2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-11-2023 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Size

625KB
MD5

1397cf8d91b63946171a9133d5e9cec7
SHA1

1a1acbeb404dc06a8a50247480059dbb4e6ea41e
SHA256

2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7
SHA512

ea8bf3b87c6cc7113a85744dfd5fe8bc493c8becb5cde726fa6a5dd78a95fba523b5d55b0110b35ea423a97c7f65f1f3249f18cadb2d7f668e7e928770ee3e93
SSDEEP

6144:YZmsQhU+bZVx5rLKJzu6gLP44ZwcDy/qF6cEOkCybEaQRXr9HNdvOapLj7iq2zr3:8UF30Ngj44ecDyfOkx2LIapLyV

Score

10^/10

upx vmprotect

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1204 created 420	1204	Explorer.EXE	3

Downloads MZ/PE file

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\vf05EvqqNgb.adz	TpmInit.exe
File opened for modification	C:\Windows\system32\drivers\o36kGJ24NDf.msb	TpmInit.exe
File opened for modification	C:\Windows\system32\drivers\1sCabsWlIuuV.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\drivers\AOmhF1Ry31.fwg	TpmInit.exe
File opened for modification	C:\Windows\system32\drivers\Vh6wSBrFcejS.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\drivers\W3Y314nmpcn1Xl.sys	TpmInit.exe
File created	C:\Windows\System32\drivers\eq6hS4rQZ.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\drivers\WZnt9MGRUaqX.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\drivers\NSAAvHhmS8.buc	TpmInit.exe

Deletes itself 1 IoCs

pid	Process
2816	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	TpmInit.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000015ce6-617.dat	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000a000000015cb0-126.dat	vmprotect
behavioral1/files/0x0018000000015cb0-214.dat	vmprotect
behavioral1/files/0x0026000000015cb0-298.dat	vmprotect
behavioral1/files/0x0034000000015cb0-382.dat	vmprotect

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	TpmInit.exe
File created	C:\Windows\system32\ \Windows\System32\qCuzLJ.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734	TpmInit.exe
File opened for modification	C:\Windows\system32\HKvxfV5HlkTZS.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\nOMMuhMt7YHoFQ.vbx	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	TpmInit.exe
File opened for modification	C:\Windows\system32\OzOrtqDmFL.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\C07GnFHEzei4Gu.mny	TpmInit.exe
File opened for modification	C:\Windows\system32\x0Yz4Cc3N5S.kbt	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	TpmInit.exe
File opened for modification	C:\Windows\system32\ortPvq1N3V.fgg	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734	TpmInit.exe
File opened for modification	C:\Windows\system32\28hwzM2L77fU.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\ftRVJyE1ch.sys	TpmInit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	TpmInit.exe

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\JwmIXW6yXKjlyO.iew	TpmInit.exe
File opened for modification	C:\Program Files\Windows NT\manifest.json	TpmInit.exe
File opened for modification	C:\Program Files\Mozilla Firefox\3ddbb530.js	Dwm.exe
File opened for modification	C:\Program Files\Mozilla Firefox\lib\6c407d14.js	Dwm.exe
File opened for modification	C:\Program Files (x86)\pxfKB7PSvWXe2.jtu	TpmInit.exe
File opened for modification	C:\Program Files\Windows NT\3ddbb010.js	TpmInit.exe
File opened for modification	C:\Program Files\DVD Maker\3ddbb3b8.js	Explorer.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\manifest.json	Dwm.exe
File opened for modification	C:\Program Files\Windows NT\lib\6c40741c.js	TpmInit.exe
File opened for modification	C:\Program Files\DVD Maker\4d52a0a6.html	Explorer.EXE
File opened for modification	C:\Program Files\DVD Maker\5cc98d94.js	Explorer.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\5cc98fc8.js	Dwm.exe
File opened for modification	C:\Program Files\WO9qMlZH9Y.rgq	TpmInit.exe
File opened for modification	C:\Program Files\8FxIEv7zEI9.sys	TpmInit.exe
File opened for modification	C:\Program Files (x86)\DD04GWBNeS3xN.sys	TpmInit.exe
File opened for modification	C:\Program Files\DVD Maker\lib\6c407a82.js	Explorer.EXE
File opened for modification	C:\Program Files (x86)\bAoG8W0XVZCkbu.coq	TpmInit.exe
File opened for modification	C:\Program Files\O4heDsBLGxtx.tny	TpmInit.exe
File opened for modification	C:\Program Files (x86)\EadyZ1FFT24zqD.iwt	TpmInit.exe
File opened for modification	C:\Program Files\Windows NT\4d529c14.html	TpmInit.exe
File opened for modification	C:\Program Files (x86)\nSNKXNXKiAT.sys	TpmInit.exe
File opened for modification	C:\Program Files (x86)\SUPvO3878hB9.sys	TpmInit.exe
File opened for modification	C:\Program Files\iVkbPwn9niQz9o.sys	TpmInit.exe
File opened for modification	C:\Program Files\Mozilla Firefox\4d52a27c.html	Dwm.exe
File opened for modification	C:\Program Files\DuuL8UB5CJHO.sys	TpmInit.exe
File opened for modification	C:\Program Files (x86)\ND3x71vDWojb.sys	TpmInit.exe
File opened for modification	C:\Program Files (x86)\LyjUKP8MXsbb9.msk	TpmInit.exe
File opened for modification	C:\Program Files\J6GUptQcTHD1.sys	TpmInit.exe
File opened for modification	C:\Program Files\1iJhzdSLTkiP.xqi	TpmInit.exe
File opened for modification	C:\Program Files\Windows NT\5cc98818.js	TpmInit.exe
File opened for modification	C:\Program Files\DVD Maker\manifest.json	Explorer.EXE

