9f330b9235b7e96e57ffc3aebbb08573f2824e895889a96a650de9316a959f0d

Analysis

max time kernel
133s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UgPhone.exe
Size

130.1MB
MD5

b15e411ff8e001a75f453262f8f7e6c0
SHA1

c4173c0c6e3490cc51249a0b31d16deb0dc60661
SHA256

81f178fef70e5a05bfaf70e3ca0cec93002b6d0ada112fd33c5454ea8237a59e
SHA512

4d734a55b1ab890265e135352ea8c2f7d7683388574bd5288af80c9c58a9bd8a893df0442c250b65c88717bb66ef79cd9f59f6ab8a13562ae4b33502f341806f
SSDEEP

1572864:hK/gNQW2SJeFf769vh9hwK9opP8rju/BRcjmmRm1WWn:E46WVJeFz690ujm7WWn

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UgPhone.exeUgPhone.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	UgPhone.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	UgPhone.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

UgPhone.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	UgPhone.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	UgPhone.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

UgPhone.exeUgPhone.exeUgPhone.exe

pid process

2728 UgPhone.exe
2224 UgPhone.exe
2112 UgPhone.exe
2112 UgPhone.exe

pid	process
2728	UgPhone.exe
2224	UgPhone.exe
2112	UgPhone.exe
2112	UgPhone.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

UgPhone.exe

description	pid	process	target process
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2588	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2728	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2728	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2728	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2224	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2224	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2224	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1928	2112	UgPhone.exe	UgPhone.exe

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1068,8401978450570027965,12288640907284071434,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1080 /prefetch:2
2⤵
PID:2588

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,8401978450570027965,12288640907284071434,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=1276 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2728

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=renderer --field-trial-handle=1068,8401978450570027965,12288640907284071434,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1396 /prefetch:1
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2224

C:\Users\Admin\AppData\Local\Temp\UgPhone.exe
"C:\Users\Admin\AppData\Local\Temp\UgPhone.exe" --type=gpu-process --field-trial-handle=1068,8401978450570027965,12288640907284071434,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1080 /prefetch:2
2⤵
PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
memory/2588-1-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2588-33-0x0000000077410000-0x0000000077411000-memory.dmp

Filesize
4KB

Download