Overview
overview
10Static
static
DBUG.ps1
windows7-x64
1DBUG.ps1
windows10-2004-x64
1WinSupport...re.dll
windows7-x64
1WinSupport...re.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
3WinSupport...EK.dll
windows7-x64
1WinSupport...EK.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
1WinSupport...32.exe
windows7-x64
10WinSupport...32.exe
windows10-2004-x64
10WinSupport...00.dll
windows7-x64
3WinSupport...00.dll
windows10-2004-x64
3WinSupport...pi.dll
windows7-x64
1WinSupport...pi.dll
windows10-2004-x64
1WinSupport...ub.exe
windows7-x64
1WinSupport...ub.exe
windows10-2004-x64
1LOCALES/MSAMRNBD.dll
windows7-x64
1LOCALES/MSAMRNBD.dll
windows10-2004-x64
1LOCALES/MSAMRNBE.dll
windows7-x64
1LOCALES/MSAMRNBE.dll
windows10-2004-x64
1LOCALES/MSAUDDEC.dll
windows7-x64
1LOCALES/MSAUDDEC.dll
windows10-2004-x64
1LOCALES/MSAUDITE.dll
windows7-x64
1LOCALES/MSAUDITE.dll
windows10-2004-x64
1LOCALES/PROTONVP.exe
windows7-x64
7LOCALES/PROTONVP.exe
windows10-2004-x64
7LOCALES/TWAIN_32.dll
windows7-x64
1LOCALES/TWAIN_32.dll
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2022 09:21
Static task
static1
Behavioral task
behavioral1
Sample
DBUG.ps1
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
DBUG.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
WinSupportSn/AudioCapture.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
WinSupportSn/AudioCapture.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
WinSupportSn/HTCTL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
WinSupportSn/HTCTL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
WinSupportSn/PCICHEK.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
WinSupportSn/PCICHEK.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
WinSupportSn/PCICL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
WinSupportSn/PCICL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
WinSupportSn/TCCTL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
WinSupportSn/TCCTL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
WinSupportSn/client32.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
WinSupportSn/client32.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
WinSupportSn/msvcr100.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
WinSupportSn/msvcr100.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
WinSupportSn/pcicapi.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
WinSupportSn/pcicapi.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
WinSupportSn/remcmdstub.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
WinSupportSn/remcmdstub.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
LOCALES/MSAMRNBD.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
LOCALES/MSAMRNBD.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
LOCALES/MSAMRNBE.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
LOCALES/MSAMRNBE.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
LOCALES/MSAUDDEC.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
LOCALES/MSAUDDEC.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
LOCALES/MSAUDITE.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
LOCALES/MSAUDITE.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
LOCALES/PROTONVP.exe
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
LOCALES/PROTONVP.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
LOCALES/TWAIN_32.dll
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
LOCALES/TWAIN_32.dll
Resource
win10v2004-20220812-en
General
-
Target
LOCALES/PROTONVP.exe
-
Size
26.9MB
-
MD5
e751f97a3d99007fd4f3bade78df78a1
-
SHA1
ec8be5c865e959b8675667a689851c2683e5c8d0
-
SHA256
b6db90130e99b34b6b28cd48c244b5c897baaa6f5cb200f83feb74d32614a3e3
-
SHA512
209ddb2fcd2ac2109ac517cf2608580286c7aa07ba876611caace0a057608112299468b7c1ff7b29ddbcfeabb7f037fed2cb64b622fe4fe925ef512d9725a5bd
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
PROTONVP.exeMsiExec.exepid process 3940 PROTONVP.exe 3940 PROTONVP.exe 1480 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exePROTONVP.exedescription ioc process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: PROTONVP.exe File opened (read-only) \??\F: PROTONVP.exe File opened (read-only) \??\G: PROTONVP.exe File opened (read-only) \??\J: PROTONVP.exe File opened (read-only) \??\U: PROTONVP.exe File opened (read-only) \??\H: PROTONVP.exe File opened (read-only) \??\K: PROTONVP.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: PROTONVP.exe File opened (read-only) \??\T: PROTONVP.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: PROTONVP.exe File opened (read-only) \??\I: PROTONVP.exe File opened (read-only) \??\V: PROTONVP.exe File opened (read-only) \??\W: PROTONVP.exe File opened (read-only) \??\Y: PROTONVP.exe File opened (read-only) \??\A: PROTONVP.exe File opened (read-only) \??\N: PROTONVP.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: PROTONVP.exe File opened (read-only) \??\Z: PROTONVP.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: PROTONVP.exe File opened (read-only) \??\P: PROTONVP.exe File opened (read-only) \??\R: PROTONVP.exe File opened (read-only) \??\S: PROTONVP.exe File opened (read-only) \??\X: PROTONVP.exe File opened (read-only) \??\O: PROTONVP.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
