Analysis

  • max time kernel
    46s
  • max time network
    47s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02-10-2024 05:17

Errors

Reason
Machine shutdown

General

  • Target

    UltraUXThemePatcher_4.4.2.exe

  • Size

    159KB

  • MD5

    446db12350e471737925dc25e82eb21c

  • SHA1

    5082ba44dccc26f278adacaf5e8bf5d4424666aa

  • SHA256

    48fb5c4c2a2e6ab49bb10c599d69ab614d2c69f91854e00adaf5508d9ee14f7a

  • SHA512

    564b995e2c3a8585aa262670ab13ec744ec198bec703107c9e9f2e2a8322acd3064d485bd8f9509f6d15a491e635f3b714ae99bc0c57190ceb4c28d59d9b804a

  • SSDEEP

    3072:qHadUuK8JdwYsawEuGstMRc/EO4Igms05Cet09kpGGVWoEcfpIg21jQkCnYpcsua:qHadpdwMctGMEO4XmbhXpnIcakkCnHs9

Malware Config

Signatures

  • Possible privilege escalation attempt 6 IoCs
  • Loads dropped DLL 11 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\UltraUXThemePatcher_4.4.2.exe
    "C:\Users\Admin\AppData\Local\Temp\UltraUXThemePatcher_4.4.2.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:4696
    • C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Windows\system32\themeui.dll" /grant Admin:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:3816
    • C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:4224
    • C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:4792
    • C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Windows\system32\uxinit.dll" /grant Admin:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:4352
    • C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:2456
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2020
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3340
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3a1f855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\SysRestore.dll

    Filesize

    5KB

    MD5

    4310bd09fc2300b106f0437b6e995330

    SHA1

    c6790a68e410d4a619b9b59e7540b702a98ad661

    SHA256

    c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e

    SHA512

    49e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7

  • C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\System.dll

    Filesize

    12KB

    MD5

    192639861e3dc2dc5c08bb8f8c7260d5

    SHA1

    58d30e460609e22fa0098bc27d928b689ef9af78

    SHA256

    23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

    SHA512

    6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

  • C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\modern-wizard.bmp

    Filesize

    201KB

    MD5

    5f728e4e6b970db76c64be8ca3cafc87

    SHA1

    b7481efd9f6938903214451d792a8b13a645c922

    SHA256

    aea40659bdb08337064640ea8b4f171881d37456b37b3e2899349ac04f0889c5

    SHA512

    2cc4e870290f8faddc8eca1a03a1efb34711b3951e263a79f259fd998a9a1f957dbf58c110c5fe64febd414ec7a22e125353f9d5c363866bd0d4298452fdadc8

  • C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    b7d61f3f56abf7b7ff0d4e7da3ad783d

    SHA1

    15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

    SHA256

    89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

    SHA512

    6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

  • C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\nsisFile.dll

    Filesize

    5KB

    MD5

    b7d0d765c151d235165823b48554e442

    SHA1

    fe530e6c6fd60392d4ce611b21ec9daad3f1bc84

    SHA256

    a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587

    SHA512

    5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66

  • C:\Windows\System32\themeui.dll.new

    Filesize

    452KB

    MD5

    48359e4ea17198c341697a50bd359ea3

    SHA1

    b178b6b3317ec0365b10f4b493fd80fbc85c709e

    SHA256

    a168df5b361469e957a8470d68fe2c4a1b664f519e6811b3ce7931ca7f01b669

    SHA512

    24ddd3c396630ce820d599168f856575bec19c065f73535565898d2eefc63b7c0515d56a4defee693328cb4b8e830ad1640b33e5ab316d8cd98be3aebc958075

  • C:\Windows\System32\uxinit.dll.new

    Filesize

    140KB

    MD5

    83f209434ea9b3f4f48f0dc498dc9a7a

    SHA1

    49ef0f3c6d6e76e121a4cc480737677d303f5f9b

    SHA256

    59a124cff1d4ebd1a0043d7652ec3a241d736489626f05415f65bae3a45a13a2

    SHA512

    15b58125e0803bcf1e2b0827a9544d4390c6721931b82d238f856dab07a51db11f27d64f9595bd625999863a2160934119edf5537e67799206ed248e89c438c1