431675fcbb448567fafc83fee2b93c620ab7a7f5d3d7a7c7b922fec52d58deb2

General

Target
UltraUXThemePatcher_4.4.3.exe
Size 159KB
Sample241007-glspbstbjb
SHA256 431675fcbb448567fafc83fee2b93c620ab7a7f5d3d7a7c7b922fec52d58deb2
MD5 8992718c128b589e19216ef1609c50c3
SHA1 dee042937934ae88ba0adb59752ef5ed13edb0ad
SHA512 b517d678e8590fc100a9aae590f6d37d440452cfab97397a8b62f592a164598cbc0f5a21f65bab22e3c623faeff205d1b137d1f6d104a4792b472682767d65c9
SSDEEP 3072:qHadUuK8JdwYsawEuGstcRY/Ehsd8uKK0+GFlXtTkYgW7O14yaVHoxlL2iV:qHadpdwMct24E7FlXtTkY5qy5NsJ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
2860	takeown.exe
4760	takeown.exe
3216	icacls.exe
2820	takeown.exe
2492	takeown.exe
1200	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	UltraUXThemePatcher_4.4.3.exe

Loads dropped DLL 18 IoCs

pid	Process
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe
4152	UltraUXThemePatcher_4.4.3.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2492	takeown.exe
1200	icacls.exe
2860	takeown.exe
4760	takeown.exe
3216	icacls.exe
2820	takeown.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\uxinit.dll.backup	UltraUXThemePatcher_4.4.3.exe
File created	C:\Windows\System32\uxinit.dll.new	UltraUXThemePatcher_4.4.3.exe
File opened for modification	C:\Windows\system32\uxinit.dll.new	UltraUXThemePatcher_4.4.3.exe
File opened for modification	C:\Windows\system32\uxinit.dll.old	UltraUXThemePatcher_4.4.3.exe
File created	C:\Windows\System32\themeui.dll.backup	UltraUXThemePatcher_4.4.3.exe
File opened for modification	C:\Windows\System32\themeui.dll.backup	UltraUXThemePatcher_4.4.3.exe
File created	C:\Windows\System32\themeui.dll.new	UltraUXThemePatcher_4.4.3.exe
File opened for modification	C:\Windows\system32\themeui.dll.new	UltraUXThemePatcher_4.4.3.exe
File opened for modification	C:\Windows\system32\themeui.dll.old	UltraUXThemePatcher_4.4.3.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UltraUXThemePatcher\Uninstall.exe	UltraUXThemePatcher_4.4.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UltraUXThemePatcher_4.4.3.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a54fc9f1d525247c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a54fc9f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a54fc9f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da54fc9f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a54fc9f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4152	UltraUXThemePatcher_4.4.3.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	4416	vssvc.exe
Token: SeRestorePrivilege	4416	vssvc.exe
Token: SeAuditPrivilege	4416	vssvc.exe
Token: SeTakeOwnershipPrivilege	2492	takeown.exe
Token: SeTakeOwnershipPrivilege	4760	takeown.exe
Token: SeBackupPrivilege	3776	srtasks.exe
Token: SeRestorePrivilege	3776	srtasks.exe
Token: SeSecurityPrivilege	3776	srtasks.exe
Token: SeTakeOwnershipPrivilege	3776	srtasks.exe
Token: SeBackupPrivilege	3776	srtasks.exe
Token: SeRestorePrivilege	3776	srtasks.exe
Token: SeSecurityPrivilege	3776	srtasks.exe
Token: SeTakeOwnershipPrivilege	3776	srtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 2492	4152	UltraUXThemePatcher_4.4.3.exe	96
PID 4152 wrote to memory of 2492	4152	UltraUXThemePatcher_4.4.3.exe	96
PID 4152 wrote to memory of 1200	4152	UltraUXThemePatcher_4.4.3.exe	98
PID 4152 wrote to memory of 1200	4152	UltraUXThemePatcher_4.4.3.exe	98
PID 4152 wrote to memory of 2860	4152	UltraUXThemePatcher_4.4.3.exe	100
PID 4152 wrote to memory of 2860	4152	UltraUXThemePatcher_4.4.3.exe	100
PID 4152 wrote to memory of 4760	4152	UltraUXThemePatcher_4.4.3.exe	102
PID 4152 wrote to memory of 4760	4152	UltraUXThemePatcher_4.4.3.exe	102
PID 4152 wrote to memory of 3216	4152	UltraUXThemePatcher_4.4.3.exe	104
PID 4152 wrote to memory of 3216	4152	UltraUXThemePatcher_4.4.3.exe	104
PID 4152 wrote to memory of 2820	4152	UltraUXThemePatcher_4.4.3.exe	106
PID 4152 wrote to memory of 2820	4152	UltraUXThemePatcher_4.4.3.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\UltraUXThemePatcher_4.4.3.exe
"C:\Users\Admin\AppData\Local\Temp\UltraUXThemePatcher_4.4.3.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" "C:\Windows\system32\themeui.dll" /grant Admin:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1200
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2860
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" "C:\Windows\system32\uxinit.dll" /grant Admin:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3216
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2820

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

2

T1222

Windows File and Directory Permissions Modification

1

T1222.001

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SysRestore.dll

Path C:\Users\Admin\AppData\Local\Temp\nshA579.tmp\SysRestore.dll
Size 5KB
SHA256 c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e
MD5 4310bd09fc2300b106f0437b6e995330
SHA1 c6790a68e410d4a619b9b59e7540b702a98ad661
SHA512 49e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7
SSDEEP 48:S5SLAPmT5fqaB2WB2BtBAQPcPzRcCB0E3ngT2p2UlE41qSK1Gx:ASQM57LAfuQULRxB0E3gKU941LKQx
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nshA579.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nshA579.tmp\modern-wizard.bmp
Size 201KB
SHA256 aea40659bdb08337064640ea8b4f171881d37456b37b3e2899349ac04f0889c5
MD5 5f728e4e6b970db76c64be8ca3cafc87
SHA1 b7481efd9f6938903214451d792a8b13a645c922
SHA512 2cc4e870290f8faddc8eca1a03a1efb34711b3951e263a79f259fd998a9a1f957dbf58c110c5fe64febd414ec7a22e125353f9d5c363866bd0d4298452fdadc8
SSDEEP 768:/ou/hmB0wVZLLsg0fjA9hmgr+IYesuqftVraywBZM6mJRmYUt+Bmm:AUh8xVJHnaomftVraywfrmJRnUamm
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nshA579.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsisFile.dll

Path C:\Users\Admin\AppData\Local\Temp\nshA579.tmp\nsisFile.dll
Size 5KB
SHA256 a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
MD5 b7d0d765c151d235165823b48554e442
SHA1 fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA512 5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
SSDEEP 48:a+guelvxkcuEkVy5wM4zL5stbmaN0QpUFdAwsj1gAtl/lSFc/H9UhV0n:3CBxIEkVQwzR2300URs5ldSFcv9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

themeui.dll.new

Path C:\Windows\System32\themeui.dll.new
Size 390KB
SHA256 0970d5aaab9247f5b6c63534cb29ff6e1b2b99ba0e4d96bc69eae895e67237c3
MD5 bc377febaa39552cd323cf2d46805e91
SHA1 c812c62292c62f518a9feca5c0366b22c04aa9c3
SHA512 5c5adb024d051eea9d16dc6411a1445359e5d219c3776fddefc51ea098a2d3c9db4dee22db382976e6911ec159a09bebe4f6249b36a77891d69a490cd0a8eed7
SSDEEP 12288:t3hiGVPgE108hmkI7zIB0j7bTsKPtN9lddAHmuw48H4gg:dhlV2zz7j7brNfdSHZP8Hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

uxinit.dll.new

Path C:\Windows\System32\uxinit.dll.new
Size 121KB
SHA256 79bfb188b481a28bfa4fced64dc45eaa7fab7b0c5f435e85b02025ae6910377a
MD5 1249ecbaa8441b5f2425ca165b18bff3
SHA1 388fb66c58dedbd29e0b300406e7d20b2c7e8f6c
SHA512 8b75fa4df32fad47f249fa581b5a969cdf78df84bfe9e95f8bdcfbbe00a38da4c3711d797028a1f63d8cccf6cdbc40594c26aadf0ba419782b2991a474ba5c4c
SSDEEP 1536:bFl1jzr7B+qgi+lbEHEznZVZDR872mrbGTR1uDBkncZwwoBbKbZbQFPLDhb2Swjh:bVfp+qStbZFlR1uDynWaBbg9SftHwsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads