0acebaf80946be0cb3099233e8807aa775c8304fc3dee48d42241ff68b7ab318

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
05/12/2020, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ca6df4914385efd4ba9cd239b5ed254.exe
Size 4.5MB
Sample201205-wygr8zgpvx
SHA256 0acebaf80946be0cb3099233e8807aa775c8304fc3dee48d42241ff68b7ab318
MD5 3ca6df4914385efd4ba9cd239b5ed254
SHA1 b66535ff43334177a5a167b9f2b07ade75484eec
SHA512 7951ab74ecd2ea26ed7bbcbc8bf34a770854a8fb009f256f93d72c705871b5a31c24153cc77581eec6544085cdbb51a170b2b7ef9f3f9139572b818d75424ca6
MD5 SHA1 SHA512

Score

8^/10

bootkit macro persistence spyware

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1144	setup.exe
1672	aliens.exe
1276	1E1C360C582DF797.exe
516	1E1C360C582DF797.exe
1996	ThunderFW.exe
1696	MiniThunderPlatform.exe
1200	23E04C4F32EF2158.exe
1180	23E04C4F32EF2158.tmp

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro

resource	yara_rule
behavioral1/files/0x00040000000130db-19.dat	office_xlm_macros

Loads dropped DLL 23 IoCs

pid	Process
1744	3ca6df4914385efd4ba9cd239b5ed254.exe
1744	3ca6df4914385efd4ba9cd239b5ed254.exe
1744	3ca6df4914385efd4ba9cd239b5ed254.exe
1744	3ca6df4914385efd4ba9cd239b5ed254.exe
1144	setup.exe
1064	MsiExec.exe
1672	aliens.exe
1672	aliens.exe
1276	1E1C360C582DF797.exe
1276	1E1C360C582DF797.exe
1276	1E1C360C582DF797.exe
1276	1E1C360C582DF797.exe
1276	1E1C360C582DF797.exe
1276	1E1C360C582DF797.exe
1696	MiniThunderPlatform.exe
1696	MiniThunderPlatform.exe
1696	MiniThunderPlatform.exe
1696	MiniThunderPlatform.exe
1696	MiniThunderPlatform.exe
1696	MiniThunderPlatform.exe
1696	MiniThunderPlatform.exe
1276	1E1C360C582DF797.exe
1200	23E04C4F32EF2158.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

JavaScript code in executable 3 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130db-19.dat	js
behavioral1/files/0x000300000001310d-67.dat	js
behavioral1/files/0x000300000001310d-66.dat	js

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	aliens.exe
File opened for modification	\??\PhysicalDrive0	1E1C360C582DF797.exe
File opened for modification	\??\PhysicalDrive0	1E1C360C582DF797.exe
File opened for modification	\??\PhysicalDrive0	MiniThunderPlatform.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1672	aliens.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 1876	1276	1E1C360C582DF797.exe	39
PID 1276 set thread context of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 set thread context of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 set thread context of 1528	1276	1E1C360C582DF797.exe	51

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\71eza90awf48	setup.exe
File created	C:\Program Files (x86)\71eza90awf48\__tmp_rar_sfx_access_check_259263880	setup.exe
File created	C:\Program Files (x86)\71eza90awf48\aliens.exe	setup.exe
File opened for modification	C:\Program Files (x86)\71eza90awf48\aliens.exe	setup.exe
File opened for modification	C:\Program Files (x86)\RearRips\DreamTrip.exe	23E04C4F32EF2158.tmp
File opened for modification	C:\Program Files (x86)\RearRips\seed.sfx.exe	23E04C4F32EF2158.tmp

