359f1986323fb89098109e3ad9f50a7a24eedc2252464695b8bf18e9a935f976

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85c62afc096c6b60c29365ea585772a2.exe
Size

430KB
MD5

85c62afc096c6b60c29365ea585772a2
SHA1

142fa064605cb35dc4b8813fc5495bb2d9d758b3
SHA256

359f1986323fb89098109e3ad9f50a7a24eedc2252464695b8bf18e9a935f976
SHA512

1bad1997128e43bd32f268d96b21198dd05fd8781f06ab0c53999f34f1b4d4bf2f153063f54b0c2e4aece1a2cecbf7a3433778e65b872bda67cf724dfd75835d
SSDEEP

12288:k3psRRozCi7GeMK7kW6a7uGR2NhNnQdJD4Mp1xQWGIyZLbaiGUf:spsjoui7G7K7V7uGR2N3Qd9DQWpyFaQ

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
2764	Aero_disable.exe
2568	winvnc.exe

Loads dropped DLL 3 IoCs

pid	Process
2752	cmd.exe
2752	cmd.exe
2752	cmd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2540-0-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2540-46-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2764-53-0x0000000000A40000-0x0000000000AC0000-memory.dmp	upx

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2540-46-0x0000000000400000-0x000000000048A000-memory.dmp	autoit_exe
behavioral1/memory/2764-53-0x0000000000A40000-0x0000000000AC0000-memory.dmp	autoit_exe
behavioral1/memory/2764-61-0x0000000000A40000-0x0000000000AC0000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2784	reg.exe
2668	reg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	winvnc.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2540	85c62afc096c6b60c29365ea585772a2.exe
2540	85c62afc096c6b60c29365ea585772a2.exe
2540	85c62afc096c6b60c29365ea585772a2.exe
2540	85c62afc096c6b60c29365ea585772a2.exe
2540	85c62afc096c6b60c29365ea585772a2.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2540	85c62afc096c6b60c29365ea585772a2.exe
2540	85c62afc096c6b60c29365ea585772a2.exe
2540	85c62afc096c6b60c29365ea585772a2.exe
2540	85c62afc096c6b60c29365ea585772a2.exe
2540	85c62afc096c6b60c29365ea585772a2.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2752	2540	85c62afc096c6b60c29365ea585772a2.exe	28
PID 2540 wrote to memory of 2752	2540	85c62afc096c6b60c29365ea585772a2.exe	28
PID 2540 wrote to memory of 2752	2540	85c62afc096c6b60c29365ea585772a2.exe	28
PID 2540 wrote to memory of 2752	2540	85c62afc096c6b60c29365ea585772a2.exe	28
PID 2752 wrote to memory of 1588	2752	cmd.exe	30
PID 2752 wrote to memory of 1588	2752	cmd.exe	30
PID 2752 wrote to memory of 1588	2752	cmd.exe	30
PID 2752 wrote to memory of 1588	2752	cmd.exe	30
PID 2752 wrote to memory of 2728	2752	cmd.exe	31
PID 2752 wrote to memory of 2728	2752	cmd.exe	31
PID 2752 wrote to memory of 2728	2752	cmd.exe	31
PID 2752 wrote to memory of 2728	2752	cmd.exe	31
PID 2752 wrote to memory of 2764	2752	cmd.exe	32
PID 2752 wrote to memory of 2764	2752	cmd.exe	32
PID 2752 wrote to memory of 2764	2752	cmd.exe	32
PID 2752 wrote to memory of 2764	2752	cmd.exe	32
PID 2752 wrote to memory of 2784	2752	cmd.exe	33
PID 2752 wrote to memory of 2784	2752	cmd.exe	33
PID 2752 wrote to memory of 2784	2752	cmd.exe	33
PID 2752 wrote to memory of 2784	2752	cmd.exe	33
PID 2752 wrote to memory of 2588	2752	cmd.exe	34
PID 2752 wrote to memory of 2588	2752	cmd.exe	34
PID 2752 wrote to memory of 2588	2752	cmd.exe	34
PID 2752 wrote to memory of 2588	2752	cmd.exe	34
PID 2588 wrote to memory of 2608	2588	cmd.exe	35
PID 2588 wrote to memory of 2608	2588	cmd.exe	35
PID 2588 wrote to memory of 2608	2588	cmd.exe	35
PID 2588 wrote to memory of 2608	2588	cmd.exe	35
PID 2752 wrote to memory of 2184	2752	cmd.exe	36
PID 2752 wrote to memory of 2184	2752	cmd.exe	36
PID 2752 wrote to memory of 2184	2752	cmd.exe	36
PID 2752 wrote to memory of 2184	2752	cmd.exe	36
PID 2752 wrote to memory of 2644	2752	cmd.exe	37
PID 2752 wrote to memory of 2644	2752	cmd.exe	37
PID 2752 wrote to memory of 2644	2752	cmd.exe	37
PID 2752 wrote to memory of 2644	2752	cmd.exe	37
PID 2752 wrote to memory of 2668	2752	cmd.exe	38
PID 2752 wrote to memory of 2668	2752	cmd.exe	38
PID 2752 wrote to memory of 2668	2752	cmd.exe	38
PID 2752 wrote to memory of 2668	2752	cmd.exe	38
PID 2752 wrote to memory of 1076	2752	cmd.exe	39
PID 2752 wrote to memory of 1076	2752	cmd.exe	39
PID 2752 wrote to memory of 1076	2752	cmd.exe	39
PID 2752 wrote to memory of 1076	2752	cmd.exe	39
PID 1076 wrote to memory of 2044	1076	cmd.exe	40
PID 1076 wrote to memory of 2044	1076	cmd.exe	40
PID 1076 wrote to memory of 2044	1076	cmd.exe	40
PID 1076 wrote to memory of 2044	1076	cmd.exe	40
PID 2752 wrote to memory of 1984	2752	cmd.exe	41
PID 2752 wrote to memory of 1984	2752	cmd.exe	41
PID 2752 wrote to memory of 1984	2752	cmd.exe	41
PID 2752 wrote to memory of 1984	2752	cmd.exe	41
PID 2752 wrote to memory of 2444	2752	cmd.exe	42
PID 2752 wrote to memory of 2444	2752	cmd.exe	42
PID 2752 wrote to memory of 2444	2752	cmd.exe	42
PID 2752 wrote to memory of 2444	2752	cmd.exe	42
PID 2752 wrote to memory of 2568	2752	cmd.exe	43
PID 2752 wrote to memory of 2568	2752	cmd.exe	43
PID 2752 wrote to memory of 2568	2752	cmd.exe	43
PID 2752 wrote to memory of 2568	2752	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\85c62afc096c6b60c29365ea585772a2.exe
"C:\Users\Admin\AppData\Local\Temp\85c62afc096c6b60c29365ea585772a2.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\winvnc.cmd VISTA"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\find.exe
    find "Version 6."
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\Aero_disable.exe
    Aero_disable.exe
    3⤵
    - Executes dropped EXE
    PID:2764
- - C:\Windows\SysWOW64\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop_VNC
    3⤵
    - Modifies registry key
    PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop
      4⤵
      PID:2608
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop_VNC /t REG_DWORD /d
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:2644
- - C:\Windows\SysWOW64\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin_VNC
    3⤵
    - Modifies registry key
    PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
      4⤵
      PID:2044
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin_VNC /t REG_DWORD /d
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:2444
- - C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\winvnc.exe
    winvnc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\helpdesk.txt

Filesize
2KB

MD5
c5d79b73d56dd2f4f35163b3cd174eb0

SHA1
f832ca036248c2dd2725b403cd37d59957e1306f

SHA256
7c1707f84643f813998537749ae64aa0c45f7ce857fabb2a08839895d1cee5fa

SHA512
2ad94e3d264b5298d137b10335f5fcb8053698f3a4db7b7e3da06ba7840cd393254eb8d3aa0aff3ed587b64643f482dc4152924a98af82bfe12fbfddf2241f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\logo.bmp

Filesize
84KB

MD5
a10eed94507ffe310eda8a1b32ff241d

SHA1
75612441d20751d8b98bfcc1b3ce8a76e73d7870

SHA256
8b39f539e91f99e4c80eed340d29dc264c90760e39f07f86c7ca7fa9c473d6a3

SHA512
c6de9567b641c4a05ab1b7f5832ed7cab55b9cf2a038c873da2088f6fb327e7657c375110e4ba6659eaad4f6ffc0384d3789e8ce929c9deb9af5b6920056d1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\winvnc.cmd

Filesize
3KB

MD5
711bbca9abd1f9d3097b8faabd754e68

SHA1
66346488e22002d35c3769c6f0d52f5fa46b4921

SHA256
5dc1989e54e65d26d798ddfdd81156dd6fe62da059a52f15424cab97ef6292e9

SHA512
9d5b30e1c36df572284d2687feca795ccdb8eba4944b21a1c650c330e75afafa4771559ff77eacb0a35e419ab666d1cd541e224ee4b21116d130dff7c6ebf56d

Download Submit
\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\Aero_disable.exe

Filesize
8KB

MD5
b0af77b8bebf095f2ba73f4e6c8b85f9

SHA1
53bd9ef658265164e9634aaf27e87cb82710ffe3

SHA256
221a859681ac1744c5180bd127d0d9ee6061cba3720cccfdf7a243d7b574fa1d

SHA512
8cb1c149f914ec72e1e5af91c935b52cc46655ee4ceab293ecd8302b3556203ef70e18084419ea2b00ece99cf5adf9fecf9adf0b703ed14bb75ac7d5c2caba7b

Download Submit
\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\winvnc.exe

Filesize
244KB

MD5
1cc077ecea12e9b484112d897da74a3b

SHA1
7fef071f41ddd1895b2723f9a526f53b6cd681c7

SHA256
db904b423b5b4b0a15a8c39851449a7f2a8271f318374ce2d6618cfab07b096f

SHA512
6cfc612f34170fc409969fff8f2ad3352b71c9d06c389276d0d7f01fcd3e4684c6016c7860fed6d020ad9713aaf86a9076719189047b8cf3e0d0d054718c23e4

Download Submit
memory/2540-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2540-46-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2764-52-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-53-0x0000000000A40000-0x0000000000AC0000-memory.dmp

Filesize
512KB

Download
memory/2764-58-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-61-0x0000000000A40000-0x0000000000AC0000-memory.dmp

Filesize
512KB

Download
memory/2764-62-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-63-0x0000000000A40000-0x0000000000AC0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads