Analysis
- max time kernel
70s - max time network
133s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/04/2021, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe
- Size 5.1MB
- Sample210427-9src5vy492
- SHA256 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab
- MD5 d7f573be43de2800c43f0a48051d82e7
- SHA1 c44edb12883a708348cf0dcbf0db458217fc847a
- SHA512 04ae9ccba30c4ef47e16a1842594e44df1dd151853ea44c22df4547cce569b146cc0cbef88762fde791631f21bfff49de8083af6dbc1371dd9bb997b64ed207d
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 1364 MsiExec.exe 1364 MsiExec.exe 1364 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\V: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\Z: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\L: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\Q: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\S: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\J: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\K: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\M: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\N: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\W: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\X: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\Y: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\F: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\H: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\R: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\Z: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3964 msiexec.exe Token: SeCreateTokenPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAssignPrimaryTokenPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLockMemoryPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncreaseQuotaPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeMachineAccountPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeTcbPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSecurityPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeTakeOwnershipPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLoadDriverPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemProfilePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemtimePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeProfSingleProcessPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncBasePriorityPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreatePagefilePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreatePermanentPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeBackupPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeRestorePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeShutdownPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeDebugPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAuditPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemEnvironmentPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeChangeNotifyPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeRemoteShutdownPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeUndockPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSyncAgentPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeEnableDelegationPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeManageVolumePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeImpersonatePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreateGlobalPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreateTokenPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAssignPrimaryTokenPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLockMemoryPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncreaseQuotaPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeMachineAccountPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeTcbPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSecurityPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeTakeOwnershipPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLoadDriverPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemProfilePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemtimePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeProfSingleProcessPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncBasePriorityPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreatePagefilePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreatePermanentPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeBackupPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeRestorePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeShutdownPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeDebugPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAuditPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemEnvironmentPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeChangeNotifyPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeRemoteShutdownPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeUndockPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSyncAgentPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeEnableDelegationPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeManageVolumePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeImpersonatePrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreateGlobalPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreateTokenPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAssignPrimaryTokenPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLockMemoryPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncreaseQuotaPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeMachineAccountPrivilege 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3920 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3964 wrote to memory of 1364 3964 msiexec.exe 77 PID 3964 wrote to memory of 1364 3964 msiexec.exe 77 PID 3964 wrote to memory of 1364 3964 msiexec.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe"C:\Users\Admin\AppData\Local\Temp\0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3920
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0E4DAE0B39A1D7FE33FA37637CC959CB C2⤵
- Loads dropped DLL
PID:1364
-