Overview

overview

7

Static

static

3

UXF0I6R1VI...JO.exe

windows10-1703-x64

7

Analysis

  • max time kernel
    30s
  • max time network
    23s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-02-2024 17:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    UXF0I6R1VIVSGGP1C0B7HLYKCKTJO.exe

  • Size

    282KB

  • MD5

    e86471da9e0244d1d5e29b15fc9feb80

  • SHA1

    5e237538eb5b5d4464751a4391302b4158e80f38

  • SHA256

    50dd267b25062a6c94de3976d9a198a882a2b5801270492d32f0c0dadc6caa81

  • SHA512

    d50a934923ec9133e871d797a59334ad92e0e51bcd3e3fd47f2c00510b87e69d6ac012682ac661121f6bbd0ece47872d79e4f9eae5550aae6dda3dd36bdb2088

  • SSDEEP

    6144:Q/oAW1Fn0OjeJQ5oj4IaobX4+sDug70sc09RZF5zN4xpS:Q/oAW1FnuJFBaobX4TD4sc0zZuxpS

Score
7/10
persistence

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UXF0I6R1VIVSGGP1C0B7HLYKCKTJO.exe
    "C:\Users\Admin\AppData\Local\Temp\UXF0I6R1VIVSGGP1C0B7HLYKCKTJO.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    PID:4392
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /7
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4136
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3248

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UXF0I6R1VIVSGGP1C0B7HLYKCKTJO.exe
      Filesize

      282KB

      MD5

      e86471da9e0244d1d5e29b15fc9feb80

      SHA1

      5e237538eb5b5d4464751a4391302b4158e80f38

      SHA256

      50dd267b25062a6c94de3976d9a198a882a2b5801270492d32f0c0dadc6caa81

      SHA512

      d50a934923ec9133e871d797a59334ad92e0e51bcd3e3fd47f2c00510b87e69d6ac012682ac661121f6bbd0ece47872d79e4f9eae5550aae6dda3dd36bdb2088

      Download Submit