NSIS installer 16 IoCs

installer

resource	yara_rule
behavioral1/files/0x00040000000130df-13.dat	nsis_installer_1
behavioral1/files/0x00040000000130df-13.dat	nsis_installer_2
behavioral1/files/0x00040000000130df-15.dat	nsis_installer_1
behavioral1/files/0x00040000000130df-15.dat	nsis_installer_2
behavioral1/files/0x00040000000130df-16.dat	nsis_installer_1
behavioral1/files/0x00040000000130df-16.dat	nsis_installer_2
behavioral1/files/0x00040000000130da-24.dat	nsis_installer_1
behavioral1/files/0x00040000000130da-24.dat	nsis_installer_2
behavioral1/files/0x00040000000130da-27.dat	nsis_installer_1
behavioral1/files/0x00040000000130da-27.dat	nsis_installer_2
behavioral1/files/0x00040000000130da-29.dat	nsis_installer_1
behavioral1/files/0x00040000000130da-29.dat	nsis_installer_2
behavioral1/files/0x00040000000130da-26.dat	nsis_installer_1
behavioral1/files/0x00040000000130da-26.dat	nsis_installer_2
behavioral1/files/0x00040000000130da-31.dat	nsis_installer_1
behavioral1/files/0x00040000000130da-31.dat	nsis_installer_2

Kills process with taskkill 1 IoCs

evasion

pid	Process
1448	taskkill.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	aliens.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	1E1C360C582DF797.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0f0000000100000020000000f58d226a1455ea81e8c8df37b8c942f342ebbc60a29701fc2895ec13140104610300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	1E1C360C582DF797.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 140000000100000014000000f8d0dc54367cf794020f8b92783a5d8a91251f9f0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd0f0000000100000020000000f58d226a1455ea81e8c8df37b8c942f342ebbc60a29701fc2895ec13140104612000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	1E1C360C582DF797.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 19000000010000001000000018e847daffeaedafa0faaea36340ea790f0000000100000020000000f58d226a1455ea81e8c8df37b8c942f342ebbc60a29701fc2895ec13140104610300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd140000000100000014000000f8d0dc54367cf794020f8b92783a5d8a91251f9f2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	1E1C360C582DF797.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	aliens.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1860	PING.EXE
1264	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1180	23E04C4F32EF2158.tmp
1180	23E04C4F32EF2158.tmp

