a48167c15a4d8e0d2315190ab672c8a5ce41978cfe7bcd6f74710a474795a161 | Triage

Sharing

General

Target

UCK.exe.vir
Size

69.3MB
Sample

240821-ka9egsydkb
MD5

887684673f599f97b51b698decbe315f
SHA1

abd983ff5b007f8937aadbf550a035dc08118f62
SHA256

a48167c15a4d8e0d2315190ab672c8a5ce41978cfe7bcd6f74710a474795a161
SHA512

9d8d775807109b37f853734b410387eaaf8a52679dc338b1a874168b2a72149743798452967cfc6d475f3ff0974178beb48c71dcbbf844fe7b471a819d0bdb3e
SSDEEP

1572864:IklYCjxMgp23PnpSRxxhaz/+df11/GgzBGQIj5Oi:7y+9unkRxDw/Mf/pBGRj5

Score

10^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  UCK.exe.vir
- Size
  
  69.3MB
- MD5
  
  887684673f599f97b51b698decbe315f
- SHA1
  
  abd983ff5b007f8937aadbf550a035dc08118f62
- SHA256
  
  a48167c15a4d8e0d2315190ab672c8a5ce41978cfe7bcd6f74710a474795a161
- SHA512
  
  9d8d775807109b37f853734b410387eaaf8a52679dc338b1a874168b2a72149743798452967cfc6d475f3ff0974178beb48c71dcbbf844fe7b471a819d0bdb3e
- SSDEEP
  
  1572864:IklYCjxMgp23PnpSRxxhaz/+df11/GgzBGQIj5Oi:7y+9unkRxDw/Mf/pBGRj5
Score

10^/10

discovery evasion persistence privilege_escalation trojan
- UAC bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalationtrojan