3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2023 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
Size

4.6MB
MD5

c63dd11e0f9a1ae3b5dd7d2b0c3516aa
SHA1

c95075bd92932a71d65cfaafb546c811e910d819
SHA256

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20
SHA512

6ebd7021689e834774141da72c8958f73357be447207256f51b6309fd7c51dd65401b7af414f810305670b5a73b1d607b13b66504440817d9f5e2b4948d805a3
SSDEEP

98304:15Cg2aaIU6EfD5fWnPzycNkpspmmCW7fd3CYOcOBkChVTSOZHuA:15Ch4TEfD5fezyLpImy7EmOBkChVTSgJ

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

pid	process
4372	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
4372	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
4372	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
4372	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

C:\Users\Admin\AppData\Local\Temp\3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
"C:\Users\Admin\AppData\Local\Temp\3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\guanggao[1].htm
Filesize
1KB

MD5
9247a7ca941e7d4f7db5278cb92db6ae

SHA1
b32c43ade9e78639d4f57ef62e793b1d72eb84f5

SHA256
a96d35e73b9a156ee31db5eae8de2c260860537bedb1e2487aa68360066d3fe5

SHA512
b597f5a1f8cf694f994daac0fe5c95bec16f694d4ca5ad8b0307ea12ec754a477788bcccfc4b9b79992b9d0aaae448a50764380c96e8fadf45b19fd438662404

Download Submit
memory/4372-151-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-176-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-148-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-138-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-139-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-142-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-134-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-145-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-136-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-135-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-157-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-154-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-160-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-161-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-164-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-167-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-170-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-173-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/4372-133-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download