Suspicious use of AdjustPrivilegeToken 94 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1504	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1504	msiexec.exe
Token: SeRestorePrivilege	340	msiexec.exe
Token: SeTakeOwnershipPrivilege	340	msiexec.exe
Token: SeSecurityPrivilege	340	msiexec.exe
Token: SeCreateTokenPrivilege	1504	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1504	msiexec.exe
Token: SeLockMemoryPrivilege	1504	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1504	msiexec.exe
Token: SeMachineAccountPrivilege	1504	msiexec.exe
Token: SeTcbPrivilege	1504	msiexec.exe
Token: SeSecurityPrivilege	1504	msiexec.exe
Token: SeTakeOwnershipPrivilege	1504	msiexec.exe
Token: SeLoadDriverPrivilege	1504	msiexec.exe
Token: SeSystemProfilePrivilege	1504	msiexec.exe
Token: SeSystemtimePrivilege	1504	msiexec.exe
Token: SeProfSingleProcessPrivilege	1504	msiexec.exe
Token: SeIncBasePriorityPrivilege	1504	msiexec.exe
Token: SeCreatePagefilePrivilege	1504	msiexec.exe
Token: SeCreatePermanentPrivilege	1504	msiexec.exe
Token: SeBackupPrivilege	1504	msiexec.exe
Token: SeRestorePrivilege	1504	msiexec.exe
Token: SeShutdownPrivilege	1504	msiexec.exe
Token: SeDebugPrivilege	1504	msiexec.exe
Token: SeAuditPrivilege	1504	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1504	msiexec.exe
Token: SeChangeNotifyPrivilege	1504	msiexec.exe
Token: SeRemoteShutdownPrivilege	1504	msiexec.exe
Token: SeUndockPrivilege	1504	msiexec.exe
Token: SeSyncAgentPrivilege	1504	msiexec.exe
Token: SeEnableDelegationPrivilege	1504	msiexec.exe
Token: SeManageVolumePrivilege	1504	msiexec.exe
Token: SeImpersonatePrivilege	1504	msiexec.exe
Token: SeCreateGlobalPrivilege	1504	msiexec.exe
Token: SeCreateTokenPrivilege	1504	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1504	msiexec.exe
Token: SeLockMemoryPrivilege	1504	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1504	msiexec.exe
Token: SeMachineAccountPrivilege	1504	msiexec.exe
Token: SeTcbPrivilege	1504	msiexec.exe
Token: SeSecurityPrivilege	1504	msiexec.exe
Token: SeTakeOwnershipPrivilege	1504	msiexec.exe
Token: SeLoadDriverPrivilege	1504	msiexec.exe
Token: SeSystemProfilePrivilege	1504	msiexec.exe
Token: SeSystemtimePrivilege	1504	msiexec.exe
Token: SeProfSingleProcessPrivilege	1504	msiexec.exe
Token: SeIncBasePriorityPrivilege	1504	msiexec.exe
Token: SeCreatePagefilePrivilege	1504	msiexec.exe
Token: SeCreatePermanentPrivilege	1504	msiexec.exe
Token: SeBackupPrivilege	1504	msiexec.exe
Token: SeRestorePrivilege	1504	msiexec.exe
Token: SeShutdownPrivilege	1504	msiexec.exe
Token: SeDebugPrivilege	1504	msiexec.exe
Token: SeAuditPrivilege	1504	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1504	msiexec.exe
Token: SeChangeNotifyPrivilege	1504	msiexec.exe
Token: SeRemoteShutdownPrivilege	1504	msiexec.exe
Token: SeUndockPrivilege	1504	msiexec.exe
Token: SeSyncAgentPrivilege	1504	msiexec.exe
Token: SeEnableDelegationPrivilege	1504	msiexec.exe
Token: SeManageVolumePrivilege	1504	msiexec.exe
Token: SeImpersonatePrivilege	1504	msiexec.exe
Token: SeCreateGlobalPrivilege	1504	msiexec.exe
Token: SeCreateTokenPrivilege	1504	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1504	msiexec.exe
Token: SeLockMemoryPrivilege	1504	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1504	msiexec.exe
Token: SeMachineAccountPrivilege	1504	msiexec.exe
Token: SeTcbPrivilege	1504	msiexec.exe
Token: SeSecurityPrivilege	1504	msiexec.exe
Token: SeTakeOwnershipPrivilege	1504	msiexec.exe
Token: SeLoadDriverPrivilege	1504	msiexec.exe
Token: SeSystemProfilePrivilege	1504	msiexec.exe
Token: SeSystemtimePrivilege	1504	msiexec.exe
Token: SeProfSingleProcessPrivilege	1504	msiexec.exe
Token: SeIncBasePriorityPrivilege	1504	msiexec.exe
Token: SeCreatePagefilePrivilege	1504	msiexec.exe
Token: SeCreatePermanentPrivilege	1504	msiexec.exe
Token: SeBackupPrivilege	1504	msiexec.exe
Token: SeRestorePrivilege	1504	msiexec.exe
Token: SeShutdownPrivilege	1504	msiexec.exe
Token: SeDebugPrivilege	1504	msiexec.exe
Token: SeAuditPrivilege	1504	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1504	msiexec.exe
Token: SeChangeNotifyPrivilege	1504	msiexec.exe
Token: SeRemoteShutdownPrivilege	1504	msiexec.exe
Token: SeUndockPrivilege	1504	msiexec.exe
Token: SeSyncAgentPrivilege	1504	msiexec.exe
Token: SeEnableDelegationPrivilege	1504	msiexec.exe
Token: SeManageVolumePrivilege	1504	msiexec.exe
Token: SeImpersonatePrivilege	1504	msiexec.exe
Token: SeCreateGlobalPrivilege	1504	msiexec.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeManageVolumePrivilege	1696	MiniThunderPlatform.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1504	msiexec.exe

Suspicious use of WriteProcessMemory 120 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1144	1744	3ca6df4914385efd4ba9cd239b5ed254.exe	26
PID 1744 wrote to memory of 1144	1744	3ca6df4914385efd4ba9cd239b5ed254.exe	26
PID 1744 wrote to memory of 1144	1744	3ca6df4914385efd4ba9cd239b5ed254.exe	26
PID 1744 wrote to memory of 1144	1744	3ca6df4914385efd4ba9cd239b5ed254.exe	26
PID 1744 wrote to memory of 1144	1744	3ca6df4914385efd4ba9cd239b5ed254.exe	26
PID 1744 wrote to memory of 1144	1744	3ca6df4914385efd4ba9cd239b5ed254.exe	26
PID 1744 wrote to memory of 1144	1744	3ca6df4914385efd4ba9cd239b5ed254.exe	26
PID 1144 wrote to memory of 1672	1144	setup.exe	30
PID 1144 wrote to memory of 1672	1144	setup.exe	30
PID 1144 wrote to memory of 1672	1144	setup.exe	30
PID 1144 wrote to memory of 1672	1144	setup.exe	30
PID 1144 wrote to memory of 1672	1144	setup.exe	30
PID 1144 wrote to memory of 1672	1144	setup.exe	30
PID 1144 wrote to memory of 1672	1144	setup.exe	30
PID 1672 wrote to memory of 1504	1672	aliens.exe	31
PID 1672 wrote to memory of 1504	1672	aliens.exe	31
PID 1672 wrote to memory of 1504	1672	aliens.exe	31
PID 1672 wrote to memory of 1504	1672	aliens.exe	31
PID 1672 wrote to memory of 1504	1672	aliens.exe	31
PID 1672 wrote to memory of 1504	1672	aliens.exe	31
PID 1672 wrote to memory of 1504	1672	aliens.exe	31
PID 340 wrote to memory of 1064	340	msiexec.exe	33
PID 340 wrote to memory of 1064	340	msiexec.exe	33
PID 340 wrote to memory of 1064	340	msiexec.exe	33
PID 340 wrote to memory of 1064	340	msiexec.exe	33
PID 340 wrote to memory of 1064	340	msiexec.exe	33
PID 340 wrote to memory of 1064	340	msiexec.exe	33
PID 340 wrote to memory of 1064	340	msiexec.exe	33
PID 1672 wrote to memory of 1276	1672	aliens.exe	34
PID 1672 wrote to memory of 1276	1672	aliens.exe	34
PID 1672 wrote to memory of 1276	1672	aliens.exe	34
PID 1672 wrote to memory of 1276	1672	aliens.exe	34
PID 1672 wrote to memory of 1276	1672	aliens.exe	34
PID 1672 wrote to memory of 1276	1672	aliens.exe	34
PID 1672 wrote to memory of 1276	1672	aliens.exe	34
PID 1672 wrote to memory of 516	1672	aliens.exe	35
PID 1672 wrote to memory of 516	1672	aliens.exe	35
PID 1672 wrote to memory of 516	1672	aliens.exe	35
PID 1672 wrote to memory of 516	1672	aliens.exe	35
PID 1672 wrote to memory of 516	1672	aliens.exe	35
PID 1672 wrote to memory of 516	1672	aliens.exe	35
PID 1672 wrote to memory of 516	1672	aliens.exe	35
PID 1672 wrote to memory of 1760	1672	aliens.exe	36
PID 1672 wrote to memory of 1760	1672	aliens.exe	36
PID 1672 wrote to memory of 1760	1672	aliens.exe	36
PID 1672 wrote to memory of 1760	1672	aliens.exe	36
PID 1760 wrote to memory of 1860	1760	cmd.exe	38
PID 1760 wrote to memory of 1860	1760	cmd.exe	38
PID 1760 wrote to memory of 1860	1760	cmd.exe	38
PID 1760 wrote to memory of 1860	1760	cmd.exe	38
PID 516 wrote to memory of 1300	516	1E1C360C582DF797.exe	40
PID 516 wrote to memory of 1300	516	1E1C360C582DF797.exe	40
PID 516 wrote to memory of 1300	516	1E1C360C582DF797.exe	40
PID 516 wrote to memory of 1300	516	1E1C360C582DF797.exe	40
PID 1276 wrote to memory of 1876	1276	1E1C360C582DF797.exe	39
PID 1276 wrote to memory of 1876	1276	1E1C360C582DF797.exe	39
PID 1276 wrote to memory of 1876	1276	1E1C360C582DF797.exe	39
PID 1276 wrote to memory of 1876	1276	1E1C360C582DF797.exe	39
PID 1276 wrote to memory of 1876	1276	1E1C360C582DF797.exe	39
PID 1276 wrote to memory of 1876	1276	1E1C360C582DF797.exe	39
PID 1276 wrote to memory of 1876	1276	1E1C360C582DF797.exe	39
PID 1276 wrote to memory of 1876	1276	1E1C360C582DF797.exe	39
PID 1300 wrote to memory of 1448	1300	cmd.exe	42