PROTONVP.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 PROTONVP.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 PROTONVP.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 PROTONVP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 PROTONVP.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 PROTONVP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exePROTONVP.exedescription pid process Token: SeSecurityPrivilege 5044 msiexec.exe Token: SeCreateTokenPrivilege 3940 PROTONVP.exe Token: SeAssignPrimaryTokenPrivilege 3940 PROTONVP.exe Token: SeLockMemoryPrivilege 3940 PROTONVP.exe Token: SeIncreaseQuotaPrivilege 3940 PROTONVP.exe Token: SeMachineAccountPrivilege 3940 PROTONVP.exe Token: SeTcbPrivilege 3940 PROTONVP.exe Token: SeSecurityPrivilege 3940 PROTONVP.exe Token: SeTakeOwnershipPrivilege 3940 PROTONVP.exe Token: SeLoadDriverPrivilege 3940 PROTONVP.exe Token: SeSystemProfilePrivilege 3940 PROTONVP.exe Token: SeSystemtimePrivilege 3940 PROTONVP.exe Token: SeProfSingleProcessPrivilege 3940 PROTONVP.exe Token: SeIncBasePriorityPrivilege 3940 PROTONVP.exe Token: SeCreatePagefilePrivilege 3940 PROTONVP.exe Token: SeCreatePermanentPrivilege 3940 PROTONVP.exe Token: SeBackupPrivilege 3940 PROTONVP.exe Token: SeRestorePrivilege 3940 PROTONVP.exe Token: SeShutdownPrivilege 3940 PROTONVP.exe Token: SeDebugPrivilege 3940 PROTONVP.exe Token: SeAuditPrivilege 3940 PROTONVP.exe Token: SeSystemEnvironmentPrivilege 3940 PROTONVP.exe Token: SeChangeNotifyPrivilege 3940 PROTONVP.exe Token: SeRemoteShutdownPrivilege 3940 PROTONVP.exe Token: SeUndockPrivilege 3940 PROTONVP.exe Token: SeSyncAgentPrivilege 3940 PROTONVP.exe Token: SeEnableDelegationPrivilege 3940 PROTONVP.exe Token: SeManageVolumePrivilege 3940 PROTONVP.exe Token: SeImpersonatePrivilege 3940 PROTONVP.exe Token: SeCreateGlobalPrivilege 3940 PROTONVP.exe Token: SeCreateTokenPrivilege 3940 PROTONVP.exe Token: SeAssignPrimaryTokenPrivilege 3940 PROTONVP.exe Token: SeLockMemoryPrivilege 3940 PROTONVP.exe Token: SeIncreaseQuotaPrivilege 3940 PROTONVP.exe Token: SeMachineAccountPrivilege 3940 PROTONVP.exe Token: SeTcbPrivilege 3940 PROTONVP.exe Token: SeSecurityPrivilege 3940 PROTONVP.exe Token: SeTakeOwnershipPrivilege 3940 PROTONVP.exe Token: SeLoadDriverPrivilege 3940 PROTONVP.exe Token: SeSystemProfilePrivilege 3940 PROTONVP.exe Token: SeSystemtimePrivilege 3940 PROTONVP.exe Token: SeProfSingleProcessPrivilege 3940 PROTONVP.exe Token: SeIncBasePriorityPrivilege 3940 PROTONVP.exe Token: SeCreatePagefilePrivilege 3940 PROTONVP.exe Token: SeCreatePermanentPrivilege 3940 PROTONVP.exe Token: SeBackupPrivilege 3940 PROTONVP.exe Token: SeRestorePrivilege 3940 PROTONVP.exe Token: SeShutdownPrivilege 3940 PROTONVP.exe Token: SeDebugPrivilege 3940 PROTONVP.exe Token: SeAuditPrivilege 3940 PROTONVP.exe Token: SeSystemEnvironmentPrivilege 3940 PROTONVP.exe Token: SeChangeNotifyPrivilege 3940 PROTONVP.exe Token: SeRemoteShutdownPrivilege 3940 PROTONVP.exe Token: SeUndockPrivilege 3940 PROTONVP.exe Token: SeSyncAgentPrivilege 3940 PROTONVP.exe Token: SeEnableDelegationPrivilege 3940 PROTONVP.exe Token: SeManageVolumePrivilege 3940 PROTONVP.exe Token: SeImpersonatePrivilege 3940 PROTONVP.exe Token: SeCreateGlobalPrivilege 3940 PROTONVP.exe Token: SeCreateTokenPrivilege 3940 PROTONVP.exe Token: SeAssignPrimaryTokenPrivilege 3940 PROTONVP.exe Token: SeLockMemoryPrivilege 3940 PROTONVP.exe Token: SeIncreaseQuotaPrivilege 3940 PROTONVP.exe Token: SeMachineAccountPrivilege 3940 PROTONVP.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
PROTONVP.exepid process 3940 PROTONVP.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
msiexec.exedescription pid process target process PID 5044 wrote to memory of 1480 5044 msiexec.exe MsiExec.exe PID 5044 wrote to memory of 1480 5044 msiexec.exe MsiExec.exe PID 5044 wrote to memory of 1480 5044 msiexec.exe MsiExec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LOCALES\PROTONVP.exe"C:\Users\Admin\AppData\Local\Temp\LOCALES\PROTONVP.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 50D43174F8F6F47586CB00291F52D15C C2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI6236.tmpFilesize
495KB
MD5cfab78ac0d042a1d8ad7085a94328ef6
SHA1b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA25617b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
SHA512647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
-
C:\Users\Admin\AppData\Local\Temp\MSI6236.tmpFilesize
495KB
MD5cfab78ac0d042a1d8ad7085a94328ef6
SHA1b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA25617b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
SHA512647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
-
C:\Users\Admin\AppData\Local\Temp\{78E8B570-4551-416B-8F87-6917E1EBBAF9}\decoder.dllFilesize
206KB
MD5899944fb96ccc34cfbd2ccb9134367c5
SHA17c46aa3f84ba5da95ceff39cd49185672f963538
SHA256780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259
SHA5122c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0
-
C:\Users\Admin\AppData\Local\Temp\{78E8B570-4551-416B-8F87-6917E1EBBAF9}\decoder.dllFilesize
206KB
MD5899944fb96ccc34cfbd2ccb9134367c5
SHA17c46aa3f84ba5da95ceff39cd49185672f963538
SHA256780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259
SHA5122c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0
-
memory/1480-134-0x0000000000000000-mapping.dmp