48c616cbb15b33f9f8001ae8074e8f68657f604bb20b923ddb6722f752427a9e

Analysis

max time kernel
140s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UUSeePlayer.exe
Size

421KB
MD5

9ab0941a1c54567373b6afed3f2ed491
SHA1

e0b8328027c65d4904e63124f80dc69e77ec0e6a
SHA256

b99716d09b8aa83e4cad5d9d889a144ddb04f8fe1f7f5bb58c656d873c3d04fb
SHA512

e79491c9c88775a735c9190d7a3d0536b62f62255f8da947358442309916a873d6923fa74cec237a1619ef12ecb2488b61394fb2058f3771ce621d7824190725
SSDEEP

6144:wk37CXfkVQp0lV731pO8nhJFSVpInCOXJYE56NnGrpk3iRYjZt5Bo:D7CXff0lN31NtWsYE565GCSRYjZt5Bo

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\UUSeePlayer.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UUSeePlayer.exe:*:Enabled:UUPlayer"	UUSeePlayer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UUSeePlayer.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main	UUSeePlayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	UUSeePlayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	UUSeePlayer.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEEREC\ = "URL:UUSEEREC Protocol"	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEENOTIFY\ = "URL:UUSEENOTIFY Protocol"	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEENOTIFY\shell	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE.ucf\Shell\Open	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE\URL Protocol	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE.ucf\DefaultIcon	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE.ucf\Shell	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE.ucf\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UUSeePlayer.exe\" -file \"%1\""	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UUSeePlayer.exe\" -v UUPlayer -url \"%1\""	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEEREC\shell\open\command	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEEREC\shell	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE\ = "URL:UUSEE Protocol"	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE\shell\open	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEEREC\shell\open	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ucf	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE.ucf\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UUSeePlayer.exe\",-150"	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE.ucf\Shell\Open\Command	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEEREC\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UUSeePlayer.exe\" -v UUPlayer -url \"%1\""	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEENOTIFY\shell\open\command	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ucf\ = "UUSEE.ucf"	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE.ucf	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE.ucf\ = "UUSEE Media File"	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEENOTIFY\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UUSeePlayer.exe\" -v UUPlayer -url \"%1\""	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE\shell\open\command	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEEREC	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEEREC\URL Protocol	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEENOTIFY	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEE\shell	UUSeePlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEENOTIFY\shell\open	UUSeePlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUSEENOTIFY\URL Protocol	UUSeePlayer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
904	UUSeePlayer.exe
904	UUSeePlayer.exe
904	UUSeePlayer.exe
904	UUSeePlayer.exe
904	UUSeePlayer.exe
904	UUSeePlayer.exe
904	UUSeePlayer.exe

C:\Users\Admin\AppData\Local\Temp\UUSeePlayer.exe
"C:\Users\Admin\AppData\Local\Temp\UUSeePlayer.exe"
1⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UUAD_Message.html

Filesize
419B

MD5
e1344a235249aee1e45f7400dbe7c303

SHA1
15f248fd4d9e8ee035999cc0ba83451d226ee0f4

SHA256
acb213a7e6b29b4bd2f3dce7d086c7187d1de96237e4d1125af099ae9f5d5fdf

SHA512
d237c38f451c2be81abf022b5400464d3daad87fdf872f6b5c69ffad04f384784f3033735fab9e20b6aed46aacd5771864f5a315df8499b7dd91ba7508df117f

Download Submit
memory/904-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/904-1-0x0000000000481000-0x0000000000482000-memory.dmp

Filesize
4KB

Download
memory/904-2-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/904-3-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/904-4-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/904-5-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/904-22-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/904-23-0x0000000000481000-0x0000000000482000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads