f80a58564f070acf295b2a76ce6331402b3e9e71eed07cf3e017376e1bdb0f36

General

Target
DOC022122.exe
Size 773KB
Sample220221-pl6j7abbgl
SHA256 f80a58564f070acf295b2a76ce6331402b3e9e71eed07cf3e017376e1bdb0f36
MD5 bb223afdfbf620b0b9150cc25493fb4a
SHA1 393f98d1d69c52cdf38e44b0bffcf6bddcb66b14
SHA512 f738f1207628c2d3114ad8c7a20ef2840c1be899a14e9cd3bc15379b08591e97f239648e5aa6e4d6cff47dc02947af020668f6eb2f6a3909b132e448fd4fc41a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Modifies system certificate store 2 TTPs 5 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CF87B8022D45FBC7FF916B9C0B6CE54FE4FA74C7\Blob = 1900000001000000100000005be55c2bfe9902ed9bc5df0e2c5e9a35140000000100000014000000409fd2346b4e9b50d7426e3d21b5f356b6004a80030000000100000014000000cf87b8022d45fbc7ff916b9c0b6ce54fe4fa74c70f00000001000000200000004072804131f6307f67eb287101f694f1e207f5224d827f6d80662a16f94a9ec70400000001000000100000006ba3d3a80370583c0d4bf6fc3ae29f492000000001000000f9020000308202f5308201dda00302010202100b08c949902af6a5a07438d248534064300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303231303135303030305a170d3237303230393135303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d35c6b7408a79ae6d910de7be6964003f7b080a190b454987d8ce23d3c915f6b324eb4cfe36b83b3ee9cc54e1a2330e9d955c09b2f0983630b96ec8ab61c58b4bfe2cfeab24c8c0cf0ddc8e68bddbcf81b3b07f314c1c2b9836e8224a466688d83d99d295b33432231917aea6dc16f8fd2d5d7d62461a007a4856cc68d8b4bdabab7da40b9cb202f882c5eaf04d2fbbea012526ecb30c4995235a833fdaddf1d195c416b086e3b922d55f8a9307ef56f1a2696d96d48c87ade5187cba1c17d132e35556e651146b3a7679c42941773ede8086565801f02333b78b4785789b512734ac5d1833d1298b69182f05ea44191ac15b849ceca91bd65134886751f07150203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414409fd2346b4e9b50d7426e3d21b5f356b6004a80300d06092a864886f70d01010b050003820101005784bdbe332019d7ffe66611cc1595f65e32bf285157c9864df2f96328a0403b4334ee429d40ddef1e23d187a5c86cc6fc217c7efd81ab90c86f49cd4f178c8fd5209f34caef6eaad8c36326128131016b9a06a71e7a198ced2b091713def432501f845c05afea0ea0bb06b955365c80cfac74cfb54051e2ce7da3c4de3ba0174bff878b7d4a42f327e3b7b2829fa3fd41ad4ed60ea499a1a27972314020428559714dfade0f88579ee32fa48b91fffe17608cf274f6ec626c73aa0a63673c32f21e31c09b99b0a387bf76618acc30db37625115de3bd0b7aca26faccbd3de7a6def8d896084c3da89d12a2b5f56e0b2dc5fdd7c8d72f6d7a8c5fc25980774c2	DOC022122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CF87B8022D45FBC7FF916B9C0B6CE54FE4FA74C7	DOC022122.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CF87B8022D45FBC7FF916B9C0B6CE54FE4FA74C7\Blob = 0f00000001000000200000004072804131f6307f67eb287101f694f1e207f5224d827f6d80662a16f94a9ec7030000000100000014000000cf87b8022d45fbc7ff916b9c0b6ce54fe4fa74c72000000001000000f9020000308202f5308201dda00302010202100b08c949902af6a5a07438d248534064300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303231303135303030305a170d3237303230393135303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d35c6b7408a79ae6d910de7be6964003f7b080a190b454987d8ce23d3c915f6b324eb4cfe36b83b3ee9cc54e1a2330e9d955c09b2f0983630b96ec8ab61c58b4bfe2cfeab24c8c0cf0ddc8e68bddbcf81b3b07f314c1c2b9836e8224a466688d83d99d295b33432231917aea6dc16f8fd2d5d7d62461a007a4856cc68d8b4bdabab7da40b9cb202f882c5eaf04d2fbbea012526ecb30c4995235a833fdaddf1d195c416b086e3b922d55f8a9307ef56f1a2696d96d48c87ade5187cba1c17d132e35556e651146b3a7679c42941773ede8086565801f02333b78b4785789b512734ac5d1833d1298b69182f05ea44191ac15b849ceca91bd65134886751f07150203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414409fd2346b4e9b50d7426e3d21b5f356b6004a80300d06092a864886f70d01010b050003820101005784bdbe332019d7ffe66611cc1595f65e32bf285157c9864df2f96328a0403b4334ee429d40ddef1e23d187a5c86cc6fc217c7efd81ab90c86f49cd4f178c8fd5209f34caef6eaad8c36326128131016b9a06a71e7a198ced2b091713def432501f845c05afea0ea0bb06b955365c80cfac74cfb54051e2ce7da3c4de3ba0174bff878b7d4a42f327e3b7b2829fa3fd41ad4ed60ea499a1a27972314020428559714dfade0f88579ee32fa48b91fffe17608cf274f6ec626c73aa0a63673c32f21e31c09b99b0a387bf76618acc30db37625115de3bd0b7aca26faccbd3de7a6def8d896084c3da89d12a2b5f56e0b2dc5fdd7c8d72f6d7a8c5fc25980774c2	DOC022122.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CF87B8022D45FBC7FF916B9C0B6CE54FE4FA74C7\Blob = 140000000100000014000000409fd2346b4e9b50d7426e3d21b5f356b6004a80030000000100000014000000cf87b8022d45fbc7ff916b9c0b6ce54fe4fa74c70f00000001000000200000004072804131f6307f67eb287101f694f1e207f5224d827f6d80662a16f94a9ec72000000001000000f9020000308202f5308201dda00302010202100b08c949902af6a5a07438d248534064300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303231303135303030305a170d3237303230393135303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d35c6b7408a79ae6d910de7be6964003f7b080a190b454987d8ce23d3c915f6b324eb4cfe36b83b3ee9cc54e1a2330e9d955c09b2f0983630b96ec8ab61c58b4bfe2cfeab24c8c0cf0ddc8e68bddbcf81b3b07f314c1c2b9836e8224a466688d83d99d295b33432231917aea6dc16f8fd2d5d7d62461a007a4856cc68d8b4bdabab7da40b9cb202f882c5eaf04d2fbbea012526ecb30c4995235a833fdaddf1d195c416b086e3b922d55f8a9307ef56f1a2696d96d48c87ade5187cba1c17d132e35556e651146b3a7679c42941773ede8086565801f02333b78b4785789b512734ac5d1833d1298b69182f05ea44191ac15b849ceca91bd65134886751f07150203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414409fd2346b4e9b50d7426e3d21b5f356b6004a80300d06092a864886f70d01010b050003820101005784bdbe332019d7ffe66611cc1595f65e32bf285157c9864df2f96328a0403b4334ee429d40ddef1e23d187a5c86cc6fc217c7efd81ab90c86f49cd4f178c8fd5209f34caef6eaad8c36326128131016b9a06a71e7a198ced2b091713def432501f845c05afea0ea0bb06b955365c80cfac74cfb54051e2ce7da3c4de3ba0174bff878b7d4a42f327e3b7b2829fa3fd41ad4ed60ea499a1a27972314020428559714dfade0f88579ee32fa48b91fffe17608cf274f6ec626c73aa0a63673c32f21e31c09b99b0a387bf76618acc30db37625115de3bd0b7aca26faccbd3de7a6def8d896084c3da89d12a2b5f56e0b2dc5fdd7c8d72f6d7a8c5fc25980774c2	DOC022122.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CF87B8022D45FBC7FF916B9C0B6CE54FE4FA74C7\Blob = 0400000001000000100000006ba3d3a80370583c0d4bf6fc3ae29f490f00000001000000200000004072804131f6307f67eb287101f694f1e207f5224d827f6d80662a16f94a9ec7030000000100000014000000cf87b8022d45fbc7ff916b9c0b6ce54fe4fa74c7140000000100000014000000409fd2346b4e9b50d7426e3d21b5f356b6004a802000000001000000f9020000308202f5308201dda00302010202100b08c949902af6a5a07438d248534064300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303231303135303030305a170d3237303230393135303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d35c6b7408a79ae6d910de7be6964003f7b080a190b454987d8ce23d3c915f6b324eb4cfe36b83b3ee9cc54e1a2330e9d955c09b2f0983630b96ec8ab61c58b4bfe2cfeab24c8c0cf0ddc8e68bddbcf81b3b07f314c1c2b9836e8224a466688d83d99d295b33432231917aea6dc16f8fd2d5d7d62461a007a4856cc68d8b4bdabab7da40b9cb202f882c5eaf04d2fbbea012526ecb30c4995235a833fdaddf1d195c416b086e3b922d55f8a9307ef56f1a2696d96d48c87ade5187cba1c17d132e35556e651146b3a7679c42941773ede8086565801f02333b78b4785789b512734ac5d1833d1298b69182f05ea44191ac15b849ceca91bd65134886751f07150203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414409fd2346b4e9b50d7426e3d21b5f356b6004a80300d06092a864886f70d01010b050003820101005784bdbe332019d7ffe66611cc1595f65e32bf285157c9864df2f96328a0403b4334ee429d40ddef1e23d187a5c86cc6fc217c7efd81ab90c86f49cd4f178c8fd5209f34caef6eaad8c36326128131016b9a06a71e7a198ced2b091713def432501f845c05afea0ea0bb06b955365c80cfac74cfb54051e2ce7da3c4de3ba0174bff878b7d4a42f327e3b7b2829fa3fd41ad4ed60ea499a1a27972314020428559714dfade0f88579ee32fa48b91fffe17608cf274f6ec626c73aa0a63673c32f21e31c09b99b0a387bf76618acc30db37625115de3bd0b7aca26faccbd3de7a6def8d896084c3da89d12a2b5f56e0b2dc5fdd7c8d72f6d7a8c5fc25980774c2	DOC022122.exe

C:\Users\Admin\AppData\Local\Temp\DOC022122.exe
"C:\Users\Admin\AppData\Local\Temp\DOC022122.exe"
1⤵
- Modifies system certificate store
PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-55-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/572-56-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

Resubmissions

Analysis

Sharing