fcd3a1825386eb0b08d3c8a686acf5d05e534c10d866539984caa74ec968d931

General

Target

a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe
Size

1.7MB
MD5

d9e11790a7fef40f5776de7d38a65bbb
SHA1

c5c62a5807d8876ece11fd31495679fbe25eeb3d
SHA256

a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11
SHA512

d7dbc0e9f86e2035f18e713aeb29c906179f984bcc2a7bb3a398c3dbfc1801c1e51dea73263e27542a1bfa40f739ae338a700a85b3b619be61ca371941df8137
SSDEEP

24576:R7FUDowAyrTVE3U5Fmdvpi4PaJPfrT90eKc4cgFLNPfs8duMpmsDx:RBuZrEUqpi4wPH9RHgFLRdp/t

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1232	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp

Loads dropped DLL 2 IoCs

pid	Process
1240	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe
1232	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1232	1240	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	27
PID 1240 wrote to memory of 1232	1240	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	27
PID 1240 wrote to memory of 1232	1240	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	27
PID 1240 wrote to memory of 1232	1240	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	27
PID 1240 wrote to memory of 1232	1240	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	27
PID 1240 wrote to memory of 1232	1240	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	27
PID 1240 wrote to memory of 1232	1240	a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe	27

C:\Users\Admin\AppData\Local\Temp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe
"C:\Users\Admin\AppData\Local\Temp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\is-0KT2L.tmp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0KT2L.tmp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp" /SL5="$80022,875199,832512,C:\Users\Admin\AppData\Local\Temp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  PID:1232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ed152667198c0fc9ebe02aa15eb56ef

SHA1
5a05487c24a2456139fcf7ce6cbe1a9fd6a03f9d

SHA256
1ea0e921bb9f81c1ad9d615fa637f9e9d7ba69b2d5bddbb57063e67fe86ee36d

SHA512
3616e347b3e90607609f79f66fd184143f62b6a39e06387d05c60274c647b1cb2b2ae329826f93c7d1be4937301f91661c18871e3621349c798c1a4afedbf6b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F2F.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0KT2L.tmp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp

Filesize
3.0MB

MD5
f992278fb92d50ca8bb4a6f43772b4cc

SHA1
e895323b721206603a903181c810e0f1139178f3

SHA256
1e4d2015f5e9dde2450695ff67ca0353ba26c404c021aadbd8faac65c04cdeb5

SHA512
db7ae9794d225da68f4c672426110e32abf3c12373f8b3988a148345e18d7917c2286568f14040ae385418ed38a3a2409c74ea977f32b65d1e7ac77943f0409e

Download Submit
\Users\Admin\AppData\Local\Temp\is-0KT2L.tmp\a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11.tmp

Filesize
3.0MB

MD5
f992278fb92d50ca8bb4a6f43772b4cc

SHA1
e895323b721206603a903181c810e0f1139178f3

SHA256
1e4d2015f5e9dde2450695ff67ca0353ba26c404c021aadbd8faac65c04cdeb5

SHA512
db7ae9794d225da68f4c672426110e32abf3c12373f8b3988a148345e18d7917c2286568f14040ae385418ed38a3a2409c74ea977f32b65d1e7ac77943f0409e

Download Submit
\Users\Admin\AppData\Local\Temp\is-I3A9E.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
memory/1232-61-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1232-85-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1232-188-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1232-190-0x0000000003720000-0x000000000372F000-memory.dmp

Filesize
60KB

Download
memory/1232-195-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1240-84-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1240-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1240-197-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing