Analysis
-
max time kernel
60s -
max time network
60s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 14:37
Static task
static1
Behavioral task
behavioral1
Sample
5101b2617704dba03c4a896258ce5b34.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5101b2617704dba03c4a896258ce5b34.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
5101b2617704dba03c4a896258ce5b34.exe
-
Size
6.2MB
-
MD5
5101b2617704dba03c4a896258ce5b34
-
SHA1
2489a2da6d03273ec09564ca6762c21c14083fbf
-
SHA256
7e14e6db59a8655bdb4006bed368dea18ff5af0021496e6e342130606aa88361
-
SHA512
5d357497d0079873780585062111385d8d5b0534883effff48b8e59a269162285916a39a4c580fdda584266be52cf8cd8dc11d070e78ebeb7ec852b49ac04d4c
Malware Config
Signatures
-
XMRig Miner Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/868-2-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig behavioral1/memory/868-3-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig behavioral1/memory/868-4-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig behavioral1/memory/868-5-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig -
Processes:
yara_rule upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx -
Drops desktop.ini file(s) 2 IoCs
Processes:
5101b2617704dba03c4a896258ce5b34.exedescription ioc process File created C:\$Recycle.Bin\S-1-5-21-293278959-2699126792-324916226-1000\desktop.ini 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5101b2617704dba03c4a896258ce5b34.exe -
Drops file in Program Files directory 945 IoCs
Processes:
5101b2617704dba03c4a896258ce5b34.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Internet Explorer\DiagnosticsTap.dll 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\icudtl.dat 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\zh-TW.pak 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\7-Zip\readme.txt 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Internet Explorer\jsprofilerui.dll 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Internet Explorer\iedvtool.dll 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome.dll 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\eventlog_provider.dll 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\lt.pak 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png 5101b2617704dba03c4a896258ce5b34.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\mr.pak 5101b2617704dba03c4a896258ce5b34.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb 5101b2617704dba03c4a896258ce5b34.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
5101b2617704dba03c4a896258ce5b34.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.FpjQhWHXfk.com" 5101b2617704dba03c4a896258ce5b34.exe -
Processes:
5101b2617704dba03c4a896258ce5b34.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd 5101b2617704dba03c4a896258ce5b34.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A 5101b2617704dba03c4a896258ce5b34.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 5101b2617704dba03c4a896258ce5b34.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 5101b2617704dba03c4a896258ce5b34.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 5101b2617704dba03c4a896258ce5b34.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 5101b2617704dba03c4a896258ce5b34.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 5101b2617704dba03c4a896258ce5b34.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 5101b2617704dba03c4a896258ce5b34.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5101b2617704dba03c4a896258ce5b34.exedescription pid process Token: SeLockMemoryPrivilege 868 5101b2617704dba03c4a896258ce5b34.exe Token: SeLockMemoryPrivilege 868 5101b2617704dba03c4a896258ce5b34.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5101b2617704dba03c4a896258ce5b34.exe"C:\Users\Admin\AppData\Local\Temp\5101b2617704dba03c4a896258ce5b34.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/868-2-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/868-3-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/868-4-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/868-5-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/868-6-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/868-7-0x0000000000290000-0x0000000000292000-memory.dmpFilesize
8KB