Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 15:53
Static task
static1
Behavioral task
behavioral1
Sample
pivotAnimator_v2-2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
pivotAnimator_v2-2.exe
Resource
win10v2004-20230703-en
General
-
Target
pivotAnimator_v2-2.exe
-
Size
572KB
-
MD5
285ba255e1e9d6afa2f8505fd484532e
-
SHA1
5a88d532501652128ca3bb00ae7fdbdc757c5696
-
SHA256
86f80bd5e2f0c81f2ccb3bc20f2fc2a9381934f557a9f8c760aae3d2abdfc0d9
-
SHA512
83121dea33fbd9e58375830b2ead6e9533a78910603f96bfa294dada36f05f800b127f47073cb0ce32ea48f497022a54ccc5b78a73cfbc10ccbe1971a4987a41
-
SSDEEP
12288:1ftU8otA3z0tuuJQX0pfd5Ehl3q89pfz/tpfB8:1y853z0tuuJQXOl5Ehl3q87Dp8
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 4268 pivot_v2-2.exe 2216 pivot_v2-2.tmp 4972 pivot.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-OQNP6.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-VICVB.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-PUBGH.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-T3890.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-JLCRT.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-642AS.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-70LR7.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-ONR1C.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\animations\is-CQ1ST.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\animations\is-N98R1.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-K9G9I.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-EJAAG.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-NGF5S.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-MGBFA.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-F9MQE.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-UNBLO.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-P07KA.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-9F5V5.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-RBT3P.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-QN3MJ.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-A2CE8.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-4LA3E.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-C54P2.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-JPBNO.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-A2S0L.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-5LOAM.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-R4F9U.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-CK7JF.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-SB457.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-S7B79.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\unins000.dat pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-NAUOM.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-MARBO.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-4NTF8.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-60Q2J.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-8PTE4.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\is-NRMMO.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-I2B64.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-R58VT.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-51955.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-KC2G4.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\animations\is-99K35.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-KFHA1.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-8A5NQ.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-LIH7M.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-8VIOA.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-5S8LQ.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-TIU9Q.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-VVTE1.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-UIRES.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-69J3I.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\is-KS96P.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-0TRFU.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-1FGMT.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-U73AO.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-3QCGA.tmp pivot_v2-2.tmp File opened for modification C:\Program Files (x86)\Pivot Stickfigure Animator\unins000.dat pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-OOVJR.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-0ETJB.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-3ORRU.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-91R06.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-VORR7.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-FJQN8.tmp pivot_v2-2.tmp File created C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-TQ3LU.tmp pivot_v2-2.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\shell\open pivot_v2-2.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\DefaultIcon\ = "C:\\Program Files (x86)\\Pivot Stickfigure Animator\\pivot.exe,1" pivot_v2-2.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\ = "Pivot Animation Figure" pivot_v2-2.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\DefaultIcon\ = "C:\\Program Files (x86)\\Pivot Stickfigure Animator\\pivot.exe,2" pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\shell pivot_v2-2.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\shell\open\command\ = "\"C:\\Program Files (x86)\\Pivot Stickfigure Animator\\pivot.exe\" \"%1" pivot_v2-2.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.piv\ = "PivotAnimationFile" pivot_v2-2.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\ = "Pivot Animation File" pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\shell\open\command pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\shell pivot_v2-2.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\shell\open\command\ = "\"C:\\Program Files (x86)\\Pivot Stickfigure Animator\\pivot.exe\" \"%1\"" pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.stk pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\DefaultIcon pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.piv pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\DefaultIcon pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\shell\open\command pivot_v2-2.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\shell\open pivot_v2-2.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.stk\ = "PivotAnimationFigure" pivot_v2-2.tmp -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 pivotAnimator_v2-2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 pivotAnimator_v2-2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E pivotAnimator_v2-2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c pivotAnimator_v2-2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a50f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c pivotAnimator_v2-2.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C pivotAnimator_v2-2.exe Set value (data) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 pivotAnimator_v2-2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A pivotAnimator_v2-2.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe 208 pivotAnimator_v2-2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 208 pivotAnimator_v2-2.exe Token: SeShutdownPrivilege 208 pivotAnimator_v2-2.exe Token: SeCreatePagefilePrivilege 208 pivotAnimator_v2-2.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 pivot_v2-2.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4268 wrote to memory of 2216 4268 pivot_v2-2.exe 95 PID 4268 wrote to memory of 2216 4268 pivot_v2-2.exe 95 PID 4268 wrote to memory of 2216 4268 pivot_v2-2.exe 95 PID 208 wrote to memory of 4972 208 pivotAnimator_v2-2.exe 97 PID 208 wrote to memory of 4972 208 pivotAnimator_v2-2.exe 97 PID 208 wrote to memory of 4972 208 pivotAnimator_v2-2.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\pivotAnimator_v2-2.exe"C:\Users\Admin\AppData\Local\Temp\pivotAnimator_v2-2.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Program Files (x86)\Pivot Stickfigure Animator\pivot.exe"C:\Program Files (x86)\Pivot Stickfigure Animator\pivot.exe"2⤵
- Executes dropped EXE
PID:4972
-
-
C:\Users\Admin\AppData\Local\Temp\Pivot_Animator_files\pivot_v2-2.exe"C:\Users\Admin\AppData\Local\Temp\Pivot_Animator_files\pivot_v2-2.exe" /VERYSILENT1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\is-SIJBH.tmp\pivot_v2-2.tmp"C:\Users\Admin\AppData\Local\Temp\is-SIJBH.tmp\pivot_v2-2.tmp" /SL5="$1024C,392138,54272,C:\Users\Admin\AppData\Local\Temp\Pivot_Animator_files\pivot_v2-2.exe" /VERYSILENT2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
779KB
MD53346fb6c0d0073e43a6f7bffed38758d
SHA16e8eee796e60bd45c4b00d4696a8c1fa72bb98d1
SHA25677dd82cb93c2b8f16b99317ac46a58dd3595e11c96891d0f67e5869ee1dcf161
SHA512fcdc44428222ff6acb014a1375f452c697cf7d0e55d741948bdfeabfb52aa72796d01f6a706f2e324c6778bee7b2b93ed1b21328a41f37f893d96ffed6de9397
-
Filesize
779KB
MD53346fb6c0d0073e43a6f7bffed38758d
SHA16e8eee796e60bd45c4b00d4696a8c1fa72bb98d1
SHA25677dd82cb93c2b8f16b99317ac46a58dd3595e11c96891d0f67e5869ee1dcf161
SHA512fcdc44428222ff6acb014a1375f452c697cf7d0e55d741948bdfeabfb52aa72796d01f6a706f2e324c6778bee7b2b93ed1b21328a41f37f893d96ffed6de9397
-
Filesize
779KB
MD53346fb6c0d0073e43a6f7bffed38758d
SHA16e8eee796e60bd45c4b00d4696a8c1fa72bb98d1
SHA25677dd82cb93c2b8f16b99317ac46a58dd3595e11c96891d0f67e5869ee1dcf161
SHA512fcdc44428222ff6acb014a1375f452c697cf7d0e55d741948bdfeabfb52aa72796d01f6a706f2e324c6778bee7b2b93ed1b21328a41f37f893d96ffed6de9397
-
Filesize
625KB
MD57e17d07c077c785d63dcfad293b824be
SHA1a589554ee426ab062f031fca07bc66f2c2e089fb
SHA256325340951fc31d4910a4ab9ab3b66b85783a47d84414d422ee289314f343bff2
SHA512102e7dbb31e2f1cbba3c458eb00e4945f9b05fd416a3bcc15498620d820b8370d1099d79edb5bace57824aceeba6aa78c00307f876ee71e127e65c99637417af
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891