Analysis
-
max time kernel
46s -
max time network
47s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-10-2024 05:17
Static task
static1
Behavioral task
behavioral1
Sample
UltraUXThemePatcher_4.4.2.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SysRestore.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisFile.dll
Resource
win11-20240802-en
Errors
General
-
Target
UltraUXThemePatcher_4.4.2.exe
-
Size
159KB
-
MD5
446db12350e471737925dc25e82eb21c
-
SHA1
5082ba44dccc26f278adacaf5e8bf5d4424666aa
-
SHA256
48fb5c4c2a2e6ab49bb10c599d69ab614d2c69f91854e00adaf5508d9ee14f7a
-
SHA512
564b995e2c3a8585aa262670ab13ec744ec198bec703107c9e9f2e2a8322acd3064d485bd8f9509f6d15a491e635f3b714ae99bc0c57190ceb4c28d59d9b804a
-
SSDEEP
3072:qHadUuK8JdwYsawEuGstMRc/EO4Igms05Cet09kpGGVWoEcfpIg21jQkCnYpcsua:qHadpdwMctGMEO4XmbhXpnIcakkCnHs9
Malware Config
Signatures
-
Possible privilege escalation attempt 6 IoCs
Processes:
takeown.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exepid Process 2456 takeown.exe 4696 takeown.exe 3816 icacls.exe 4224 takeown.exe 4792 takeown.exe 4352 icacls.exe -
Loads dropped DLL 11 IoCs
Processes:
UltraUXThemePatcher_4.4.2.exepid Process 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe 3080 UltraUXThemePatcher_4.4.2.exe -
Modifies file permissions 1 TTPs 6 IoCs
Processes:
icacls.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exepid Process 3816 icacls.exe 4224 takeown.exe 4792 takeown.exe 4352 icacls.exe 2456 takeown.exe 4696 takeown.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Drops file in System32 directory 9 IoCs
Processes:
UltraUXThemePatcher_4.4.2.exedescription ioc Process File created C:\Windows\System32\themeui.dll.backup UltraUXThemePatcher_4.4.2.exe File opened for modification C:\Windows\System32\themeui.dll.backup UltraUXThemePatcher_4.4.2.exe File created C:\Windows\System32\themeui.dll.new UltraUXThemePatcher_4.4.2.exe File created C:\Windows\System32\uxinit.dll.backup UltraUXThemePatcher_4.4.2.exe File created C:\Windows\System32\uxinit.dll.new UltraUXThemePatcher_4.4.2.exe File opened for modification C:\Windows\system32\uxinit.dll.old UltraUXThemePatcher_4.4.2.exe File opened for modification C:\Windows\system32\themeui.dll.new UltraUXThemePatcher_4.4.2.exe File opened for modification C:\Windows\system32\themeui.dll.old UltraUXThemePatcher_4.4.2.exe File opened for modification C:\Windows\system32\uxinit.dll.new UltraUXThemePatcher_4.4.2.exe -
Drops file in Program Files directory 1 IoCs
Processes:
UltraUXThemePatcher_4.4.2.exedescription ioc Process File created C:\Program Files (x86)\UltraUXThemePatcher\Uninstall.exe UltraUXThemePatcher_4.4.2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
UltraUXThemePatcher_4.4.2.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UltraUXThemePatcher_4.4.2.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006586dee215ef0e8b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006586dee20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006586dee2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6586dee2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006586dee200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "200" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
UltraUXThemePatcher_4.4.2.exepid Process 3080 UltraUXThemePatcher_4.4.2.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
vssvc.exetakeown.exetakeown.exesrtasks.exeUltraUXThemePatcher_4.4.2.exedescription pid Process Token: SeBackupPrivilege 2020 vssvc.exe Token: SeRestorePrivilege 2020 vssvc.exe Token: SeAuditPrivilege 2020 vssvc.exe Token: SeTakeOwnershipPrivilege 4696 takeown.exe Token: SeTakeOwnershipPrivilege 4792 takeown.exe Token: SeBackupPrivilege 3340 srtasks.exe Token: SeRestorePrivilege 3340 srtasks.exe Token: SeSecurityPrivilege 3340 srtasks.exe Token: SeTakeOwnershipPrivilege 3340 srtasks.exe Token: SeBackupPrivilege 3340 srtasks.exe Token: SeRestorePrivilege 3340 srtasks.exe Token: SeSecurityPrivilege 3340 srtasks.exe Token: SeTakeOwnershipPrivilege 3340 srtasks.exe Token: SeShutdownPrivilege 3080 UltraUXThemePatcher_4.4.2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid Process 3052 LogonUI.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
