c0dfa51657d72d26ab58594bca7fd35e6e41e57085436974efd4ffd25e4445b8

Resubmissions

31/10/2023, 07:12 UTC

231031-h1xr9shb9w 6

31/10/2023, 07:09 UTC

231031-hy68xsbc69 6

31/10/2023, 07:01 UTC

231031-htdqtabc49 6

Analysis

max time kernel
148s
max time network
129s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
31/10/2023, 07:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HideUL/HideUL.exe
Size

779KB
MD5

59e6919b61bcef4225d571e10fb13ef2
SHA1

c864cb1e389c51bdea6cecfed47162e6a03f1e22
SHA256

65ceb24e66bdac7453863bf268316bf6b6b17070ae1100713027c0be398e61f6
SHA512

c904007bd0989c6be41ce1afbbf05fa72d4f81a8b5a4e81e0fda11030e772d6a33c21fad0fe4e1faf97ec0611427a8c7aa6366d5920714e835ba80444f76d89c
SSDEEP

12288:daWzgMg7v3qnCiMErQohh0F4TCJ8lnyJQY4ZNGdiXJpp05iwQK:8aHMv6C4rjXnyJQRZYiA5kK

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	HideUL.exe
File created	C:\Windows\System32\GroupPolicy\User\Registry.pol	HideUL.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	HideUL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs regedit.exe 1 IoCs

pid	Process
4248	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3708	HideUL.exe
3708	HideUL.exe
3708	HideUL.exe
3708	HideUL.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3708	HideUL.exe
4248	regedit.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:appsfeatures;"	HideUL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	HideUL.exe

C:\Users\Admin\AppData\Local\Temp\HideUL\HideUL.exe
"C:\Users\Admin\AppData\Local\Temp\HideUL\HideUL.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:3708

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4344

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3664

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4540

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:4248

Network

DNS

48.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.229.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

48.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

48.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3708-7-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

Filesize
4KB

Download