Analysis
- max time kernel
119s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
28/03/2022, 23:16
Static task
static1
Behavioral task
behavioral1
Sample
15a290552f9cdc38b18e6c0babe7fdd52ff8abfa73ff823220fa994e7f023dc0.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
15a290552f9cdc38b18e6c0babe7fdd52ff8abfa73ff823220fa994e7f023dc0.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 15a290552f9cdc38b18e6c0babe7fdd52ff8abfa73ff823220fa994e7f023dc0.exe
- Size 396KB
- Sample220328-286vpagee5
- SHA256 15a290552f9cdc38b18e6c0babe7fdd52ff8abfa73ff823220fa994e7f023dc0
- MD5 3a47c5d00f1bdf8943b595a2c92a53a6
- SHA1 6fe044af1a52ea91ba3a6538bf7a919f16ab36d7
- SHA512 2faf903a06d2508b271330308db9cecb131b6a5d3ab1508e3d62bc85538d59dabb57b95f872d586b43a85ce52a3c1a9775629f9981e60a6dd525e03541761b66
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018C005F23F1507 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000008463dd8bfbde8f8562199ae5aa42fce0a0e7a1f3eef4246cbee293ebb14b6bcb000000000e80000000020000200000008090a39bcbd41ffed96c53154cb1e12c713cddb2269c2be79586a7f770b50388800000005639dfd1db06af58d43aa47dc8148a27ae511c8abfa8d6e26743f548c880f034112b65582369c5f588193450bef434adf8f897e4ef2b588ff0a38d159de3e1340630b9b147c06a626a9ab3e74c3fdd39f196f9079319be45ad94144006d685a54d39a72d90fd902af1c47653c22acc807d8eea180fae31a75702064bf48281a540000000300d1ec55cc2b747e15a276955814f93daceb28d9c0fab079a0b864aa4b2740da90e3c61533e1ebc703c0863919cc33eee74d2f10ccda39bc990b75c0e43346b svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000c02c222b4ec169b9717adb30de420cefe681911d2178823f1cbb79441c89d1f9000000000e8000000002000020000000cd31b27889fdf1f6a86e001d431acd5aff36fa4034e96be81efa35bb477ec763100d00001f62a5eb45281d5faa84b6f22138f9ec1ea0e9028c4d0211f1312ef2bea530830d6bbc5461abb23172347a9ced1b9688367988bbabfa21c5e653b65cba59fcc0e626e248b38d12e779e8e69bb549cd104ca542414bc0c63e9accc68f306d80dd145b2e2e90b013f23d4cf30d4b07b9c03b44c5a9248633a5a06ecf71dd952233743709c6b1e8816517b84688c4aef4dcaae303f57e741d5b8880fa6990913172245df193313ffcce715ba84435f28a4672504d7246b99abbd0c7d7666430d0b91f608c3241b137d3caed349be20fd398234c221f979f8a0bb49237c2b0c16111e215eb2ec214ab336404175c44375d03c26cf1823d5623cb7d43778eda229cb152cc8c2bd1b96d5c5b23411b58ef21320fa4214ccb358aaee1d31ca7e15911cdde037e40e5c7307939c1d0c0c75b8beaee7d0b4f6a2700c7bb6d1bcc52eb5c20b08e374e0118850efa31c16a4e6bd41b46c157dcf12cb95438e9b98732d1e0c9b4adcc469dc6cea4c0d10bfbac9cbf3927c397b0e1fd46e5b47c966acd58687798500dae41607a435aa9fe6fc2e9b04181b115c66c32be378c22913a7fd8481bf7de43a4faf5e783bc3a2d80e566bc8d2d6df4f29b0eb78351ac5e4d9addebcb586af9d3d3d2bc8988f2626e718d3cdd22891741c9b2e4d491eae362df26ddceff9ef4dd551d79948260da85843f7c20e8f9eb1ab27a8407a4665f6eb360a4905ad869b16db3f1356882e5fc6ab7ccad9d0ac19fe4bca80d81cabcdaccdd35fe9f60ec67a35a72bab4830cbde91401c2c0ad573d212aed84204bf4c5089da66000c4193829eabc363e6a6eade4a3250658ce8b81861e32101051bed13292cebcdf3157cc4e999000ee189ad6e5c361d973cf56f6d7c587c4e0ae66c78679615f880dfe06d615f149259f4f85b05bba92dbf1fb922a70194180996c6df79585915c70fa5ac2aaea89c96370c25d68788311aab8da19756539db9a341f33f8936f3eb4b07b34d7d6014b1ed68c955661241fad4e720e038d04825334b4cc53f6551ce079c60bed7f97cec35a2d5b7ad89a9aa067e363a2b803aaca204d1c7c5660af41c32d5eb3c39f8edcd718eeb94bfbd7abcd5a7de76be079f9f7e3066d7bd0a0036f14e91187076bb9c235ae051459c1678e9e307295840b6b4a5a757e85495e0284e519e274ec3a95af15495e135a5d8b69dbcd4e55b68944b5c7461b7083b7267ba33e24f8f4cb191b95858e7738ceb3c43d7117f8e9f24bb2c1e02d44ecf839cf0695becc2a6b8978bb03c67cd2b660829816c46d89dbc91f2db863f2ae779c170e4a916d9d36afea7218567d309b8950b0dddfd681853232a167af049f5d480f0c2b33c7754aca9f0e6ed2cce33b4a5d73264b3e0995033ed845eaafe15ed1585828da4536f83fac3d02b0962466255186c755e595ade59df50afeac29f107adf3d062f78f6d2599148c910413754c50ce8c57527c5207b65bc4332ca3812eafe30d9fe890a9c9a21061cb042414e053c7131acf4dca1bfea5d0c20708ee62d1444138522531465790664e441d5cfaecd1215523dbf0d2fad3ab8a340070598b1686778387a557c678fffea25294462ad8df0a90ca47124d5caba2e2a67f3da9fbfa0ea332c31c9f0589ff9b3555fad7db873e8bc4bb6a63d1cc242b9f978422fe56f7fbed3b211d2c066ce02096a57a25020f627d94d9392c17dccdd4943a0b1642199ab5f49747a2fac6ff86b5406318ed4a63a7be788a080ee8e855d3e056714f7caae24051706bef06747ae52f0dbe07ecb705cb6e4b5df24cf8c3a5502b0e9e2584139a7c69f1f84c9b394a3b30b55533813aeba56745b2a738fa85bc222d3b165c434927fac5cb5f781017a448f34016354285608499b56f1ff26d3829bb237b1af582f8ebfab80457d112717d972f2eb7f5301c6ae1ad520be23861c0dc3351b8ba90fdd8a7cf0e8995a0fb2effbd5fac58af21d0a4c9ed281ca20199158a16b5569668b1fb0cf250e9c8a516c46e509aaf52bf671e72dcb1584314c1133c31bbc6c71aad0d0ca81118af74325be061d42b12e81b57549aaeb01e98bf37c148302ef4c961a4af2a478872c027def671417c5d4bcb7ff3db902d42fb64f0d561a9fc138ed298ad167a1152fe791b9d0427547a0fce0a1f5f4bb3a10f29803643b75e15d740ff20c5f0f966ab13ba4b95e0cd28c2224a806fdb7db675b3dd8f0b748a78989af64d1d4e6e992dde270f294be6644ca1056c9bdf31946cffae738ce0183130a7300b20fb4739b33070f5fd164b1884bb6975d061ab60eaed6be61470bb4236e503084c42df8edf3257ab479ea5e4260b2b8cf77bb0c4829e0881888c10910e9055b1510a6805cca258f3df477127dbe2f83724cdd790576bd869a12a6c6d4e7047f792f093f3af3875802ad40ff321806accbe848fed1188b19cd950d7a6371b5a86caed9580e737b250a8d88116743cc1b0347da825a1d1036ab80411884916c878bf3f794e9eeb42a28fa02fb032e8682b0c3fd9c248ab69d7397eb7230b52eba340e602bfb3b37e123643a28f607c891439f3404374ff311977178ccb4b19fbf9a8860ea699ec612be6712a83f095decf876863aa69cef15a726f5febdfc80c37a7a3a43bc51184435703718843597374ab3f525532cc39d95516b8b8db6acf8858c5e707ab01e514977a54e7473e68f3854e888fb6c88c5069aaab3d6a32ae2f89b99735577e5502ba28c5b31867aa23ef642096484a02ee32891255a87a1cdaaf6b478843961373ce2fd9fc091b3134503d72bf7f4d313af085f2b0ed2ba6ede4819be8a06562cf5e4ecb686cb674fc1e27268b21905f596ec04933184f643d1c4b10c1ae1e837d4de75f8254f32bee915ca99d2845c0cc99741895c249fa63da2b1672da204cdd4b283a41b3f1014b2b1a4b2857dff8d4d1f0677cc920882a135228cb322aadd0745f631463a1d6f274b16a2396c0bd1eee18f8d5b78cb467a33c183de9cded2233bca687516c523eb8a589c9d64dc1fd882479df4fc2e8d4814d2599aebf9ad2c813a05c8f134b9f1705191c15acf989525a10cbf7ab364b5d6c5a4cf6ee8311a539148832f94e9b4523d68242ab500982b24947591b12a34ae9aa9946efba60517572132c4e907655e9b4f1de7343367c1c471f203455963f7afc966d0c3b5fdfc500a06375a824ef4331ec2d77b493bf7e1c00e117f776e10617d468953b6a98d0612d7bbfb8147bdee17a1d21852fb4f5b2840dc7278a397d55fa55dc2bf790f2e48bfb3611bb06b2eed5868f2fa1f0e8bccdb71f5cfe6082647b012d49fd5c533888088f0bf3e97e49502c43a6a4cd39542dec28430ce77d32812a182a3dbf49c18df2655928294178593edcb0f401cfc414e04e9634a21951c2e0643133e5d724ef3e5e3a4a0596f9bd0272b229db3c1b55e76eff425c4432f7e0813760c2580993d568da33119273e13be39e79c0bfddb260b4863fd4fdc5f4c07cb16e46faa11c6427b38d2f32db76089d67a1fdaa2c2c548b9780d02ac23298eff74c7799f1c3923e8ff5b8229a53dedadf166e9f13b79d5246ab791bb9181c19f87bf6a5d0cb5e7672b2523b19568d14932a9fd6fcaec411462ce15329d6d348095027720dc673a3f680de680234c1cde85b4a3590e57b2915babfa01c6b5a21912df05a997ba842a4a346c8e1b9c614ca367b9534dd1ac37f61146ac86a68956b2cc776a2a46821076f0a7ca3f7e7cc88b7c492332b194f480e89ec42608a426a8563850c2b018c5a7cbd17446a33e2bb54b7b89131d3dbf4d9bc8cbf01ba66686cc95e64db69aaa06da6d34e656a0b9c5511e31b7ac133d3f3c3c1d72e4835cc9275e1c1a58d137fadec9db044659c6582236836692e167f28e0c3055c8413e654049f66b9d10d1aa5c6c5324bae39ba767ed42471da30378e89845999ee4a2357c63c643cafcae6eafd49e7077a992d6718e20a87d83c8dcd05f6e7ee775aba7db1c605e06691d13ea20a8b669f6ed1488b95c9d7d200d099a14caed8c938392740a1b78fccaa70645ff50fbdff0945af8b6abce3ff2735c43463c0838aaaea82976677ac197d2f007f48a55e7a3b13e7b366417d546345dbaf03785a257b84469a13d020fb79868228f241ec4a16b81beccba2c1c6c860b06000d7e7921ed6d27c0661d26aee2ff46db25a9b9ef2c67eca511c971a6babd52cc3efc0f1c1e727dc50534ca5be97ad705f2375ec080f33e51b0b4dc904c8f94ab9a2f8bcccc779779acdf027afd7f69eaf1a5b23b943561f8378d3d88f3ae3ae47759067ade3444ba237d47e402ae5ae0c5f71756abc683af3d730465a0f9f7e470a8e4e4a3117de85dd8cb2c8822741e091711a716d19e77edf6e281675024204c1f0c36489e7d9409d4bdb3e02ebc0094b7ccc92db0fdeeff9b531a7617482e58f1f1dba70f8266740a4b53d53dbf7f2d5a895d21c5df861a4993094e6a2df055ef3402ad63a803b92f62da9192872b3b7c1fd3fb44292baa40193ca592e6ec8ae60283ff2b8a0c9739f3f19e26035207bed3cf043f8d1bc250b69aceae9c08cbf9e081f98f9721e4688ecaef000f4d32651df74d94e15b052272a63628f06e5ded6c3e96c8bc175e102234f854bcabdc29c85d1855d3b2363ea2d0f9f193109e5200f985181195c4cd42a459580f3e8026f53ee952db8fc12ef5294216b9300f3400000005b44683ab49e59f1dfacd7f9809b1d009cd4b8983300d358d16ba54356ac3f68c636c6e6b3a33d6e6e31c3a24475d0a5b231ce2bae7c88a42d9c218e667c8a14 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018C005F23F1507" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15a290552f9cdc38b18e6c0babe7fdd52ff8abfa73ff823220fa994e7f023dc0.exe"C:\Users\Admin\AppData\Local\Temp\15a290552f9cdc38b18e6c0babe7fdd52ff8abfa73ff823220fa994e7f023dc0.exe"1⤵PID:3296
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:1092