PID 1300 wrote to memory of 1448	1300	cmd.exe	42
PID 1300 wrote to memory of 1448	1300	cmd.exe	42
PID 1300 wrote to memory of 1448	1300	cmd.exe	42
PID 516 wrote to memory of 616	516	1E1C360C582DF797.exe	45
PID 516 wrote to memory of 616	516	1E1C360C582DF797.exe	45
PID 516 wrote to memory of 616	516	1E1C360C582DF797.exe	45
PID 516 wrote to memory of 616	516	1E1C360C582DF797.exe	45
PID 616 wrote to memory of 1264	616	cmd.exe	47
PID 616 wrote to memory of 1264	616	cmd.exe	47
PID 616 wrote to memory of 1264	616	cmd.exe	47
PID 616 wrote to memory of 1264	616	cmd.exe	47
PID 1276 wrote to memory of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 wrote to memory of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 wrote to memory of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 wrote to memory of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 wrote to memory of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 wrote to memory of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 wrote to memory of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 wrote to memory of 1656	1276	1E1C360C582DF797.exe	49
PID 1276 wrote to memory of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 wrote to memory of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 wrote to memory of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 wrote to memory of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 wrote to memory of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 wrote to memory of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 wrote to memory of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 wrote to memory of 1244	1276	1E1C360C582DF797.exe	50
PID 1276 wrote to memory of 1528	1276	1E1C360C582DF797.exe	51
PID 1276 wrote to memory of 1528	1276	1E1C360C582DF797.exe	51
PID 1276 wrote to memory of 1528	1276	1E1C360C582DF797.exe	51
PID 1276 wrote to memory of 1528	1276	1E1C360C582DF797.exe	51
PID 1276 wrote to memory of 1528	1276	1E1C360C582DF797.exe	51
PID 1276 wrote to memory of 1528	1276	1E1C360C582DF797.exe	51
PID 1276 wrote to memory of 1528	1276	1E1C360C582DF797.exe	51
PID 1276 wrote to memory of 1528	1276	1E1C360C582DF797.exe	51
PID 1276 wrote to memory of 1996	1276	1E1C360C582DF797.exe	52
PID 1276 wrote to memory of 1996	1276	1E1C360C582DF797.exe	52
PID 1276 wrote to memory of 1996	1276	1E1C360C582DF797.exe	52
PID 1276 wrote to memory of 1996	1276	1E1C360C582DF797.exe	52
PID 1276 wrote to memory of 1696	1276	1E1C360C582DF797.exe	53
PID 1276 wrote to memory of 1696	1276	1E1C360C582DF797.exe	53
PID 1276 wrote to memory of 1696	1276	1E1C360C582DF797.exe	53
PID 1276 wrote to memory of 1696	1276	1E1C360C582DF797.exe	53
PID 1276 wrote to memory of 1200	1276	1E1C360C582DF797.exe	55
PID 1276 wrote to memory of 1200	1276	1E1C360C582DF797.exe	55
PID 1276 wrote to memory of 1200	1276	1E1C360C582DF797.exe	55
PID 1276 wrote to memory of 1200	1276	1E1C360C582DF797.exe	55
PID 1276 wrote to memory of 1200	1276	1E1C360C582DF797.exe	55
PID 1276 wrote to memory of 1200	1276	1E1C360C582DF797.exe	55
PID 1276 wrote to memory of 1200	1276	1E1C360C582DF797.exe	55
PID 1200 wrote to memory of 1180	1200	23E04C4F32EF2158.exe	56
PID 1200 wrote to memory of 1180	1200	23E04C4F32EF2158.exe	56
PID 1200 wrote to memory of 1180	1200	23E04C4F32EF2158.exe	56
PID 1200 wrote to memory of 1180	1200	23E04C4F32EF2158.exe	56
PID 1200 wrote to memory of 1180	1200	23E04C4F32EF2158.exe	56
PID 1200 wrote to memory of 1180	1200	23E04C4F32EF2158.exe	56
PID 1200 wrote to memory of 1180	1200	23E04C4F32EF2158.exe	56

