aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24

General

Target

aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe
Size

523KB
MD5

9224e118f4c08d6d1011ca694be9df3b
SHA1

87799e7f922e8e0170a37c3c73ec7ca0a8b5ca92
SHA256

aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24
SHA512

597197e5d45712a88a8bda971a1f459228203b774b247efa6c1d405c9878b111b02063124e051b9a5f6eec11f5f220bad443917cd122a6da2b7c9d7cd96c6f8a
SSDEEP

6144:vK8LfFo13WU+kmGbW8m5Oq3zmzZVhnkidyPaiWaXukbSBykZBItx+:S8LfK+mb25OqdEFywI

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	328	WerFault.exe	19

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	328	aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1908	328	aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe	27
PID 328 wrote to memory of 1908	328	aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe	27
PID 328 wrote to memory of 1908	328	aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe	27
PID 328 wrote to memory of 1908	328	aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe	27

C:\Users\Admin\AppData\Local\Temp\aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe
"C:\Users\Admin\AppData\Local\Temp\aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24.exe"
1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 1544
  2⤵
  - Program crash
  PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-54-0x0000000001320000-0x00000000013AA000-memory.dmp

Filesize
552KB

Download
memory/328-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/328-56-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing