9680c5834db387243d2f05b424bdbf2603156c80e95af9f4d460898fd861f961

General

Target

b848813e19d1c5653f11cded6441dd22.exe
Size

411KB
MD5

b848813e19d1c5653f11cded6441dd22
SHA1

bc4f3f5eeb5e8b4cfebb3710bdd1dde4ac35f9c2
SHA256

9680c5834db387243d2f05b424bdbf2603156c80e95af9f4d460898fd861f961
SHA512

4128d5d5acf5ab31ac236eebcfda92d6190495d1c5a5fc4308e95fcc879a9df082a8b33aeaa06ce84259a64553b615749f35275b2d8b36750622e045520c74e9
SSDEEP

6144:wvRTT8iwlz7IK/gEpQGAC3yVjChP06uBgqQhQxLY6m+RprldcrcgD8T:YIf+vQyVA0jBtLY6dldcjD8T

Score

8^/10

discovery evasion persistence trojan upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b848813e19d1c5653f11cded6441dd22.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\anhboamzvu = "C:\\Windows\\SysWOW64\\Windowsw.exe"	b848813e19d1c5653f11cded6441dd22.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Windowsw.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b848813e19d1c5653f11cded6441dd22.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Windowsw.exe

Executes dropped EXE 1 IoCs

pid	Process
868	Windowsw.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4872-0-0x0000000000400000-0x00000000004E3000-memory.dmp	upx
behavioral2/memory/4872-1-0x0000000000400000-0x00000000004E3000-memory.dmp	upx
behavioral2/memory/4872-2-0x0000000000400000-0x00000000004E3000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b848813e19d1c5653f11cded6441dd22.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Windowsw.exe	b848813e19d1c5653f11cded6441dd22.exe
File opened for modification	C:\Windows\SysWOW64\Windowsw.exe	b848813e19d1c5653f11cded6441dd22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4612	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4872	b848813e19d1c5653f11cded6441dd22.exe
4872	b848813e19d1c5653f11cded6441dd22.exe
4872	b848813e19d1c5653f11cded6441dd22.exe
4872	b848813e19d1c5653f11cded6441dd22.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	b848813e19d1c5653f11cded6441dd22.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
868	Windowsw.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 868	4872	b848813e19d1c5653f11cded6441dd22.exe	91
PID 4872 wrote to memory of 868	4872	b848813e19d1c5653f11cded6441dd22.exe	91
PID 4872 wrote to memory of 868	4872	b848813e19d1c5653f11cded6441dd22.exe	91
PID 4872 wrote to memory of 2988	4872	b848813e19d1c5653f11cded6441dd22.exe	93
PID 4872 wrote to memory of 2988	4872	b848813e19d1c5653f11cded6441dd22.exe	93
PID 4872 wrote to memory of 2988	4872	b848813e19d1c5653f11cded6441dd22.exe	93
PID 868 wrote to memory of 4612	868	Windowsw.exe	95
PID 868 wrote to memory of 4612	868	Windowsw.exe	95
PID 868 wrote to memory of 4612	868	Windowsw.exe	95

C:\Users\Admin\AppData\Local\Temp\b848813e19d1c5653f11cded6441dd22.exe
"C:\Users\Admin\AppData\Local\Temp\b848813e19d1c5653f11cded6441dd22.exe"
1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\Windowsw.exe
  C:\Windows\SysWOW64\Windowsw.exe
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Users\Admin\AppData\Local\Temp\~unins7812.bat "C:\Users\Admin\AppData\Local\Temp\b848813e19d1c5653f11cded6441dd22.exe"
  2⤵
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

5

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~unins7812.bat

Filesize
49B

MD5
9e0a2f5ab30517809b95a1ff1dd98c53

SHA1
5c1eefdf10e67d1e9216e2e3f5e92352d583c9ce

SHA256
97ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32

SHA512
e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42

Download Submit
C:\Users\Adminxplore.exe

Filesize
89B

MD5
2bd83f0dd1740fff26d071dcdd59af56

SHA1
221e9e64a79255053a9e4da65957a7bdd6bc045b

SHA256
70a676e21716581858de2753ea5eec8befe6741ed299216f65a13c3853805c05

SHA512
fe632b63b8b850cc83f0eb2a114de60693ec0dd8b62fe8f0938b42526557889f48357da0ca3bb06bed1ad68562280023a69b54d93cff8b7266bb8ebb63ac903c

Download Submit
C:\Windows\SysWOW64\Windowsw.exe

Filesize
226KB

MD5
1135872e3de251afdcb15e7a8d1370b2

SHA1
4430eec72c017f2fcf4809a8e2f8f5cb47864128

SHA256
f77f3994006cc3b231bceccba1e01a73e9451f796b648a4dd73982e4994c16f0

SHA512
de91c5376603054de42dfb0ad8b813c3a6e86894f9106fa3e61e41f7e39c1439949deb4bb8e88c5a082dfe946891533b992de54614bfdc6d58c098a6de0233b9

Download Submit
memory/4872-0-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/4872-1-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/4872-2-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/4872-3-0x0000000000770000-0x000000000081F000-memory.dmp

Filesize
700KB

Download
memory/4872-7-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads