Analysis
- max time kernel
68s - max time network
131s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/04/2021, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe
- Size 5.1MB
- Sample210427-b2eshqhfja
- SHA256 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55
- MD5 c3aa5ffcab6ac655b4ae3fe9b26bde0e
- SHA1 c8dad4aa1d63325cf851b0d0fd4b9cb358932ca5
- SHA512 fa9e4cc795ff417cacc60cc1a923aa336962944125da369495c637aea4f7588e5103f6dfca16695e71b529861f4374b52bce9a872e5f50728a5e020b43b10107
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 1516 MsiExec.exe 1516 MsiExec.exe 1516 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\M: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\P: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\S: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\T: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\I: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\J: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\B: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\H: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\Q: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\R: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\F: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\U: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\N: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\O: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\V: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\W: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\Y: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\Z: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3280 msiexec.exe Token: SeCreateTokenPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAssignPrimaryTokenPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLockMemoryPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncreaseQuotaPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeMachineAccountPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeTcbPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSecurityPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeTakeOwnershipPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLoadDriverPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemProfilePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemtimePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeProfSingleProcessPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncBasePriorityPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreatePagefilePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreatePermanentPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeBackupPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeRestorePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeShutdownPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeDebugPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAuditPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemEnvironmentPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeChangeNotifyPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeRemoteShutdownPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeUndockPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSyncAgentPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeEnableDelegationPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeManageVolumePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeImpersonatePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreateGlobalPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreateTokenPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAssignPrimaryTokenPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLockMemoryPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncreaseQuotaPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeMachineAccountPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeTcbPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSecurityPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeTakeOwnershipPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLoadDriverPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemProfilePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemtimePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeProfSingleProcessPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncBasePriorityPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreatePagefilePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreatePermanentPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeBackupPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeRestorePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeShutdownPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeDebugPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAuditPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemEnvironmentPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeChangeNotifyPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeRemoteShutdownPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeUndockPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSyncAgentPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeEnableDelegationPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeManageVolumePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeImpersonatePrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreateGlobalPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreateTokenPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAssignPrimaryTokenPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLockMemoryPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncreaseQuotaPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeMachineAccountPrivilege 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 860 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3280 wrote to memory of 1516 3280 msiexec.exe 77 PID 3280 wrote to memory of 1516 3280 msiexec.exe 77 PID 3280 wrote to memory of 1516 3280 msiexec.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe"C:\Users\Admin\AppData\Local\Temp\0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:860
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4ED5BDD6397EB74D3DB2477589641B57 C2⤵
- Loads dropped DLL
PID:1516
-