UltraUXThemePatcher_4.4.2.exedescription pid Process procid_target PID 3080 wrote to memory of 4696 3080 UltraUXThemePatcher_4.4.2.exe 84 PID 3080 wrote to memory of 4696 3080 UltraUXThemePatcher_4.4.2.exe 84 PID 3080 wrote to memory of 3816 3080 UltraUXThemePatcher_4.4.2.exe 86 PID 3080 wrote to memory of 3816 3080 UltraUXThemePatcher_4.4.2.exe 86 PID 3080 wrote to memory of 4224 3080 UltraUXThemePatcher_4.4.2.exe 88 PID 3080 wrote to memory of 4224 3080 UltraUXThemePatcher_4.4.2.exe 88 PID 3080 wrote to memory of 4792 3080 UltraUXThemePatcher_4.4.2.exe 90 PID 3080 wrote to memory of 4792 3080 UltraUXThemePatcher_4.4.2.exe 90 PID 3080 wrote to memory of 4352 3080 UltraUXThemePatcher_4.4.2.exe 92 PID 3080 wrote to memory of 4352 3080 UltraUXThemePatcher_4.4.2.exe 92 PID 3080 wrote to memory of 2456 3080 UltraUXThemePatcher_4.4.2.exe 94 PID 3080 wrote to memory of 2456 3080 UltraUXThemePatcher_4.4.2.exe 94 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\UltraUXThemePatcher_4.4.2.exe"C:\Users\Admin\AppData\Local\Temp\UltraUXThemePatcher_4.4.2.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Windows\system32\themeui.dll" /grant Admin:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3816
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4224
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Windows\system32\uxinit.dll" /grant Admin:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4352
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2456
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:3340
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a1f855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3052
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54310bd09fc2300b106f0437b6e995330
SHA1c6790a68e410d4a619b9b59e7540b702a98ad661
SHA256c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e
SHA51249e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7
-
Filesize
12KB
MD5192639861e3dc2dc5c08bb8f8c7260d5
SHA158d30e460609e22fa0098bc27d928b689ef9af78
SHA25623d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
SHA5126e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
-
Filesize
201KB
MD55f728e4e6b970db76c64be8ca3cafc87
SHA1b7481efd9f6938903214451d792a8b13a645c922
SHA256aea40659bdb08337064640ea8b4f171881d37456b37b3e2899349ac04f0889c5
SHA5122cc4e870290f8faddc8eca1a03a1efb34711b3951e263a79f259fd998a9a1f957dbf58c110c5fe64febd414ec7a22e125353f9d5c363866bd0d4298452fdadc8
-
Filesize
9KB
MD5b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA115ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA25689a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
SHA5126467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
-
Filesize
5KB
MD5b7d0d765c151d235165823b48554e442
SHA1fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA256a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
SHA5125d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
-
Filesize
452KB
MD548359e4ea17198c341697a50bd359ea3
SHA1b178b6b3317ec0365b10f4b493fd80fbc85c709e
SHA256a168df5b361469e957a8470d68fe2c4a1b664f519e6811b3ce7931ca7f01b669
SHA51224ddd3c396630ce820d599168f856575bec19c065f73535565898d2eefc63b7c0515d56a4defee693328cb4b8e830ad1640b33e5ab316d8cd98be3aebc958075
-
Filesize
140KB
MD583f209434ea9b3f4f48f0dc498dc9a7a
SHA149ef0f3c6d6e76e121a4cc480737677d303f5f9b
SHA25659a124cff1d4ebd1a0043d7652ec3a241d736489626f05415f65bae3a45a13a2
SHA51215b58125e0803bcf1e2b0827a9544d4390c6721931b82d238f856dab07a51db11f27d64f9595bd625999863a2160934119edf5537e67799206ed248e89c438c1