9977291ab2a17549ea194ee338da6dab687d3ad945b7f249b5595d770c675194

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fastcopy 5.4.3/FastCopy/fcp.exe
Size

1.0MB
MD5

bc066197fb338339054929c02eaaf99b
SHA1

186b8788b28ff123b217be0b083c901fce46a084
SHA256

7c75f4d11e5a8c7d56f5014b8063b68e92a839fb6359bff14c34553171500633
SHA512

ad7b618d2f203b1cac529e7ba2907f6823646d83fdadd1d8498e257aa20d192e0ec95f0f33dd9e84283fca0e79b94d209df32b84f3248f1fcc3b3dd3ffb8fe7b
SSDEEP

24576:H5EUOW5vS1Jajmemof9MqRw6BCwk0xl704Zh/5yUq:Zq+EJhnUSqNCAxl7lZXyU

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fcp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	2888	fcp.exe
Token: SeRestorePrivilege	2888	fcp.exe
Token: SeManageVolumePrivilege	2888	fcp.exe
Token: SeSecurityPrivilege	2888	fcp.exe
Token: 35	2888	fcp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2888	fcp.exe
2888	fcp.exe

C:\Users\Admin\AppData\Local\Temp\Fastcopy 5.4.3\FastCopy\fcp.exe
"C:\Users\Admin\AppData\Local\Temp\Fastcopy 5.4.3\FastCopy\fcp.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...