9977291ab2a17549ea194ee338da6dab687d3ad945b7f249b5595d770c675194

Analysis

max time kernel
138s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fastcopy 5.4.3/FastCopy64/FastCopy.exe
Size

1.1MB
MD5

4817896a7d7486dd8283d5224886596d
SHA1

18bbb74628e8138467be9239de01f3872749d6ec
SHA256

0af0869004ab7de4c3b965d73bd9801b4d3379d4adc1157984d61167c6ceecce
SHA512

f504999455f17af91604aa99b00df81f92f82b5b5192767059aaff8c1fac39ef45471466b1e18b743e16e34afc3a5e290abd2849fa499aa3d27d2b31573c6511
SSDEEP

24576:OGtlqe7zwYT8k5EsI7woz2ECwI1jCYjcBZz8Z:OGtlqc4HfwozgwI1+QcBZY

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FastCopy.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	4464	FastCopy.exe
Token: SeRestorePrivilege	4464	FastCopy.exe
Token: SeManageVolumePrivilege	4464	FastCopy.exe
Token: SeSecurityPrivilege	4464	FastCopy.exe
Token: 35	4464	FastCopy.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4464	FastCopy.exe
4464	FastCopy.exe

C:\Users\Admin\AppData\Local\Temp\Fastcopy 5.4.3\FastCopy64\FastCopy.exe
"C:\Users\Admin\AppData\Local\Temp\Fastcopy 5.4.3\FastCopy64\FastCopy.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...