af582ce1d3bbc2d9201c81a058203e96f81087433b80ddd85f8eb1a66faa8d31

Resubmissions

11-12-2023 15:39

231211-s3p6bacbh4 7

10-12-2023 15:26

09-12-2023 14:29

09-12-2023 11:42

08-12-2023 15:15

05-12-2023 15:49

05-12-2023 04:28

Analysis

max time kernel
33s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dac.exe
Size

22.6MB
MD5

111983bd0209f1541e9d1ee618be1c45
SHA1

cf15e95ad616bbf3b806b0f6b7290cc14c6b557e
SHA256

af582ce1d3bbc2d9201c81a058203e96f81087433b80ddd85f8eb1a66faa8d31
SHA512

6c1e810557acffc3c10213aa663b7527f4808b418e80c3c5610a5489994138236457aad1ffd28861b912add0aaa66053a4cdac2b3a47167d075f8e9b2d592511
SSDEEP

393216:oHqEnUyriULZiXg6LPmmG3z7z/wQ74cZd060stbgB7OrowyVm9fC8:fXyriULZikmG3zP/p748d0LsqB7uyI48

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

dac.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation dac.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	dac.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/3952-0-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral3/memory/3952-1-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral3/memory/3952-3-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral3/memory/3952-4-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral3/memory/3952-5-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral3/memory/3952-15-0x0000000180000000-0x0000000180033000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

dac.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings dac.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	dac.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

dac.exemmc.exemmc.exe

description	pid	process
Token: SeShutdownPrivilege	3952	dac.exe
Token: 33	2708	mmc.exe
Token: SeIncBasePriorityPrivilege	2708	mmc.exe
Token: 33	2708	mmc.exe
Token: SeIncBasePriorityPrivilege	2708	mmc.exe
Token: 33	4516	mmc.exe
Token: SeIncBasePriorityPrivilege	4516	mmc.exe
Token: 33	4516	mmc.exe
Token: SeIncBasePriorityPrivilege	4516	mmc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

dac.exemmc.exemmc.exemmc.exe

pid process

3952 dac.exe
3952 dac.exe
2708 mmc.exe
2708 mmc.exe
4516 mmc.exe
4516 mmc.exe
1012 mmc.exe
1012 mmc.exe

pid	process
3952	dac.exe
3952	dac.exe
2708	mmc.exe
2708	mmc.exe
4516	mmc.exe
4516	mmc.exe
1012	mmc.exe
1012	mmc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

mmc.exemmc.exedac.execmd.exe

description	pid	process	target process
PID 2708 wrote to memory of 4332	2708	mmc.exe	netsh.exe
PID 2708 wrote to memory of 4332	2708	mmc.exe	netsh.exe
PID 4516 wrote to memory of 1692	4516	mmc.exe	netsh.exe
PID 4516 wrote to memory of 1692	4516	mmc.exe	netsh.exe
PID 3952 wrote to memory of 1476	3952	dac.exe	cmd.exe
PID 3952 wrote to memory of 1476	3952	dac.exe	cmd.exe
PID 1476 wrote to memory of 860	1476	cmd.exe	reg.exe
PID 1476 wrote to memory of 860	1476	cmd.exe	reg.exe
PID 1476 wrote to memory of 2568	1476	cmd.exe	reg.exe
PID 1476 wrote to memory of 2568	1476	cmd.exe	reg.exe
PID 1476 wrote to memory of 2300	1476	cmd.exe	reg.exe
PID 1476 wrote to memory of 2300	1476	cmd.exe	reg.exe
PID 3952 wrote to memory of 3532	3952	dac.exe	cmd.exe
PID 3952 wrote to memory of 3532	3952	dac.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\dac.exe
"C:\Users\Admin\AppData\Local\Temp\dac.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\Bza1l.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
3⤵
- UAC bypass
PID:860

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
3⤵
- UAC bypass
PID:2568

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
3⤵
- UAC bypass
PID:2300

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\1bywV\Y2OT5@f\v+C:\Users\Public\Pictures\1bywV\Y2OT5@f\b C:\Users\Public\Pictures\1bywV\Y2OT5@f\AliProtect.dll
2⤵
PID:3532

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address 以太网 static 1.0.0.2 255.255.255.0 1.0.0.1 1
2⤵
PID:4332

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
2⤵
PID:1692

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Bza1l.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Public\Pictures\1bywV\Y2OT5@f\b

Filesize
880KB

MD5
40f0f5f381f5de3289f61e73069fa965

SHA1
4cdd2c8dfdd2dafa20ec9b57ddd91f1abe4bc2dc

SHA256
5cbd6e6ff971a9ce2a61193a7a01211f74cc14cce888901dc94fe9aaaf010704

SHA512
9b62d3f2e4603a6b990265848b61529125a32eda3ff0cb241a406e4b8acb23436ad385b30a37bf7cf96ed26bbd574cb8a4cbd12f3dfb9c625cd55aea9c57de8b

Download Submit
C:\Users\Public\Pictures\1bywV\Y2OT5@f\v

Filesize
880KB

MD5
003878433cbd4a8b59982b69815b85b8

SHA1
4ab8bfdf56557d57f0688dee13d157c67ed90c51

SHA256
df493f4c531e3b4569be51c7d00ec8ad05390c12cce372ac18e1c83a4cc14bbd

SHA512
6ed33f98c92562ee20728063b421d2b236ba628c4ed4889f461e933f1d25508b818eafe97a042d64088ae0e5163f9e2969604eacf2cab989e3b664c204c39715

Download Submit
memory/3952-0-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3952-1-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3952-3-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3952-4-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3952-5-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3952-15-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download