3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad

Analysis

max time kernel
152s
max time network
161s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Size

1.9MB
MD5

c92f0fea8d7a5010ed4493cd5600cb1c
SHA1

fa256e858b84cff6bdaabbec96a911dbdb2c04d4
SHA256

3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad
SHA512

48af6bc13792bb5eb579f50a00f69c28199459a59a3321fcbf3c2c51f7392deda2b09d55e03692c014de84cd692c24c12c565ee794cb2736c1d9b9316ab15ac6
SSDEEP

24576:51MhLpgeK7gMD5cClV3j0nNI6hn2IQFiJC:5Kdk7JlNjy73JC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe

Modifies registry class 62 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0\HELPDIR	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\TypeLib	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\ = "DispInterface1"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\ËÙ´ï\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe\" \"%1\""	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\ = "ITBrowserToDelphi"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\TypeLib\ = "{2CE64F20-D4B0-11D3-9CA6-444553540000}"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\TypeLib\Version = "1.0"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\TypeLib\Version = "1.0"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\ËÙ´ï\command	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\ËÙ´ï\command	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\TypeLib\Version = "1.0"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\TypeLib\Version = "1.0"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\ProxyStubClsid32	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\ËÙ´ï	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\ProxyStubClsid32	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\ = "ITBrowserToDelphi"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\TypeLib\ = "{2CE64F20-D4B0-11D3-9CA6-444553540000}"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe\" \"%1\""	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\ = "ËÙ´ï"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\ = "ËÙ´ï"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe\" \"%1\""	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\ProxyStubClsid32	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0\ = "example Library"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\ËÙ´ï	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\ = "ËÙ´ï"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\ËÙ´ï	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\ProxyStubClsid32	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\ËÙ´ï\command	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\ËÙ´ï\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe\" \"%1\""	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0\FLAGS\ = "0"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\ = "DispInterface1"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\TypeLib	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\TypeLib\ = "{2CE64F20-D4B0-11D3-9CA6-444553540000}"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe\" \"%1\""	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0\FLAGS	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0\0	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE64F20-D4B0-11D3-9CA6-444553540000}\1.0\0\win32	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\TypeLib\ = "{2CE64F20-D4B0-11D3-9CA6-444553540000}"	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE64F21-D4B0-11D3-9CA6-444553540000}\TypeLib	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ECD7C67C-BC6E-4A2A-9530-45547BE7B3F9}\TypeLib	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\ËÙ´ï\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe\" \"%1\""	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2544	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2544	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
2544	3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe

C:\Users\Admin\AppData\Local\Temp\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe
"C:\Users\Admin\AppData\Local\Temp\3c205a39087d06c3892e178994344f11962e12355d6636127f8a088d10d925ad.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabF817.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Config.ini

Filesize
49B

MD5
a90e080e08a3d43d94d86ae99d069839

SHA1
62229e11a0c3df7c6263184925f92ce84aa63678

SHA256
ab92c2c404e114c75b8c711b4ff439dd1415ac1bd873ffdd4ef5cd2da2b17899

SHA512
e5470e4d44cde1664794315457c8de93226bfa79ef27be2dcbfb1b464de5dde36975e56af0ffb69a6c057055ab9283a5f3636889ec9c07852fbd984696cc555e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Config.ini

Filesize
23B

MD5
26f53843188bf2b9399b4fe89e20fbe5

SHA1
0809c4cccd5d3b7d04f92418b248b465d727840f

SHA256
0755ed42d97172933d1071f2d17a9171c6efb615855c028c6581fbef64c82a8e

SHA512
4d0f3fc31db41a6245dc992a179f95471174253eb606cddcafbc11a5fd0d2dd01d2d7daa08f2a7984ae704c26d1593892ca7ac935bd199706c08ee3b1c117ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD77.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
memory/2544-82-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/2544-55-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/2544-53-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/2544-76-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/2544-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2544-85-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/2544-102-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Filesize
4KB

Download
memory/2544-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2544-112-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/2544-1-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/2544-144-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Filesize
4KB

Download
memory/2544-147-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads