Analysis
-
max time kernel
58s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 13:23
Static task
static1
Behavioral task
behavioral1
Sample
022dfc7c68260ff81d8913f18f06a68b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
022dfc7c68260ff81d8913f18f06a68b.exe
-
Size
6.4MB
-
MD5
022dfc7c68260ff81d8913f18f06a68b
-
SHA1
ce8ce79e0c923e22e7920a094934cde717016c1f
-
SHA256
e458ed5cbe2292794b5a71907c6c5a1d133f5b46b8388f600732f60c84fad9ce
-
SHA512
84bd56ae593e1fc7b2b164acbf74a69405e3313ad6f7109af0d2bf2e461c1b16c1bd203c04d7eb7c192afd50328e5fdacd34758708ae671cb0e0456adcf67717
Malware Config
Signatures
-
XMRig Miner Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4768-2-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig behavioral2/memory/4768-3-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig -
Processes:
yara_rule upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx -
Drops desktop.ini file(s) 2 IoCs
Processes:
022dfc7c68260ff81d8913f18f06a68b.exedescription ioc process File created C:\$Recycle.Bin\S-1-5-21-3341490333-719741536-2920803124-1000\desktop.ini 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 022dfc7c68260ff81d8913f18f06a68b.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1697 IoCs
Processes:
022dfc7c68260ff81d8913f18f06a68b.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\VisualElements\LogoBeta.png 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\eula.dll 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\prism_common.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\he.pak 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jli.dll 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\snmp.acl.template 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_de_DE.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\README.txt 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\prism_sw.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME.txt 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\plugin.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\th.pak 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_cs.jar 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\attach.dll 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar 022dfc7c68260ff81d8913f18f06a68b.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock 022dfc7c68260ff81d8913f18f06a68b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar 022dfc7c68260ff81d8913f18f06a68b.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4568 4768 WerFault.exe 022dfc7c68260ff81d8913f18f06a68b.exe -
Modifies Internet Explorer start page 1 TTPs 4 IoCs
Processes:
022dfc7c68260ff81d8913f18f06a68b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.KBPDGMfJFA.com" 022dfc7c68260ff81d8913f18f06a68b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.LwMYXAFsOi.com" 022dfc7c68260ff81d8913f18f06a68b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.NYrAPRdxKE.com" 022dfc7c68260ff81d8913f18f06a68b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.ALxWvSojTa.com" 022dfc7c68260ff81d8913f18f06a68b.exe -
Processes:
022dfc7c68260ff81d8913f18f06a68b.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 022dfc7c68260ff81d8913f18f06a68b.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C 022dfc7c68260ff81d8913f18f06a68b.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 022dfc7c68260ff81d8913f18f06a68b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 022dfc7c68260ff81d8913f18f06a68b.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 022dfc7c68260ff81d8913f18f06a68b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
022dfc7c68260ff81d8913f18f06a68b.exedescription pid process Token: SeLockMemoryPrivilege 4768 022dfc7c68260ff81d8913f18f06a68b.exe Token: SeLockMemoryPrivilege 4768 022dfc7c68260ff81d8913f18f06a68b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\022dfc7c68260ff81d8913f18f06a68b.exe"C:\Users\Admin\AppData\Local\Temp\022dfc7c68260ff81d8913f18f06a68b.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4768 -s 5842⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4768-2-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/4768-3-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/4768-6-0x0000000000180000-0x00000000001C0000-memory.dmpFilesize
256KB
-
memory/4768-7-0x00000000001C0000-0x00000000001E2000-memory.dmpFilesize
136KB
-
memory/4768-8-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB