5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
Size

3.6MB
MD5

8db3864480e464251b678fa2fc266da2
SHA1

ecb39a6062e94f911fa9b5bf2fdae19801222688
SHA256

5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791
SHA512

7cdac3bf0156f496ece58edf3d5795d361057a8da30a78ae85cb91968f2374b39e1e545263d5199f9756704bd2f5ae59e0922508cea3c736dedfec6421eb7b34
SSDEEP

98304:x5JzROzykc6W98Sn8/qPXpSaEgjO8Sdib59Wx:xIp2SSn8/qPXpVnjIlx

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2140-133-0x0000000000400000-0x000000000109F000-memory.dmp	upx
behavioral2/memory/2140-153-0x0000000000400000-0x000000000109F000-memory.dmp	upx
behavioral2/memory/2140-158-0x0000000000400000-0x000000000109F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
2140	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe

C:\Users\Admin\AppData\Local\Temp\5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe
"C:\Users\Admin\AppData\Local\Temp\5173bbfa9a3eee515876ef7acbc4e924254d94e10050ae1197b8144708eb0791.exe"
1⤵
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cfg.ini

Filesize
207B

MD5
06934c207930e5306b23916036adc9bd

SHA1
4ea5180ee6763cbf822b2f7fd31af72f1a6d72dc

SHA256
09e4e3a36df1d02559b60a67ebe80884168358b6714c6a02635ad4e5e6ccb7cd

SHA512
cb693b55625ebb7772ea987d575bd66af1ab924b135d03155906085fcfd26984983a633908618341e7639892cf7cefdafe67d198e046dd54b2285a8d8b8324bf

Download Submit
memory/2140-133-0x0000000000400000-0x000000000109F000-memory.dmp

Filesize
12.6MB

Download
memory/2140-134-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download
memory/2140-152-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/2140-153-0x0000000000400000-0x000000000109F000-memory.dmp

Filesize
12.6MB

Download
memory/2140-154-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download
memory/2140-158-0x0000000000400000-0x000000000109F000-memory.dmp

Filesize
12.6MB

Download