86f80bd5e2f0c81f2ccb3bc20f2fc2a9381934f557a9f8c760aae3d2abdfc0d9

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pivotAnimator_v2-2.exe
Size

572KB
MD5

285ba255e1e9d6afa2f8505fd484532e
SHA1

5a88d532501652128ca3bb00ae7fdbdc757c5696
SHA256

86f80bd5e2f0c81f2ccb3bc20f2fc2a9381934f557a9f8c760aae3d2abdfc0d9
SHA512

83121dea33fbd9e58375830b2ead6e9533a78910603f96bfa294dada36f05f800b127f47073cb0ce32ea48f497022a54ccc5b78a73cfbc10ccbe1971a4987a41
SSDEEP

12288:1ftU8otA3z0tuuJQX0pfd5Ehl3q89pfz/tpfB8:1y853z0tuuJQXOl5Ehl3q87Dp8

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4268	pivot_v2-2.exe
2216	pivot_v2-2.tmp
4972	pivot.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-OQNP6.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-VICVB.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-PUBGH.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-T3890.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-JLCRT.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-642AS.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-70LR7.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-ONR1C.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\animations\is-CQ1ST.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\animations\is-N98R1.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-K9G9I.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-EJAAG.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-NGF5S.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-MGBFA.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-F9MQE.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-UNBLO.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-P07KA.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-9F5V5.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-RBT3P.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-QN3MJ.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-A2CE8.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-4LA3E.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-C54P2.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-JPBNO.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-A2S0L.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-5LOAM.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-R4F9U.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-CK7JF.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-SB457.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-S7B79.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\unins000.dat	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-NAUOM.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-MARBO.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-4NTF8.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-60Q2J.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-8PTE4.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\is-NRMMO.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-I2B64.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-R58VT.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-51955.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-KC2G4.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\animations\is-99K35.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-KFHA1.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-8A5NQ.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-LIH7M.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-8VIOA.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-5S8LQ.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-TIU9Q.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-VVTE1.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-UIRES.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-69J3I.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\is-KS96P.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-0TRFU.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-1FGMT.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-U73AO.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-3QCGA.tmp	pivot_v2-2.tmp
File opened for modification	C:\Program Files (x86)\Pivot Stickfigure Animator\unins000.dat	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-OOVJR.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-0ETJB.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\is-3ORRU.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-91R06.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-VORR7.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-FJQN8.tmp	pivot_v2-2.tmp
File created	C:\Program Files (x86)\Pivot Stickfigure Animator\stick figures\alphabet\is-TQ3LU.tmp	pivot_v2-2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\shell\open	pivot_v2-2.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\DefaultIcon\ = "C:\\Program Files (x86)\\Pivot Stickfigure Animator\\pivot.exe,1"	pivot_v2-2.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\ = "Pivot Animation Figure"	pivot_v2-2.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\DefaultIcon\ = "C:\\Program Files (x86)\\Pivot Stickfigure Animator\\pivot.exe,2"	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\shell	pivot_v2-2.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\shell\open\command\ = "\"C:\\Program Files (x86)\\Pivot Stickfigure Animator\\pivot.exe\" \"%1"	pivot_v2-2.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.piv\ = "PivotAnimationFile"	pivot_v2-2.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\ = "Pivot Animation File"	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\shell\open\command	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\shell	pivot_v2-2.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\shell\open\command\ = "\"C:\\Program Files (x86)\\Pivot Stickfigure Animator\\pivot.exe\" \"%1\""	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.stk	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFigure\DefaultIcon	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.piv	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\DefaultIcon	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\shell\open\command	pivot_v2-2.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PivotAnimationFile\shell\open	pivot_v2-2.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.stk\ = "PivotAnimationFigure"	pivot_v2-2.tmp

Modifies system certificate store 2 TTPs 8 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	pivotAnimator_v2-2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	pivotAnimator_v2-2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E	pivotAnimator_v2-2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	pivotAnimator_v2-2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a50f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	pivotAnimator_v2-2.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	pivotAnimator_v2-2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	pivotAnimator_v2-2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	pivotAnimator_v2-2.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe
208	pivotAnimator_v2-2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	208	pivotAnimator_v2-2.exe
Token: SeShutdownPrivilege	208	pivotAnimator_v2-2.exe
Token: SeCreatePagefilePrivilege	208	pivotAnimator_v2-2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	pivot_v2-2.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 2216	4268	pivot_v2-2.exe	95
PID 4268 wrote to memory of 2216	4268	pivot_v2-2.exe	95
PID 4268 wrote to memory of 2216	4268	pivot_v2-2.exe	95
PID 208 wrote to memory of 4972	208	pivotAnimator_v2-2.exe	97
PID 208 wrote to memory of 4972	208	pivotAnimator_v2-2.exe	97
PID 208 wrote to memory of 4972	208	pivotAnimator_v2-2.exe	97