C:\Users\Admin\AppData\Local\Temp\3ca6df4914385efd4ba9cd239b5ed254.exe
"C:\Users\Admin\AppData\Local\Temp\3ca6df4914385efd4ba9cd239b5ed254.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\sib560.tmp\0\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\sib560.tmp\0\setup.exe" -s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Program Files (x86)\71eza90awf48\aliens.exe
    "C:\Program Files (x86)\71eza90awf48\aliens.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe
      C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe 0011 installp3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetThreadContext
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        
        PID:1876
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        
        PID:1656
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        
        PID:1244
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
        
        C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
        5⤵
        Executes dropped EXE
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
        
        "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\is-9RILE.tmp\23E04C4F32EF2158.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9RILE.tmp\23E04C4F32EF2158.tmp" /SL5="$6016C,755315,121344,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe
      C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe 200 installp3
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of WriteProcessMemory
      PID:516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1300
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:1448
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe"
        5⤵
        
        PID:616
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        6⤵
        Runs ping.exe
        
        PID:1264
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping 127.0.0.1 -n 3 & del "C:\Program Files (x86)\71eza90awf48\aliens.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        5⤵
        Runs ping.exe
        
        PID:1860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ADBB5EC15F4D8C273C31D7AA7691240F C
  2⤵
  - Loads dropped DLL
  PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-32-0x0000000010000000-0x000000001033D000-memory.dmp

Download

memory/516-35-0x0000000003380000-0x0000000003831000-memory.dmp

Download

memory/1276-36-0x0000000003200000-0x00000000036B1000-memory.dmp

Download

memory/1324-41-0x000007FEF7730000-0x000007FEF79AA000-memory.dmp

Download

memory/1504-20-0x00000000031C0000-0x00000000031C4000-memory.dmp

Download

memory/1672-17-0x0000000010000000-0x000000001033D000-memory.dmp

Download

memory/1696-79-0x000000000C8F0000-0x000000000C8F1000-memory.dmp

Download

memory/1744-8-0x000000000E510000-0x000000000E511000-memory.dmp

Download

memory/1744-6-0x0000000002790000-0x0000000002791000-memory.dmp

Download

memory/1744-3-0x00000000740D0000-0x00000000747BE000-memory.dmp

Download

memory/1876-39-0x0000000010000000-0x0000000010057000-memory.dmp

Download