1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850

General

Target

1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe
Size

3.4MB
MD5

84c227e60924c9391b72c7dc88777255
SHA1

9e2d04f661332204f7d34e2ceee6b49e37cccac7
SHA256

1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850
SHA512

c915452a9c9cafe64db00231876e5141c7aab056e08095fd4af6fe0d27ab74650ec5c3c7ab197db1d0f946e0e3035bcecf73ed8cd2072a8cf170351e9ad3cc4e
SSDEEP

49152:w/c+EciXT1SMTEGUlayCd1XlOrUcwFY92eg6zBCYUFQumEeBAoCuYXMYo3js:PcmEZlaPfUwbYIelzBLU3vqCRs

Score

9^/10

discovery evasion trojan upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DocumentsUSOPrivate-type0.2.5.7.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DocumentsUSOPrivate-type0.2.5.7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DocumentsUSOPrivate-type0.2.5.7.exe

Executes dropped EXE 1 IoCs

pid	Process
2064	DocumentsUSOPrivate-type0.2.5.7.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4816	icacls.exe
3956	icacls.exe
5064	icacls.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000023137-149.dat	upx
behavioral1/files/0x0006000000023137-152.dat	upx
behavioral1/files/0x0006000000023137-151.dat	upx
behavioral1/memory/2064-154-0x00007FF721510000-0x00007FF721A2F000-memory.dmp	upx
behavioral1/memory/2064-155-0x00007FF721510000-0x00007FF721A2F000-memory.dmp	upx
behavioral1/memory/2064-156-0x00007FF721510000-0x00007FF721A2F000-memory.dmp	upx
behavioral1/memory/2064-157-0x00007FF721510000-0x00007FF721A2F000-memory.dmp	upx
behavioral1/memory/2064-158-0x00007FF721510000-0x00007FF721A2F000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DocumentsUSOPrivate-type0.2.5.7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 3612	748	1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4260	748	WerFault.exe	82

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2208	schtasks.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3612	748	1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe	84
PID 748 wrote to memory of 3612	748	1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe	84
PID 748 wrote to memory of 3612	748	1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe	84
PID 748 wrote to memory of 3612	748	1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe	84
PID 748 wrote to memory of 3612	748	1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe	84
PID 3612 wrote to memory of 4816	3612	AppLaunch.exe	93
PID 3612 wrote to memory of 4816	3612	AppLaunch.exe	93
PID 3612 wrote to memory of 4816	3612	AppLaunch.exe	93
PID 3612 wrote to memory of 3956	3612	AppLaunch.exe	95
PID 3612 wrote to memory of 3956	3612	AppLaunch.exe	95
PID 3612 wrote to memory of 3956	3612	AppLaunch.exe	95
PID 3612 wrote to memory of 5064	3612	AppLaunch.exe	97
PID 3612 wrote to memory of 5064	3612	AppLaunch.exe	97
PID 3612 wrote to memory of 5064	3612	AppLaunch.exe	97
PID 3612 wrote to memory of 2208	3612	AppLaunch.exe	99
PID 3612 wrote to memory of 2208	3612	AppLaunch.exe	99
PID 3612 wrote to memory of 2208	3612	AppLaunch.exe	99
PID 3612 wrote to memory of 2064	3612	AppLaunch.exe	100
PID 3612 wrote to memory of 2064	3612	AppLaunch.exe	100

C:\Users\Admin\AppData\Local\Temp\1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe
"C:\Users\Admin\AppData\Local\Temp\1416248e000b693192f5664eb083e6bdcf63395dc06d7de8919f7849f3917850.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:4816
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:3956
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7" /inheritance:e /deny "admin:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:5064
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /TN "DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7" /TR "C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7.exe" /SC MINUTE
    3⤵
    - Creates scheduled task(s)
    PID:2208
- - C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7.exe
    "C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 352
  2⤵
  - Program crash
  PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 748 -ip 748
1⤵
PID:4380

C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7.exe
C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7.exe
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

File and Directory Permissions Modification

1

T1222

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7.exe

Filesize
653.9MB

MD5
d029b859c85025bcdfcf4c1fcc28086f

SHA1
25b745fc95e0ade1f1499024f0e2924d081b95d4

SHA256
48adac7433627d1d12308418c1501fe858e058120181b5901c822f6bd336b1e7

SHA512
5458686c71678ac904a89f174a487f293eba4cff61879d15ffc72958a76db2d327b16d81b62a50768216c8f4049f1e90e806d33ca46ae94fecdf15b58c5e516a

Download Submit
C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7.exe

Filesize
713.0MB

MD5
58e7c403f224f02ec204cfbe5b326ea2

SHA1
4c6edebc27b49642439815c2dd83861d8d827bdd

SHA256
661d117c242a0766a563ce17caa260e07f529c986e584a8a00e5ed6f80b5d2fc

SHA512
d3e74cad99e3388de223d1679314a8f24a121ada1cd4f99d26bbe44ee7a88deb41df41678eeb6b8267993b2d4889b706ce5cb12bba69dd7e3a5c3e49dd4010e4

Download Submit
C:\ProgramData\DocumentsUSOPrivate-type0.2.5.7\DocumentsUSOPrivate-type0.2.5.7.exe

Filesize
650.9MB

MD5
bdc44a7166ad528c819720f8f4518960

SHA1
fb090f9129e62520a54365fc05234e6e8c3590e9

SHA256
1984574f6c15b60ab5711ea4fb33148d3c5eb77e57aee07fa58469e31446bfb7

SHA512
417320e1fd877b34d9f0d4fca1a16cf7c9440cfba06fd80395aec506b2d428055b6fab57ab0d0a7417a9831cf9bae5882e5801e06393631b037325b2701366fc

Download Submit
memory/2064-155-0x00007FF721510000-0x00007FF721A2F000-memory.dmp

Filesize
5.1MB

Download
memory/2064-154-0x00007FF721510000-0x00007FF721A2F000-memory.dmp

Filesize
5.1MB

Download
memory/2064-156-0x00007FF721510000-0x00007FF721A2F000-memory.dmp

Filesize
5.1MB

Download
memory/2064-157-0x00007FF721510000-0x00007FF721A2F000-memory.dmp

Filesize
5.1MB

Download
memory/2064-158-0x00007FF721510000-0x00007FF721A2F000-memory.dmp

Filesize
5.1MB

Download
memory/3612-141-0x00000000051F0000-0x00000000051FA000-memory.dmp

Filesize
40KB

Download
memory/3612-142-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3612-143-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3612-144-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3612-140-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3612-139-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/3612-138-0x0000000005800000-0x0000000005DA4000-memory.dmp

Filesize
5.6MB

Download
memory/3612-133-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads