Overview
overview
8Static
static
3UltraUXThe....2.exe
windows7-x64
7UltraUXThe....2.exe
windows10-2004-x64
$PLUGINSDI...re.dll
windows7-x64
3$PLUGINSDI...re.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...le.dll
windows7-x64
3$PLUGINSDI...le.dll
windows10-2004-x64
3$TEMP/image.bmp
windows7-x64
3$TEMP/image.bmp
windows10-2004-x64
7General
-
Target
UltraUXThemePatcher_4.4.2.exe
-
Size
159KB
-
Sample
240817-y8zjtsveqf
-
MD5
446db12350e471737925dc25e82eb21c
-
SHA1
5082ba44dccc26f278adacaf5e8bf5d4424666aa
-
SHA256
48fb5c4c2a2e6ab49bb10c599d69ab614d2c69f91854e00adaf5508d9ee14f7a
-
SHA512
564b995e2c3a8585aa262670ab13ec744ec198bec703107c9e9f2e2a8322acd3064d485bd8f9509f6d15a491e635f3b714ae99bc0c57190ceb4c28d59d9b804a
-
SSDEEP
3072:qHadUuK8JdwYsawEuGstMRc/EO4Igms05Cet09kpGGVWoEcfpIg21jQkCnYpcsua:qHadpdwMctGMEO4XmbhXpnIcakkCnHs9
Static task
static1
Behavioral task
behavioral1
Sample
UltraUXThemePatcher_4.4.2.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
UltraUXThemePatcher_4.4.2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SysRestore.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SysRestore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsisFile.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsisFile.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$TEMP/image.bmp
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$TEMP/image.bmp
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
UltraUXThemePatcher_4.4.2.exe
-
Size
159KB
-
MD5
446db12350e471737925dc25e82eb21c
-
SHA1
5082ba44dccc26f278adacaf5e8bf5d4424666aa
-
SHA256
48fb5c4c2a2e6ab49bb10c599d69ab614d2c69f91854e00adaf5508d9ee14f7a
-
SHA512
564b995e2c3a8585aa262670ab13ec744ec198bec703107c9e9f2e2a8322acd3064d485bd8f9509f6d15a491e635f3b714ae99bc0c57190ceb4c28d59d9b804a
-
SSDEEP
3072:qHadUuK8JdwYsawEuGstMRc/EO4Igms05Cet09kpGGVWoEcfpIg21jQkCnYpcsua:qHadpdwMctGMEO4XmbhXpnIcakkCnHs9
Score8/10-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Drops file in System32 directory
-
-
-
Target
$PLUGINSDIR/SysRestore.dll
-
Size
5KB
-
MD5
4310bd09fc2300b106f0437b6e995330
-
SHA1
c6790a68e410d4a619b9b59e7540b702a98ad661
-
SHA256
c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e
-
SHA512
49e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7
-
SSDEEP
48:S5SLAPmT5fqaB2WB2BtBAQPcPzRcCB0E3ngT2p2UlE41qSK1Gx:ASQM57LAfuQULRxB0E3gKU941LKQx
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
192639861e3dc2dc5c08bb8f8c7260d5
-
SHA1
58d30e460609e22fa0098bc27d928b689ef9af78
-
SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
-
SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
-
SSDEEP
192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
Score3/10 -
-
-
Target
$PLUGINSDIR/modern-wizard.bmp
-
Size
201KB
-
MD5
5f728e4e6b970db76c64be8ca3cafc87
-
SHA1
b7481efd9f6938903214451d792a8b13a645c922
-
SHA256
aea40659bdb08337064640ea8b4f171881d37456b37b3e2899349ac04f0889c5
-
SHA512
2cc4e870290f8faddc8eca1a03a1efb34711b3951e263a79f259fd998a9a1f957dbf58c110c5fe64febd414ec7a22e125353f9d5c363866bd0d4298452fdadc8
-
SSDEEP
768:/ou/hmB0wVZLLsg0fjA9hmgr+IYesuqftVraywBZM6mJRmYUt+Bmm:AUh8xVJHnaomftVraywfrmJRnUamm
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
b7d61f3f56abf7b7ff0d4e7da3ad783d
-
SHA1
15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
-
SHA256
89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
-
SHA512
6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
-
SSDEEP
96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
Score3/10 -
-
-
Target
$PLUGINSDIR/nsisFile.dll
-
Size
5KB
-
MD5
b7d0d765c151d235165823b48554e442
-
SHA1
fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
-
SHA256
a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
-
SHA512
5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
-
SSDEEP
48:a+guelvxkcuEkVy5wM4zL5stbmaN0QpUFdAwsj1gAtl/lSFc/H9UhV0n:3CBxIEkVQwzR2300URs5ldSFcv9c
Score3/10 -
-
-
Target
$TEMP/image.bmp
-
Size
29KB
-
MD5
f5c857165c1ab170316b905666d7cc08
-
SHA1
e56b59d1fec84ff4a3600fc125b06172fbad5d95
-
SHA256
ebbe6a400cab4901c942338b9387939721921d571f3ee1c6a236a001bffae022
-
SHA512
a744324831d951c628d3c67332c98a7a641bdb1a5e4ea953bcb030212a36e5f70159be4313d045bd0d50a642bd2027c871225589aa7cb3b32989d1375eb6ad4e
-
SSDEEP
192:ZGyfUH/UIvqQ3v6cmy+Z/X2WbnRhlndHEs:1m/zSQ3v6by+Z/mWbHldHEs
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1