Analysis
-
max time kernel
27s -
max time network
31s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
08/06/2024, 01:46
General
-
Target
InstallDefenderUIPro.exe
-
Size
20.4MB
-
MD5
96d22442433cc2ea86d5c0e811199161
-
SHA1
0bd186aee9a0c43ba555319e6a2b7f1c01e83f39
-
SHA256
80b1cbfc43e41cd245787212d6b4da84631594152ac83dcf1796bf5ae0386178
-
SHA512
ed5704906b662958b164688ac8d28dde0c1028814b21da7b1f8fd59d1e2ba948156b2b61fb327389d2d02a503d711c88d601e0c90df500721df087e1dea1f490
-
SSDEEP
393216:gMhVOKf1xjdG/abh9ObZ/B50Ex80G2RKo01kHjihYaZRuMhdguO4N2PqswK50IXD:gMhV9fjjdG/4mZcPq4o0ymaaPuMMPqng
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
-
Stops running service(s) 4 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 6 IoCs
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 18 IoCs
-
Modifies system certificate store 2 TTPs 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\InstallDefenderUIPro.exe"C:\Users\Admin\AppData\Local\Temp\InstallDefenderUIPro.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HPOQS.tmp\InstallDefenderUIPro.tmp"C:\Users\Admin\AppData\Local\Temp\is-HPOQS.tmp\InstallDefenderUIPro.tmp" /SL5="$901AA,20505195,1072128,C:\Users\Admin\AppData\Local\Temp\InstallDefenderUIPro.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im DefenderUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop DefenderUIService3⤵
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\Temp\is-UA7AO.tmp\_isetup\_setup64.tmphelper 105 0x55C3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\DefenderUI\Driver\vsscanner.inf3⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Program Files\DefenderUI\DefenderUIService.exe"C:\Program Files\DefenderUI\DefenderUIService.exe" --install3⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" sdset DefenderUIService D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)3⤵
- Launches sc.exe
-
-
-
C:\Program Files\DefenderUI\DefenderUIService.exe"C:\Program Files\DefenderUI\DefenderUIService.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\DefenderUI\DefenderUI.exe"C:\Program Files\DefenderUI\DefenderUI.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\DefenderUI\DefenderUI.exe"C:\Program Files\DefenderUI\DefenderUI.exe" /sw1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD546c6e91f541a7b8ebdc053fdf26f99b1
SHA176754e7394194dbd8770d270cf6ce2b27da9ff58
SHA2566c2b166e289138e6ccd0e61ca6fac2c8f3362af1ab71ef56b7b58c23e3c81ec2
SHA5123ff9630bab1ce9bb43e8424ef0ad008c14fa985b9d121ef51319f568b8a95dab6fde96b1099a7fb2fae343cef7dd2723f6ac9c0b28c42d9dd398dd855dbb7b12
-
Filesize
1.3MB
MD5cdbf9bbd1378cc07fdd92b13023c9bcc
SHA1878e875131bfc46e07574d54926862a8646b4104
SHA256ef166bb2658800fb4744fe98e53898e6b4bd8c59d6009dd4f4ce8ac918551a80
SHA512a87159ccc223f5b92a439f5daf68098bb08e5c573c7075e4f814776f6b1f2304fc3f4d74cfd3a064c331bd6776588920d57cc765af005787bedcb32041eae2e1
-
Filesize
1KB
MD5c6b2de0f8113184c04769bb6f134d9f1
SHA10ebf02392a1d28593a44de1f21935550bc19defc
SHA256175ed8238069585caf13fc51a77dca2390bd943251d8d1399b2e2c01ffe9f363
SHA5126708fc7066d90896ed362a4e7fe4c7cf4c85c583eacac6ac8cf3c9aaf9e944390d3fcf9f384bc1f8127fbaef759e99d8e8aedee42bcbdbbbeb015304a48ab6b2
-
Filesize
361KB
MD5ffba3b6c96181a7b54a7d7af139ba615
SHA12473b8e122e14ac6fe0636470a4a691ad9728359
SHA2569ad10a2a5548806acc39772556c94681ea6ff04746abbb1214b3e7d124f4847e
SHA512a114e76f9e8cb77aaf3a31a135ca36cfdd52c9aa094f5eba23f45366aa191e8b10e0ca98ab5870d38ed2712c2cf4091f5a460b7ef808eab6367ee576bf777636
-
Filesize
3KB
MD55cb67e84b23249734d137883ab92b530
SHA1cfc77dff844c6d99ac1fe359ab3503069097042c
SHA256d7904044c960312f80c3ee5c9e60bfc278a6eff9f6bf2827b0f94b4e4400bdec
SHA5126554bb815fb06cd35cb2cc54e7d71ff5b0843865bf92f37bf0df22b6e08c8e951c8bb81c93d3f2cbe6774e70fba4e7ff762b1b6ab64c95b7730319e2b85364ac
-
Filesize
2KB
MD5d82e80adad75bae02c6da59858a6b4b9
SHA120fe218cc855f40a4c034a0a2c43465a01f045df
SHA256a81a5ac2602ed63933db5399ecec11e727920a5d041b6ecb67356c9562d8e6ec
SHA512fc3ff08f6086235dce5100687f3d89396bb51f2ce2e3ba6c3d0b410a39dab9a713e94e5708ea4793a79ac8e8f57ffc73e296ada8cc2e43ef9bccff96ce07df62
-
Filesize
2KB
MD55f10bc8d97e2410e8c71383b88089be2
SHA19fab31aa82dff8693991cca0f54888341324e6e9
SHA256c2b26ea61e02203ddca7cef244bb8209226e25412ef4e1d0c61ee911845cdca6
SHA5127f9edd3b62bd5d4ffcd5918f4a19d20d1368105f62c63195f0589db4584465dacda0b582a8e155d42cb7a9487edc29d21bf3ba756eac0000e35b58085b52f4e4
-
Filesize
3.3MB
MD50119f46005416658b46f39ddc8163fc5
SHA163dae48d758f4e299397775ded455449ae73edc7
SHA256a5e3d60b69d9af9cc48242a9a7dd04f9ec3e9652ec8e279fd38df7d2d0afa83f
SHA51213a1d9488cc633789ae76838d71a1887aa8c474c01144dc962cdceb5533420c2552238857a8ab133ca4b9d58a361fa18e25f0deca8081998d1052f28d96dfa2f
-
Filesize
6KB
MD5e4211d6d009757c078a9fac7ff4f03d4
SHA1019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
SHA51217257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
-
Filesize
376KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
320KB
-
Filesize
1.0MB
-
Filesize
160KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
728KB
-
Filesize
1.3MB
-
Filesize
1.0MB