Overview

overview

8

Static

static

3

UltraUXThe....2.exe

windows11-21h2-x64

$PLUGINSDI...re.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...le.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    46s
  • max time network
    47s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/10/2024, 05:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    UltraUXThemePatcher_4.4.2.exe
  • Size 159KB
  • Sample241002-fywfbasfpd
  • SHA256 48fb5c4c2a2e6ab49bb10c599d69ab614d2c69f91854e00adaf5508d9ee14f7a
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
defense_evasiondiscoveryexploit

Malware Config

Signatures

  • Possible privilege escalation attempt 6 IoCs
    exploit
  • Loads dropped DLL 11 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\UltraUXThemePatcher_4.4.2.exe
    "C:\Users\Admin\AppData\Local\Temp\UltraUXThemePatcher_4.4.2.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:4696
    • C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Windows\system32\themeui.dll" /grant Admin:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:3816
    • C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:4224
    • C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:4792
    • C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Windows\system32\uxinit.dll" /grant Admin:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:4352
    • C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:2456
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2020
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3340
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3a1f855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3052

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SysRestore.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\SysRestore.dll
        • Size 5KB
        • SHA256 c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\System.dll
        • Size 12KB
        • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        modern-wizard.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\modern-wizard.bmp
        • Size 201KB
        • SHA256 aea40659bdb08337064640ea8b4f171881d37456b37b3e2899349ac04f0889c5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsisFile.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsnCDD1.tmp\nsisFile.dll
        • Size 5KB
        • SHA256 a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        themeui.dll.new
        • Path C:\Windows\System32\themeui.dll.new
        • Size 452KB
        • SHA256 a168df5b361469e957a8470d68fe2c4a1b664f519e6811b3ce7931ca7f01b669
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        uxinit.dll.new
        • Path C:\Windows\System32\uxinit.dll.new
        • Size 140KB
        • SHA256 59a124cff1d4ebd1a0043d7652ec3a241d736489626f05415f65bae3a45a13a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download