78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2

Analysis

max time kernel
19s
max time network
53s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe
Size

889KB
MD5

5268552703cd4f4010dab6f951dec767
SHA1

93fadc984be53aca832c8c9188e3f15d02a96494
SHA256

78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2
SHA512

5c58829464bf73f475a27fae47639d9cbf2dc985526ba7eed7284476c14df948a4e5d85f0777305cf175b70bc4305b13dc4e3c0ff10182e181d24028b57b3a91
SSDEEP

6144:RJ1etoAWIVpTiAKhft1JEqwLcEOkCybEaQRXr9HNdvOa7AXGSqLr4Eza:XAoo7i5FMqwTOkx2LIa0EC

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\uZFa5n86.sys	shutdown.exe

Deletes itself 1 IoCs

pid	Process
596	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2828	94433b6
1668	shutdown.exe

Loads dropped DLL 1 IoCs

pid	Process
1192	Explorer.EXE

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2488-54-0x0000000000220000-0x00000000002AE000-memory.dmp	upx
behavioral1/files/0x0009000000012025-56.dat	upx
behavioral1/memory/2828-57-0x00000000002C0000-0x000000000034E000-memory.dmp	upx
behavioral1/memory/2488-86-0x0000000000220000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2828-90-0x00000000002C0000-0x000000000034E000-memory.dmp	upx
behavioral1/memory/2488-98-0x0000000000220000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2828-100-0x00000000002C0000-0x000000000034E000-memory.dmp	upx
behavioral1/memory/2828-127-0x00000000002C0000-0x000000000034E000-memory.dmp	upx
behavioral1/files/0x0009000000012025-129.dat	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_BE25D0FE540174A4A87E2295C663329D	94433b6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	94433b6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	94433b6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	94433b6
File created	C:\Windows\system32\ \Windows\System32\nnvoYfVxj.sys	shutdown.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D5DF65AC453D5B00AB7595FC0459D879	94433b6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D5DF65AC453D5B00AB7595FC0459D879	94433b6
File created	C:\Windows\Syswow64\94433b6	78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	94433b6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	94433b6
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_BE25D0FE540174A4A87E2295C663329D	94433b6

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Logs\shutdown.exe	Explorer.EXE
File opened for modification	C:\Windows\Logs\shutdown.exe	Explorer.EXE
File created	C:\Windows\AJYn9nz.sys	shutdown.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1964	timeout.exe
2672	timeout.exe

Modifies data under HKEY_USERS 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	94433b6
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	94433b6
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	94433b6
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	94433b6
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	94433b6
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	94433b6
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ba000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	94433b6
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	94433b6
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	94433b6
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	94433b6
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	94433b6
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	94433b6
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	94433b6

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	94433b6
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	shutdown.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	shutdown.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	94433b6
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	94433b6
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	94433b6

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2828	94433b6
2828	94433b6
2828	94433b6
2828	94433b6
2828	94433b6
2828	94433b6
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
2828	94433b6

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe
Token: SeTcbPrivilege	2488	78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe
Token: SeDebugPrivilege	2828	94433b6
Token: SeTcbPrivilege	2828	94433b6
Token: SeDebugPrivilege	2828	94433b6
Token: SeDebugPrivilege	1192	Explorer.EXE
Token: SeDebugPrivilege	1192	Explorer.EXE
Token: SeIncBasePriorityPrivilege	2488	78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe
Token: SeDebugPrivilege	2828	94433b6
Token: SeDebugPrivilege	1668	shutdown.exe
Token: SeDebugPrivilege	1668	shutdown.exe
Token: SeDebugPrivilege	1668	shutdown.exe
Token: SeIncBasePriorityPrivilege	2828	94433b6

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1192	2828	94433b6	18
PID 2828 wrote to memory of 1192	2828	94433b6	18
PID 2828 wrote to memory of 1192	2828	94433b6	18
PID 2828 wrote to memory of 1192	2828	94433b6	18
PID 2828 wrote to memory of 1192	2828	94433b6	18
PID 1192 wrote to memory of 1668	1192	Explorer.EXE	29
PID 1192 wrote to memory of 1668	1192	Explorer.EXE	29
PID 1192 wrote to memory of 1668	1192	Explorer.EXE	29
PID 1192 wrote to memory of 1668	1192	Explorer.EXE	29
PID 1192 wrote to memory of 1668	1192	Explorer.EXE	29
PID 1192 wrote to memory of 1668	1192	Explorer.EXE	29
PID 1192 wrote to memory of 1668	1192	Explorer.EXE	29
PID 1192 wrote to memory of 1668	1192	Explorer.EXE	29
PID 2828 wrote to memory of 420	2828	94433b6	5
PID 2828 wrote to memory of 420	2828	94433b6	5
PID 2828 wrote to memory of 420	2828	94433b6	5
PID 2828 wrote to memory of 420	2828	94433b6	5
PID 2828 wrote to memory of 420	2828	94433b6	5
PID 2488 wrote to memory of 596	2488	78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe	32
PID 2488 wrote to memory of 596	2488	78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe	32
PID 2488 wrote to memory of 596	2488	78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe	32
PID 2488 wrote to memory of 596	2488	78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe	32
PID 596 wrote to memory of 2672	596	cmd.exe	34
PID 596 wrote to memory of 2672	596	cmd.exe	34
PID 596 wrote to memory of 2672	596	cmd.exe	34
PID 596 wrote to memory of 2672	596	cmd.exe	34
PID 2828 wrote to memory of 2036	2828	94433b6	35
PID 2828 wrote to memory of 2036	2828	94433b6	35
PID 2828 wrote to memory of 2036	2828	94433b6	35
PID 2828 wrote to memory of 2036	2828	94433b6	35
PID 2036 wrote to memory of 1964	2036	cmd.exe	37
PID 2036 wrote to memory of 1964	2036	cmd.exe	37
PID 2036 wrote to memory of 1964	2036	cmd.exe	37
PID 2036 wrote to memory of 1964	2036	cmd.exe	37

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe
  "C:\Users\Admin\AppData\Local\Temp\78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\78bfcc08559801a33ca17235700b47830f79de64cd98f7b3cd66f0e39a12f7e2.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:596
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2672
- C:\Windows\Logs\shutdown.exe
  "C:\Windows\Logs\shutdown.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:1668

C:\Windows\Syswow64\94433b6
C:\Windows\Syswow64\94433b6
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\94433b6"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TarB52D.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Windows\Logs\shutdown.exe

Filesize
33KB

MD5
afb0227374ddf86df2d8c2e4460ba92c

SHA1
f1c76ade438cb46a83961c8c3722d35af8bcdd37

SHA256
a9abe5b78deda854d09118996b748d6ad3b35da3238fba8660602361e7323eb5

SHA512
51ce4b16acc07542a5a75d3f389d9cc29fcc506cdf15471edbca0043b22cba662eeca07f09dbba43c9ce945fac8e38fc35b4909cbd21547c250d68f53edb7313

Download Submit
C:\Windows\SysWOW64\94433b6

Filesize
889KB

MD5
1058a5280c3daa51e7d08db2de431ca6

SHA1
1aa51f9247d1fd46a3c4b6f0ebbacf3b44d5317a

SHA256
ac30d354530fe3e17eb73f9a7b2a6acaba2de7e52390d8effeb6131fe0302f80

SHA512
0cdfdaafb331fa607095fbbe490d1ee39dab2cadc8c10a932d88d5b506b6228a202d3f7e5e25fba665a784595b3a8609e28ea3a346f5aed856dc89758db265b4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Windows\Syswow64\94433b6

Filesize
889KB

MD5
1058a5280c3daa51e7d08db2de431ca6

SHA1
1aa51f9247d1fd46a3c4b6f0ebbacf3b44d5317a

SHA256
ac30d354530fe3e17eb73f9a7b2a6acaba2de7e52390d8effeb6131fe0302f80

SHA512
0cdfdaafb331fa607095fbbe490d1ee39dab2cadc8c10a932d88d5b506b6228a202d3f7e5e25fba665a784595b3a8609e28ea3a346f5aed856dc89758db265b4

Download Submit
\Windows\Logs\shutdown.exe

Filesize
33KB

MD5
afb0227374ddf86df2d8c2e4460ba92c

SHA1
f1c76ade438cb46a83961c8c3722d35af8bcdd37

SHA256
a9abe5b78deda854d09118996b748d6ad3b35da3238fba8660602361e7323eb5

SHA512
51ce4b16acc07542a5a75d3f389d9cc29fcc506cdf15471edbca0043b22cba662eeca07f09dbba43c9ce945fac8e38fc35b4909cbd21547c250d68f53edb7313

Download Submit
memory/420-101-0x0000000000920000-0x0000000000948000-memory.dmp

Filesize
160KB

Download
memory/420-94-0x0000000000700000-0x0000000000703000-memory.dmp

Filesize
12KB

Download
memory/1192-70-0x0000000002C00000-0x0000000002C03000-memory.dmp

Filesize
12KB

Download
memory/1192-72-0x0000000002C00000-0x0000000002C03000-memory.dmp

Filesize
12KB

Download
memory/1192-73-0x0000000006C60000-0x0000000006D57000-memory.dmp

Filesize
988KB

Download
memory/1192-128-0x0000000006C60000-0x0000000006D57000-memory.dmp

Filesize
988KB

Download
memory/1192-71-0x0000000002C00000-0x0000000002C03000-memory.dmp

Filesize
12KB

Download
memory/1668-92-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1668-77-0x0000000000110000-0x00000000001D3000-memory.dmp

Filesize
780KB

Download
memory/1668-158-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/1668-82-0x00000000001E0000-0x00000000001E3000-memory.dmp

Filesize
12KB

Download
memory/1668-91-0x000007FEBE1E0000-0x000007FEBE1F0000-memory.dmp

Filesize
64KB

Download
memory/1668-87-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1668-156-0x0000000037BC0000-0x0000000037BD0000-memory.dmp

Filesize
64KB

Download
memory/1668-89-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1668-155-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1668-145-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1668-79-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2488-86-0x0000000000220000-0x00000000002AE000-memory.dmp

Filesize
568KB

Download
memory/2488-54-0x0000000000220000-0x00000000002AE000-memory.dmp

Filesize
568KB

Download
memory/2488-98-0x0000000000220000-0x00000000002AE000-memory.dmp

Filesize
568KB

Download
memory/2828-127-0x00000000002C0000-0x000000000034E000-memory.dmp

Filesize
568KB

Download
memory/2828-57-0x00000000002C0000-0x000000000034E000-memory.dmp

Filesize
568KB

Download
memory/2828-90-0x00000000002C0000-0x000000000034E000-memory.dmp

Filesize
568KB

Download
memory/2828-100-0x00000000002C0000-0x000000000034E000-memory.dmp

Filesize
568KB

Download