C:\Users\Admin\AppData\Local\Temp\pivotAnimator_v2-2.exe
"C:\Users\Admin\AppData\Local\Temp\pivotAnimator_v2-2.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Pivot Stickfigure Animator\pivot.exe
  "C:\Program Files (x86)\Pivot Stickfigure Animator\pivot.exe"
  2⤵
  - Executes dropped EXE
  PID:4972

C:\Users\Admin\AppData\Local\Temp\Pivot_Animator_files\pivot_v2-2.exe
"C:\Users\Admin\AppData\Local\Temp\Pivot_Animator_files\pivot_v2-2.exe" /VERYSILENT
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\is-SIJBH.tmp\pivot_v2-2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SIJBH.tmp\pivot_v2-2.tmp" /SL5="$1024C,392138,54272,C:\Users\Admin\AppData\Local\Temp\Pivot_Animator_files\pivot_v2-2.exe" /VERYSILENT
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Pivot Stickfigure Animator\pivot.exe

Filesize
779KB

MD5
3346fb6c0d0073e43a6f7bffed38758d

SHA1
6e8eee796e60bd45c4b00d4696a8c1fa72bb98d1

SHA256
77dd82cb93c2b8f16b99317ac46a58dd3595e11c96891d0f67e5869ee1dcf161

SHA512
fcdc44428222ff6acb014a1375f452c697cf7d0e55d741948bdfeabfb52aa72796d01f6a706f2e324c6778bee7b2b93ed1b21328a41f37f893d96ffed6de9397

Download Submit
C:\Program Files (x86)\Pivot Stickfigure Animator\pivot.exe

Filesize
779KB

MD5
3346fb6c0d0073e43a6f7bffed38758d

SHA1
6e8eee796e60bd45c4b00d4696a8c1fa72bb98d1

SHA256
77dd82cb93c2b8f16b99317ac46a58dd3595e11c96891d0f67e5869ee1dcf161

SHA512
fcdc44428222ff6acb014a1375f452c697cf7d0e55d741948bdfeabfb52aa72796d01f6a706f2e324c6778bee7b2b93ed1b21328a41f37f893d96ffed6de9397

Download Submit
C:\Program Files (x86)\Pivot Stickfigure Animator\pivot.exe

Filesize
779KB

MD5
3346fb6c0d0073e43a6f7bffed38758d

SHA1
6e8eee796e60bd45c4b00d4696a8c1fa72bb98d1

SHA256
77dd82cb93c2b8f16b99317ac46a58dd3595e11c96891d0f67e5869ee1dcf161

SHA512
fcdc44428222ff6acb014a1375f452c697cf7d0e55d741948bdfeabfb52aa72796d01f6a706f2e324c6778bee7b2b93ed1b21328a41f37f893d96ffed6de9397

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pivot_Animator_files\pivot_v2-2.exe

Filesize
625KB

MD5
7e17d07c077c785d63dcfad293b824be

SHA1
a589554ee426ab062f031fca07bc66f2c2e089fb

SHA256
325340951fc31d4910a4ab9ab3b66b85783a47d84414d422ee289314f343bff2

SHA512
102e7dbb31e2f1cbba3c458eb00e4945f9b05fd416a3bcc15498620d820b8370d1099d79edb5bace57824aceeba6aa78c00307f876ee71e127e65c99637417af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SIJBH.tmp\pivot_v2-2.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SIJBH.tmp\pivot_v2-2.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
memory/208-141-0x000000001B5D0000-0x000000001B602000-memory.dmp

Filesize
200KB

Download
memory/208-139-0x000000001B4F0000-0x000000001B502000-memory.dmp

Filesize
72KB

Download
memory/208-133-0x0000000000030000-0x00000000000C2000-memory.dmp

Filesize
584KB

Download
memory/208-142-0x000000001B590000-0x000000001B5AE000-memory.dmp

Filesize
120KB

Download
memory/208-143-0x000000001B5B0000-0x000000001B5CA000-memory.dmp

Filesize
104KB

Download
memory/208-144-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/208-145-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/208-146-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/208-147-0x00007FF8AF970000-0x00007FF8B0431000-memory.dmp

Filesize
10.8MB

Download
memory/208-148-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/208-149-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/208-150-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/208-151-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/208-140-0x000000001B570000-0x000000001B590000-memory.dmp

Filesize
128KB

Download
memory/208-333-0x00007FF8AF970000-0x00007FF8B0431000-memory.dmp

Filesize
10.8MB

Download
memory/208-138-0x000000001B630000-0x000000001B6E2000-memory.dmp

Filesize
712KB

Download
memory/208-137-0x000000001B520000-0x000000001B570000-memory.dmp

Filesize
320KB

Download
memory/208-134-0x00007FF8AF970000-0x00007FF8B0431000-memory.dmp

Filesize
10.8MB

Download
memory/208-136-0x000000001B890000-0x000000001BDB8000-memory.dmp

Filesize
5.2MB

Download
memory/208-135-0x0000000002170000-0x0000000002180000-memory.dmp

Filesize
64KB

Download
memory/2216-327-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2216-178-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4268-328-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4268-172-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4972-332-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4972-334-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/4972-335-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4972-338-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download