b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788

General

Target

b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
Size

1.8MB
MD5

a762669bf9d765914f31614b0d5b8b4c
SHA1

a8e5b5b0d518f710aff575e891c9435872c18514
SHA256

b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788
SHA512

0cda4acf8412a01b66f72188d0b250923258ed09194850087f112d82ae8903755ad22480ca1e8c1c61375dc19792930466e556a776819f4b24a45fa28d70739a
SSDEEP

24576:8dYLThT/W6/h+qt8qIFjoBIFjoo2qHKS6kbxkHZBz00Su60Su1Lk0Su90SuC3WA9:uY3ZQm3o2G/6kbxcZldFd1LrdedSAOGC

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemMaintenanceUpdaterGL = "\"C:\\Program Files\\System Maintenance GL\\System Maintenance Updater.exe\""	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemMaintenanceUpdaterGL = "\"C:\\Program Files\\System Maintenance GL\\System Maintenance Updater.exe\""	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

Processes:

b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

description	ioc	process
File created	C:\Program Files\System Maintenance GL\System Maintenance Updater.exe	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
File created	C:\Program Files\System Maintenance GL\System Maintenance.exe	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
File created	C:\Program Files\System Maintenance GL\uninstall.exe	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
File created	C:\Program Files\System Maintenance GL\upToDate.wav	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
File created	C:\Program Files\System Maintenance GL\notify.wav	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
File created	C:\Program Files\System Maintenance GL\icon.ico	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d701030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d467e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

pid process

212 b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

description pid process

Token: SeDebugPrivilege 212 b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

pid	process
212	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

description	pid	process
Token: SeDebugPrivilege	212	b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe

C:\Users\Admin\AppData\Local\Temp\b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe
"C:\Users\Admin\AppData\Local\Temp\b73cd61cf2835caa466489fd481bc09bb0dc661d0b2262a312d8e312a5cef788.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212