f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe
Size

71KB
MD5

b712385288d30744114aa9e91fa3dd4b
SHA1

26184712b47774b3d74cf7409354e6bb7d355d02
SHA256

f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4
SHA512

6c288f22cbb71bd1495a57be5961c7c18b342482eb392b958060ba689a6818b0890ab57f91288e6540a64966baac8e1c3c382dd1fd91183d5128b734dcbeef20
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slY:Olg35GTslA5t3/w8R

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ugboocoan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ugboocoan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ugboocoan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ugboocoan.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}	ugboocoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ugboocoan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1"	ugboocoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\arsicoop-idoas.exe"	ugboocoan.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eapxutot.exe"	ugboocoan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ugboocoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ugboocoan.exe

Executes dropped EXE 2 IoCs

pid	Process
2900	ugboocoan.exe
2772	ugboocoan.exe

Loads dropped DLL 3 IoCs

pid	Process
2748	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe
2748	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe
2900	ugboocoan.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ugboocoan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ugboocoan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ugboocoan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ugboocoan.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ugboocoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ugboocoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\anvehem-eded.dll"	ugboocoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ugboocoan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ugboocoan.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ugboocoan.exe	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe
File opened for modification	C:\Windows\SysWOW64\eapxutot.exe	ugboocoan.exe
File created	C:\Windows\SysWOW64\eapxutot.exe	ugboocoan.exe
File opened for modification	C:\Windows\SysWOW64\anvehem-eded.dll	ugboocoan.exe
File opened for modification	C:\Windows\SysWOW64\ugboocoan.exe	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe
File opened for modification	C:\Windows\SysWOW64\arsicoop-idoas.exe	ugboocoan.exe
File created	C:\Windows\SysWOW64\arsicoop-idoas.exe	ugboocoan.exe
File created	C:\Windows\SysWOW64\anvehem-eded.dll	ugboocoan.exe
File opened for modification	C:\Windows\SysWOW64\ugboocoan.exe	ugboocoan.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2772	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe
2900	ugboocoan.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe
Token: SeDebugPrivilege	2900	ugboocoan.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2900	2748	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe	28
PID 2748 wrote to memory of 2900	2748	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe	28
PID 2748 wrote to memory of 2900	2748	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe	28
PID 2748 wrote to memory of 2900	2748	f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe	28
PID 2900 wrote to memory of 424	2900	ugboocoan.exe	5
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 2772	2900	ugboocoan.exe	29
PID 2900 wrote to memory of 2772	2900	ugboocoan.exe	29
PID 2900 wrote to memory of 2772	2900	ugboocoan.exe	29
PID 2900 wrote to memory of 2772	2900	ugboocoan.exe	29
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18
PID 2900 wrote to memory of 1088	2900	ugboocoan.exe	18

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1088
- C:\Users\Admin\AppData\Local\Temp\f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe
  "C:\Users\Admin\AppData\Local\Temp\f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\ugboocoan.exe
    "C:\Windows\system32\ugboocoan.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\ugboocoan.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\anvehem-eded.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\arsicoop-idoas.exe

Filesize
73KB

MD5
42f267677923ba3568d583addbf348b8

SHA1
32fb523d94c1e220c3fd6419695b1a45b7430226

SHA256
f663896c352eb5efca32b590312070a6ffbdb369b3ad9796c67b30d182549530

SHA512
6e28cd692f367d8089ba024fb00fbbd0e16bb1193c67b99ad20863c0c32750de3ecacd5ca03493247f6b554e49d7199d70aa2ad5b18d88ef110df8807dea63da

Download Submit
C:\Windows\SysWOW64\eapxutot.exe

Filesize
74KB

MD5
2fe7629b6421444a9cac12fd7228f9e5

SHA1
d399b9d4f29de85163e97e6e42aeae814755226b

SHA256
09e5ef9f3faced100a344883497004fca8de88ae0ef1ef8cad7fa65e6379ae73

SHA512
3d6239e25a4fda56479c45c4e254a771e6f936af6f2b4ed2c2951d86e54a869c569dbee0170c3efd911bff2a04360b431cab6fd463fe7c59f6af457eeeabeab7

Download Submit
\Windows\SysWOW64\ugboocoan.exe

Filesize
71KB

MD5
b712385288d30744114aa9e91fa3dd4b

SHA1
26184712b47774b3d74cf7409354e6bb7d355d02

SHA256
f4763a630956c7d877df97f15599cb06d43b2f7e05318732d25d6b8226819fb4

SHA512
6c288f22cbb71bd1495a57be5961c7c18b342482eb392b958060ba689a6818b0890ab57f91288e6540a64966baac8e1c3c382dd1fd91183d5128b734dcbeef20

Download Submit
memory/2748-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2772-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2900-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download