks.exe

pid	process
368	schtasks.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exeAppLaunch.exe

description	pid	process	target process
PID 3440 wrote to memory of 3448	3440	559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe	AppLaunch.exe
PID 3440 wrote to memory of 3448	3440	559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe	AppLaunch.exe
PID 3440 wrote to memory of 3448	3440	559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe	AppLaunch.exe
PID 3440 wrote to memory of 3448	3440	559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe	AppLaunch.exe
PID 3440 wrote to memory of 3448	3440	559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe	AppLaunch.exe
PID 3448 wrote to memory of 4764	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 4764	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 4764	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 4932	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 4932	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 4932	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 1740	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 1740	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 1740	3448	AppLaunch.exe	icacls.exe
PID 3448 wrote to memory of 368	3448	AppLaunch.exe	schtasks.exe
PID 3448 wrote to memory of 368	3448	AppLaunch.exe	schtasks.exe
PID 3448 wrote to memory of 368	3448	AppLaunch.exe	schtasks.exe
PID 3448 wrote to memory of 2976	3448	AppLaunch.exe	sshUSOPrivate-type7.8.1.7.exe
PID 3448 wrote to memory of 2976	3448	AppLaunch.exe	sshUSOPrivate-type7.8.1.7.exe

C:\Users\Admin\AppData\Local\Temp\559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe
"C:\Users\Admin\AppData\Local\Temp\559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\ProgramData\sshUSOPrivate-type7.8.1.7" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:4764

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\ProgramData\sshUSOPrivate-type7.8.1.7" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:4932

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\ProgramData\sshUSOPrivate-type7.8.1.7" /inheritance:e /deny "admin:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:1740

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /CREATE /TN "sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7" /TR "C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe" /SC MINUTE
3⤵
- Creates scheduled task(s)
PID:368

C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe
"C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2976

C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe
C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe
Filesize
720.7MB

MD5
0e0d3a934a321177a6673d6eea291164

SHA1
9c33b1aa32dc5803afa9c6fc5bf53db9902b0796

SHA256
36ee42a0b6590fbe9089e665d553baa7ca9f2934cdff854abeb3361af34eefa3

SHA512
0c0ba2ed3d98175d70c6c1641553ca73bffd64928a95874fd0a45e92c730c47dac48f181cdef740929562c1147acf63a44177d41132f13eac16805f833c1d3ae

Download Submit
C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe
Filesize
720.7MB

MD5
0e0d3a934a321177a6673d6eea291164

SHA1
9c33b1aa32dc5803afa9c6fc5bf53db9902b0796

SHA256
36ee42a0b6590fbe9089e665d553baa7ca9f2934cdff854abeb3361af34eefa3

SHA512
0c0ba2ed3d98175d70c6c1641553ca73bffd64928a95874fd0a45e92c730c47dac48f181cdef740929562c1147acf63a44177d41132f13eac16805f833c1d3ae

Download Submit
C:\ProgramData\sshUSOPrivate-type7.8.1.7\sshUSOPrivate-type7.8.1.7.exe
Filesize
574.4MB

MD5
0fb89586d55bfbdc62620e1c373fd011

SHA1
e7a34a191915fa77e8eba77a01cb26790afa7477

SHA256
51f6ed81b10a5f2c52d6812bb0ebb7efbf31201f7b831af0b1c66b1605382633

SHA512
70b990f8bf1f2f79b9bab9a6bc2756f9295cfe310cd2d8d324d4a39a27e1246d52c8d47684cd2f35a134f1dd723ea2fa2905fe7b82b0d8a54fb9ed49b35d6971

Download Submit
memory/2184-159-0x00007FF645220000-0x00007FF64573F000-memory.dmp

Filesize
5.1MB

Download
memory/2184-158-0x00007FF645220000-0x00007FF64573F000-memory.dmp

Filesize
5.1MB

Download
memory/2184-156-0x00007FF645220000-0x00007FF64573F000-memory.dmp

Filesize
5.1MB

Download
memory/2976-154-0x00007FF645220000-0x00007FF64573F000-memory.dmp

Filesize
5.1MB

Download
memory/2976-152-0x00007FF645220000-0x00007FF64573F000-memory.dmp

Filesize
5.1MB

Download
memory/2976-153-0x00007FF645220000-0x00007FF64573F000-memory.dmp

Filesize
5.1MB

Download
memory/3448-144-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/3448-143-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/3448-142-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/3448-133-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/3448-141-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/3448-140-0x0000000002F30000-0x0000000002F3A000-memory.dmp

Filesize
40KB

Download
memory/3448-139-0x0000000005360000-0x00000000053F2000-memory.dmp

Filesize
584KB

Download
memory/3448-138-0x0000000005A60000-0x0000000006004000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads