d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879

General

Target

d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe
Size

697KB
MD5

c0cf7ee0c410e3e5d067ff5038d6dc50
SHA1

a4ccba0c55decdce865a995ad6b224f77d0f577e
SHA256

d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879
SHA512

96c78d31af19315154ab2b233b7bfbee74df16d59a52c7a5dbdd5aa2ac8254d0dc06f16b29d6859877bc2620af4639b6610127a04c2ccf99a28383e0a271a3f4
SSDEEP

12288:wIwnzs2n//LICKFnZgqn2eB8NHP+x0xpXY3McVmfYLQY:IzDnKZllBoHmx0T8co

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1376 set thread context of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
320	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe
Token: SeBackupPrivilege	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe
Token: SeDebugPrivilege	320	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26
PID 1376 wrote to memory of 320	1376	d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe	26

C:\Users\Admin\AppData\Local\Temp\d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe
"C:\Users\Admin\AppData\Local\Temp\d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe
  "C:\Users\Admin\AppData\Local\Temp\d730699574aa64067b9e270a36c9d8021d6864a3ab32869b195a10ee4ee5e879.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-99-0x0000000074310000-0x00000000748BB000-memory.dmp

Filesize
5.7MB

Download
memory/320-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-77-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-98-0x0000000074310000-0x00000000748BB000-memory.dmp

Filesize
5.7MB

Download
memory/320-97-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-86-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-85-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-80-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-95-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/320-94-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1376-55-0x0000000074310000-0x00000000748BB000-memory.dmp

Filesize
5.7MB

Download
memory/1376-74-0x0000000074310000-0x00000000748BB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing