General

  • Target

    UltraUXThemePatcher_4.4.3.exe

  • Size

    159KB

  • Sample

    241007-glspbstbjb

  • MD5

    8992718c128b589e19216ef1609c50c3

  • SHA1

    dee042937934ae88ba0adb59752ef5ed13edb0ad

  • SHA256

    431675fcbb448567fafc83fee2b93c620ab7a7f5d3d7a7c7b922fec52d58deb2

  • SHA512

    b517d678e8590fc100a9aae590f6d37d440452cfab97397a8b62f592a164598cbc0f5a21f65bab22e3c623faeff205d1b137d1f6d104a4792b472682767d65c9

  • SSDEEP

    3072:qHadUuK8JdwYsawEuGstcRY/Ehsd8uKK0+GFlXtTkYgW7O14yaVHoxlL2iV:qHadpdwMct24E7FlXtTkY5qy5NsJ

Malware Config

Targets

    • Target

      UltraUXThemePatcher_4.4.3.exe

    • Size

      159KB

    • MD5

      8992718c128b589e19216ef1609c50c3

    • SHA1

      dee042937934ae88ba0adb59752ef5ed13edb0ad

    • SHA256

      431675fcbb448567fafc83fee2b93c620ab7a7f5d3d7a7c7b922fec52d58deb2

    • SHA512

      b517d678e8590fc100a9aae590f6d37d440452cfab97397a8b62f592a164598cbc0f5a21f65bab22e3c623faeff205d1b137d1f6d104a4792b472682767d65c9

    • SSDEEP

      3072:qHadUuK8JdwYsawEuGstcRY/Ehsd8uKK0+GFlXtTkYgW7O14yaVHoxlL2iV:qHadpdwMct24E7FlXtTkY5qy5NsJ

    • Possible privilege escalation attempt

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    • Drops file in System32 directory

    • Target

      $PLUGINSDIR/SysRestore.dll

    • Size

      5KB

    • MD5

      4310bd09fc2300b106f0437b6e995330

    • SHA1

      c6790a68e410d4a619b9b59e7540b702a98ad661

    • SHA256

      c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e

    • SHA512

      49e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7

    • SSDEEP

      48:S5SLAPmT5fqaB2WB2BtBAQPcPzRcCB0E3ngT2p2UlE41qSK1Gx:ASQM57LAfuQULRxB0E3gKU941LKQx

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      192639861e3dc2dc5c08bb8f8c7260d5

    • SHA1

      58d30e460609e22fa0098bc27d928b689ef9af78

    • SHA256

      23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

    • SHA512

      6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

    • SSDEEP

      192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      b7d61f3f56abf7b7ff0d4e7da3ad783d

    • SHA1

      15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

    • SHA256

      89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

    • SHA512

      6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

    • SSDEEP

      96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc

    Score
    3/10
    • Target

      $PLUGINSDIR/nsisFile.dll

    • Size

      5KB

    • MD5

      b7d0d765c151d235165823b48554e442

    • SHA1

      fe530e6c6fd60392d4ce611b21ec9daad3f1bc84

    • SHA256

      a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587

    • SHA512

      5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66

    • SSDEEP

      48:a+guelvxkcuEkVy5wM4zL5stbmaN0QpUFdAwsj1gAtl/lSFc/H9UhV0n:3CBxIEkVQwzR2300URs5ldSFcv9c

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks