Analysis
-
max time kernel
4s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
05-08-2024 13:48
General
-
Target
UTCWebComponents.exe
-
Size
2.9MB
-
MD5
3dde23965058db0a131cfeff60aec9e8
-
SHA1
a40648440ffc40eb173b637f47e5137ca1f89753
-
SHA256
46b55211fa1efb987ad56441b71a9c4fb2d9c96dbc23ea9b58e3c22314120e7c
-
SHA512
abf725658aa67ab43541c6bbbc4c96f71fe7822b423451f0d12821609ff080982038c7949b57cbc79fb69e2f48e3de11a140af8dbd2354019cef8b8c60692a33
-
SSDEEP
49152:l2wQV7hy6LkgY9noahp/JHkngocXekwITf6v+osO+uUiaGgoENwg9k3jAHK75CXs:AwQV7lIgY9noahpBWcXeAT+4uHfECg9O
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 14 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 14 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UTCWebComponents.exe"C:\Users\Admin\AppData\Local\Temp\UTCWebComponents.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3EDUT.tmp\UTCWebComponents.tmp"C:\Users\Admin\AppData\Local\Temp\is-3EDUT.tmp\UTCWebComponents.tmp" /SL5="$80110,2726915,53760,C:\Users\Admin\AppData\Local\Temp\UTCWebComponents.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UTC Web Components\UTCWebVideoActiveX.ocx"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
354KB
MD51e6ea5d69451c7165e4481001e484d3d
SHA1deb97c00703021247ea08573360bc539c3e695fc
SHA2564d6a7800c6fae1754d43070087bab71ed70b3e9051dcb756b85b7398ec03a28d
SHA5125ac3dacdd989a00ffcb3549f8cd8d5b2c293c600a5638d191c07188a111620572eb89afbf83acdecd07635009892027ac4890509a0f8768307409fa9209818ec
-
Filesize
1.2MB
MD5f7583a78a988f24966e09fd9cae71d58
SHA1459f6e7167faea7e94079ea67b738cd16c56df01
SHA256c88f2cfc9e91cb9618f98480ec4375de2d332ccab613112337c0ada2c9d7e975
SHA5121d073b5c12699e9cf7f016cb6aded5c990590b0e09842d8e4f62959ca9a13ace6f2a9b08455cb0021ef418edb0e69ae5cffda1affe19329c6a2c22837acca51c
-
Filesize
3.5MB
MD557808c7fc5c4877dc97fd1fadb661f70
SHA18c3092d0a5d04a02c6808140576105063cb96d87
SHA2566caf3e51f5e6715d52404d9891d8c3a88875dde7da7e502281dd8a26b219df21
SHA51289104ee9cc6cc483c0bc359068d3f37bcc46ba5077a7ea0a74b0814d77374c6ae50dad7cb633934131e01fa9984b8df64c623ace177c1d140d6cb0c9eed3c382
-
Filesize
256KB
MD5653c99f74f00ac7d6bdb8b997908693a
SHA1f71590b81fe9846060e460395ef6812de8493d1c
SHA256d4c1daf83ddee781834cf6c9de40141c11736b1fcf250974a34206970ac65cef
SHA512dff628ab593133991b2323239723c0b8eb2d4e9e67ef46d868a72f865ad8da4fcc24ad82d335bb41d88f269b96bd57fa872a5135ac50d59565b0aacf69d0ed1e
-
Filesize
326KB
MD53f7e90cb0c6f6a420701ec3a88d54db3
SHA10a83ab45ebb3997a2b0e6452d730ecc874930ade
SHA256804c577d54a35e81c8eac74bf00f00adb7fe0c8760368aedde3fb285a5d565bf
SHA512d552ec2cf828e1aed89d390c39d26ff5ebb980fac3c7e75ca37ff87730579f633d1361c19eb10c6594bc13edadf448b5ceb0f0556fdab51280c26d0edbc65ba0
-
Filesize
346KB
MD51a51297ffee085d6d9c0a8259fa2675c
SHA16bb948a2b3a4c97fa2fa1d69148d9e093769346e
SHA25678f4900fa7816990472666d27d70ddd090d6fa173c1809c060f72f6badea3485
SHA512c6a3a7e4928dd1772ea80a9a4362ffe05ce7c031fa7111777a3e01c7e143011d1ed773334f84c479eb93cf9fdb01856f025b8969cbd09591f20e34b854c16292
-
Filesize
1.9MB
MD586e39e9161c3d930d93822f1563c280d
SHA1f5944df4142983714a6d9955e6e393d9876c1e11
SHA2560b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
SHA5120a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
-
Filesize
680KB
MD514924c1b767c6e6a24be1235b250eb86
SHA16a11e672b51d597db871ede8dde868ef3cdea0a7
SHA2568148e8e6916f0df121f26fa5465021ce192546eea4c0a363859ef5ea39e65386
SHA5121200e08f1f0167cee1443ac4ec57cacdb468061295d8708d831a7947f4baf056027734ca73cdb2031af3ca1e1dd72c1f63563d309325aa0be7ebc0df14895e06
-
Filesize
80KB
MD5dc44c208f60e7451fad7a28455a8aee1
SHA19fba99f7f584f49005bd665b08ec21c382e2e307
SHA256cebbdd04b47d619b02fced2ca28aa19796f80ade141457ad391a5f1bff75ea51
SHA512e967eec6f8faa42876c95d6c9d3ecf6d4b9397622c8ab81cc2937148362d06dca69d56e25a218ffe69c625f542417b29b5d7b0d23ece8dbbcedca04625907788
-
Filesize
417KB
MD552c83a72943b529b7f495b0606c117b6
SHA1dcc74f5109a09c4cec8274f2968159c80016002d
SHA256b21ae0059a8182a51d1645a44f403429e60e26453353c0d708d7f501557ca01c
SHA51217179685e6e65c9130ccaea16c8953be818e4c6502595cb2e6dabebbc05f904e98b1797173e880ddfb64276cb0b53d48d8caae28457d1531160810af90eb6706
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
3.8MB
-
Filesize
1.3MB
-
Filesize
392KB
-
Filesize
520KB
-
Filesize
2.2MB
-
Filesize
744KB
-
Filesize
744KB