xmrig | 33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3

Analysis

max time kernel
132s
max time network
147s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14-11-2023 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Size

9.9MB
MD5

c587b4b15255bf826cfa4ae67144be08
SHA1

ba6fb8933f22d69bb7c9ed81b7c555ca30b39ab6
SHA256

33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3
SHA512

01d7e59ca61c59a333d2a593d8e3ebee6a3e2c8628aca575d8c5115a807fc797c488aeb3d4822ee329385cc36a49b4869dce9f8e3ab29ce8911302801e3531f1
SSDEEP

98304:fQVdEMntjpBcNzKWr9mCjuTfeCuvLASCpmvdzuYg6YTDsj:fQVXndQN/55UfxdQjqQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2452-332-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/2452-495-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/2452-496-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/2452-499-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/2452-502-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/2452-510-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2452-1-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/2452-332-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/2452-495-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/2452-496-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/2452-499-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/2452-502-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/2452-510-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/2452-512-0x0000000000400000-0x00000000010B6000-memory.dmp	upx

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	D:\autorun.inf	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	F:\autorun.inf	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	F:\autorun.inf	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7-zip.chm.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7z.dll.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7z.sfx.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7-zip.dll	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7-zip.dll.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
File created	C:\Program Files\7-Zip\7z.exe.exe	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.zobldSbcoV.com"	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.cMswmUKZvw.com"	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.fiDEwuglZB.com"	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.QEuprSAVeQ.com"	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.waLEehlSJT.com"	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.jPGqVtRoZm.com"	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2452	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
Token: SeLockMemoryPrivilege	2452	33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe

C:\Users\Admin\AppData\Local\Temp\33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe
"C:\Users\Admin\AppData\Local\Temp\33fb580a0a57849f8849e7eb031a57407e4d5a2125f8b33e322cc95aa3193eb3.exe"
1⤵
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
aca4e9819c7a273a1deadf41231ceb62

SHA1
6b80eb2b1d7c95b889b3937855756ab9044c338a

SHA256
f70ca5109ec6c99c377023b641ec88417c1f22520b2ee15d92454c1d15120edd

SHA512
a7fdb348c9aa248f5f24d1484f42d1a469492455bdf06defe093331707cca370d6c9666fe00fe65b29b5cde14c974627d024975f861252e1b06149c3dd537885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf1c6e669b3d25f05762d634dc378239

SHA1
5f9212a9585a29beb30278b4085a62faa6ff2906

SHA256
bccae7898924f642033ffe4478db59e3a68d70873a021926e8a3d06fd4f0eac4

SHA512
b0285d04c8dcf125842111a8b7c6100b81b378f651f64789aa731ed84ecd4c90a633d2e575dbe643f146e9e29dbb0433c02f387961f4e9f54bf40ed584ee550c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08e40d3b76060adc68d996a7a3638d9f

SHA1
b25042836f8e18afdf8e0d802c24a327cb728acf

SHA256
3912c6ca9ad040bcc52f8db87bd5cdd783cf59fedd5b899a7fbe5a729c8a5dd0

SHA512
c085a202c58475077bca81f5cc8cf660e9af9aa11831afe1791ef868368b66f18ac90b3c412445e10454b9374269e660cb9a8288dbdeabae02b63e6c17eefe64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b6216d92e2ce58a9c940c99a4fafef3

SHA1
4cca3331a9203f2165fdbf18555eae452ff95a0e

SHA256
32b44cccf6a6e36a22dc28ebea2eef558409a017c1fdba764c44f9e66d498fb2

SHA512
2b203870eb35b624713874d512492a63d882f47ca7a824343180d0c3e635a9d3fdada9fab4a5be327bfb10cdb096582c5e8032110e027fdeb11ffda13d5c74c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0a04b93f97594d77d3b5c1a06567830

SHA1
effab700a0ca82504bf697832eaf8bdf5cbdf474

SHA256
6155d640650e04a2c7a2e9f98f75f676959b1ad788fccdb6afb838a9957c9f81

SHA512
9697b01e51f86ed15aa755d9009180f0cb5abd9d339c7677e796033490d493fd67d3f8d7305fc476ca33855e149b09824a2040fa225b41b30e63d26c0e69e26b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9311e5a1dc1f71e36ee76ea3015b917

SHA1
fdca091a70b3b80dd2eae98fd4efe36243a4cceb

SHA256
d1889604e95c96eebd949a2c3745bb15add1c2b362fd17cbdc91d6b997f94b80

SHA512
7242d182cc762ce59432d5bfd5b93161698d2c30972c82ec9bc051f2af54f8289af70cf70b752ddb35a4841d77299ec88454b79695fbf512346300671c03170f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A1C.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A4E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
memory/2452-495-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/2452-505-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2452-332-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/2452-1-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/2452-496-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/2452-499-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/2452-502-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/2452-0-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2452-506-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2452-507-0x0000000000260000-0x0000000000360000-memory.dmp

Filesize
1024KB

Download
memory/2452-508-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2452-509-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2452-510-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download
memory/2452-511-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/2452-512-0x0000000000400000-0x00000000010B6000-memory.dmp

Filesize
12.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads