01320a48d2d6c636502010f75f23e5fae27f06ce628b40ef0548fad5f5bc8834

Analysis

max time kernel
50s
max time network
77s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11-11-2022 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe
Size

1.7MB
MD5

2c1c93a93645d3deb11692760a713df4
SHA1

9178ac91eb42073926397cae1e6109b95a4ac35f
SHA256

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf
SHA512

be41c283ae65bca975e8495f77857d4a97296867e244acc0c0fc38c78ff30caa706eeb8165ce4dbac908150673d3e74123b46052bfdea038d40cd896134fc314
SSDEEP

24576:n4nXubIQGyxbPV0db26Wmd0l4sv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdOi:nqe3f61mZSffPMWrQ0Zkd

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmpfile_.exefile_.tmp

pid process

1192 a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
1448 file_.exe
1104 file_.tmp

pid	process
1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
1448	file_.exe
1104	file_.tmp

Loads dropped DLL 5 IoCs

Processes:

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exea2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmpfile_.exefile_.tmp

pid	process
1652	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe
1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
1448	file_.exe
1104	file_.tmp
1104	file_.tmp

Modifies system certificate store 2 TTPs 8 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmpfile_.tmp

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	file_.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	file_.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	file_.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	file_.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

pid process

1192 a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exea2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmpfile_.exe

description	pid	process	target process
PID 1652 wrote to memory of 1192	1652	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1652 wrote to memory of 1192	1652	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1652 wrote to memory of 1192	1652	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1652 wrote to memory of 1192	1652	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1652 wrote to memory of 1192	1652	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1652 wrote to memory of 1192	1652	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1652 wrote to memory of 1192	1652	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
PID 1192 wrote to memory of 1448	1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 1192 wrote to memory of 1448	1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 1192 wrote to memory of 1448	1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 1192 wrote to memory of 1448	1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 1192 wrote to memory of 1448	1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 1192 wrote to memory of 1448	1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 1192 wrote to memory of 1448	1192	a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp	file_.exe
PID 1448 wrote to memory of 1104	1448	file_.exe	file_.tmp
PID 1448 wrote to memory of 1104	1448	file_.exe	file_.tmp
PID 1448 wrote to memory of 1104	1448	file_.exe	file_.tmp
PID 1448 wrote to memory of 1104	1448	file_.exe	file_.tmp
PID 1448 wrote to memory of 1104	1448	file_.exe	file_.tmp
PID 1448 wrote to memory of 1104	1448	file_.exe	file_.tmp
PID 1448 wrote to memory of 1104	1448	file_.exe	file_.tmp

C:\Users\Admin\AppData\Local\Temp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe
"C:\Users\Admin\AppData\Local\Temp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\is-P6AMK.tmp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp
"C:\Users\Admin\AppData\Local\Temp\is-P6AMK.tmp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp" /SL5="$7012C,831488,831488,C:\Users\Admin\AppData\Local\Temp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\is-3QPM9.tmp\file_.exe
"C:\Users\Admin\AppData\Local\Temp\is-3QPM9.tmp\file_.exe" /LANG=en /NA=Rh85hR64
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\is-UD2H9.tmp\file_.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UD2H9.tmp\file_.tmp" /SL5="$201B4,1577628,798720,C:\Users\Admin\AppData\Local\Temp\is-3QPM9.tmp\file_.exe" /LANG=en /NA=Rh85hR64
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-3QPM9.tmp\file_.exe

Filesize
2.4MB

MD5
5c32dd00458ce7452363924473f9a8ea

SHA1
3304fad9a22267892754bf1b7227baf1c9f7b966

SHA256
b4eb51e888d78954e0554125f86b21b9fed30899f16fd15db9b3ce409f1a6dad

SHA512
e5841d84ddc7b967f0d08dbb2c158e4d118c0dffc5a516ac024121f646f72399dd8bf09ed4e8604491febe5e2bbfe3bfc6de2e2b9b29b87ab684126d90432159

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3QPM9.tmp\file_.exe

Filesize
2.4MB

MD5
5c32dd00458ce7452363924473f9a8ea

SHA1
3304fad9a22267892754bf1b7227baf1c9f7b966

SHA256
b4eb51e888d78954e0554125f86b21b9fed30899f16fd15db9b3ce409f1a6dad

SHA512
e5841d84ddc7b967f0d08dbb2c158e4d118c0dffc5a516ac024121f646f72399dd8bf09ed4e8604491febe5e2bbfe3bfc6de2e2b9b29b87ab684126d90432159

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P6AMK.tmp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

Filesize
3.0MB

MD5
0c229cd26910820581b5809c62fe5619

SHA1
28c0630385b21f29e3e2bcc34865e5d15726eaa0

SHA256
abfa49a915d2e0a82561ca440365e6a2d59f228533b56a8f78addf000a1081b3

SHA512
b8ff3dc65f7c0e03721572af738ec4886ba895dc70c1a41a3ce8c8abe0946d167cec71913017fd11d5892452db761ea88901a5a09a681ae779dd531edbb83a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UD2H9.tmp\file_.tmp

Filesize
2.9MB

MD5
4186cf42a2321ac3fac422f87c74db86

SHA1
8ecabb8f9b852e65eeab2b666cf89f2c54d4cba5

SHA256
0ea001beca6f62dd410158c78e7aaf9fd56a71ad33a7c5af0899b33608eed7bb

SHA512
c7ca63c97ebf5754564819d7a59439e73699803adac1cdf6e6c9593763de5e106c05715df0b72c02bc6dfb4605d152892267957df8a90da48fa57d4c65989329

Download Submit
\Users\Admin\AppData\Local\Temp\is-3QPM9.tmp\file_.exe

Filesize
2.4MB

MD5
5c32dd00458ce7452363924473f9a8ea

SHA1
3304fad9a22267892754bf1b7227baf1c9f7b966

SHA256
b4eb51e888d78954e0554125f86b21b9fed30899f16fd15db9b3ce409f1a6dad

SHA512
e5841d84ddc7b967f0d08dbb2c158e4d118c0dffc5a516ac024121f646f72399dd8bf09ed4e8604491febe5e2bbfe3bfc6de2e2b9b29b87ab684126d90432159

Download Submit
\Users\Admin\AppData\Local\Temp\is-FE459.tmp\Helper.dll

Filesize
2.0MB

MD5
4eb0347e66fa465f602e52c03e5c0b4b

SHA1
fdfedb72614d10766565b7f12ab87f1fdca3ea81

SHA256
c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc

SHA512
4c909a451059628119f92b2f0c8bcd67b31f63b57d5339b6ce8fd930be5c9baf261339fdd9da820321be497df8889ce7594b7bfaadbaa43c694156651bf6c1fd

Download Submit
\Users\Admin\AppData\Local\Temp\is-FE459.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
\Users\Admin\AppData\Local\Temp\is-P6AMK.tmp\a2aac45b6ae5a09bfa9e4ecdd90c5caa42acbe53588160fa6aa3f357ec6035bf.tmp

Filesize
3.0MB

MD5
0c229cd26910820581b5809c62fe5619

SHA1
28c0630385b21f29e3e2bcc34865e5d15726eaa0

SHA256
abfa49a915d2e0a82561ca440365e6a2d59f228533b56a8f78addf000a1081b3

SHA512
b8ff3dc65f7c0e03721572af738ec4886ba895dc70c1a41a3ce8c8abe0946d167cec71913017fd11d5892452db761ea88901a5a09a681ae779dd531edbb83a2a

Download Submit
\Users\Admin\AppData\Local\Temp\is-UD2H9.tmp\file_.tmp

Filesize
2.9MB

MD5
4186cf42a2321ac3fac422f87c74db86

SHA1
8ecabb8f9b852e65eeab2b666cf89f2c54d4cba5

SHA256
0ea001beca6f62dd410158c78e7aaf9fd56a71ad33a7c5af0899b33608eed7bb

SHA512
c7ca63c97ebf5754564819d7a59439e73699803adac1cdf6e6c9593763de5e106c05715df0b72c02bc6dfb4605d152892267957df8a90da48fa57d4c65989329

Download Submit
memory/1104-78-0x0000000007420000-0x000000000742F000-memory.dmp

Filesize
60KB

Download
memory/1104-71-0x0000000000000000-mapping.dmp

Download
memory/1192-58-0x0000000000000000-mapping.dmp

Download
memory/1192-62-0x0000000074601000-0x0000000074603000-memory.dmp

Filesize
8KB

Download
memory/1448-73-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1448-67-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1448-64-0x0000000000000000-mapping.dmp

Download
memory/1448-76-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1448-79-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1652-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1652-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1652-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1652-80-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download