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PM0KVQGWJ6xh.sys	TpmInit.exe
File opened for modification	C:\Windows\mnKCgBswYN.sys	TpmInit.exe
File opened for modification	C:\Windows\rRTrDAVDwCo2D.ywm	TpmInit.exe
File opened for modification	C:\Windows\BTaMgTczIr3G9f.sys	TpmInit.exe
File created	C:\Windows\TpmInit.exe	Explorer.EXE
File created	C:\Windows\fAAFdGQg.sys	TpmInit.exe
File opened for modification	C:\Windows\7rPYvawDz5.qfx	TpmInit.exe
File opened for modification	C:\Windows\IcB8SXybqA.sys	TpmInit.exe
File opened for modification	C:\Windows\i6EIzO1qNEb.zdm	TpmInit.exe
File opened for modification	C:\Windows\TpmInit.exe	Explorer.EXE
File opened for modification	C:\Windows\P5ccOBTdYv7TW8.vxb	TpmInit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2936	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C4CB855E-4E3E-4202-A914-19700802A903}	TpmInit.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-33-81-16-f1-f9\WpadDecisionTime = 40e996616d1cda01	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	TpmInit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C4CB855E-4E3E-4202-A914-19700802A903}\WpadNetworkName = "Network 3"	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	TpmInit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-33-81-16-f1-f9	TpmInit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-33-81-16-f1-f9\WpadDecisionReason = "1"	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	TpmInit.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	TpmInit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	TpmInit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	TpmInit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-33-81-16-f1-f9\WpadDecision = "0"	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	TpmInit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C4CB855E-4E3E-4202-A914-19700802A903}\WpadDecision = "0"	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	TpmInit.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0021000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	TpmInit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	TpmInit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	TpmInit.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	TpmInit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	TpmInit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C4CB855E-4E3E-4202-A914-19700802A903}\WpadDecisionReason = "1"	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	TpmInit.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	TpmInit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	TpmInit.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C4CB855E-4E3E-4202-A914-19700802A903}\WpadDecisionTime = 40e996616d1cda01	TpmInit.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	TpmInit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	TpmInit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe
2744	TpmInit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1204	Explorer.EXE

Suspicious behavior: LoadsDriver 59 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Token: SeTcbPrivilege	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Token: SeDebugPrivilege	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Token: SeDebugPrivilege	1204	Explorer.EXE
Token: SeDebugPrivilege	1204	Explorer.EXE
Token: SeDebugPrivilege	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Token: SeDebugPrivilege	2744	TpmInit.exe
Token: SeDebugPrivilege	2744	TpmInit.exe
Token: SeDebugPrivilege	2744	TpmInit.exe
Token: SeIncBasePriorityPrivilege	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
Token: SeDebugPrivilege	2744	TpmInit.exe
Token: SeBackupPrivilege	2744	TpmInit.exe
Token: SeDebugPrivilege	2744	TpmInit.exe
Token: SeDebugPrivilege	2744	TpmInit.exe
Token: SeDebugPrivilege	1204	Explorer.EXE
Token: SeBackupPrivilege	1204	Explorer.EXE
Token: SeDebugPrivilege	1152	Dwm.exe
Token: SeBackupPrivilege	1152	Dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1204	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	16
PID 2268 wrote to memory of 1204	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	16
PID 2268 wrote to memory of 1204	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	16
PID 2268 wrote to memory of 1204	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	16
PID 2268 wrote to memory of 1204	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	16
PID 1204 wrote to memory of 2744	1204	Explorer.EXE	28
PID 1204 wrote to memory of 2744	1204	Explorer.EXE	28
PID 1204 wrote to memory of 2744	1204	Explorer.EXE	28
PID 1204 wrote to memory of 2744	1204	Explorer.EXE	28
PID 1204 wrote to memory of 2744	1204	Explorer.EXE	28
PID 1204 wrote to memory of 2744	1204	Explorer.EXE	28
PID 1204 wrote to memory of 2744	1204	Explorer.EXE	28
PID 1204 wrote to memory of 2744	1204	Explorer.EXE	28
PID 2268 wrote to memory of 420	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	3
PID 2268 wrote to memory of 420	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	3
PID 2268 wrote to memory of 420	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	3
PID 2268 wrote to memory of 420	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	3
PID 2268 wrote to memory of 420	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	3
PID 2268 wrote to memory of 2816	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	30
PID 2268 wrote to memory of 2816	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	30
PID 2268 wrote to memory of 2816	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	30
PID 2268 wrote to memory of 2816	2268	2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe	30
PID 2816 wrote to memory of 2936	2816	cmd.exe	32
PID 2816 wrote to memory of 2936	2816	cmd.exe	32
PID 2816 wrote to memory of 2936	2816	cmd.exe	32
PID 2816 wrote to memory of 2936	2816	cmd.exe	32
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16
PID 2744 wrote to memory of 1204	2744	TpmInit.exe	16

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420
- C:\Windows\TpmInit.exe
  "C:\Windows\TpmInit.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2744

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe
  "C:\Users\Admin\AppData\Local\Temp\2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe"
  2⤵
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\2da8e90dd0a8b97173c4d0084eb3735c6a9f86018b4ba528477087dc367d79d7.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2936

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab41B4.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC65.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5DFD.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1859f44.tmp

Filesize
8.7MB

MD5
bc04d55a870830510d52e2e36c51fef7

SHA1
4158732d50021eb7b6dd0a9f7b2a7e6edac16826

SHA256
770d13d793c256d91cb7931bb32fe42934bcfdfc212ff71f665b3cce607b6dd1

SHA512
d3a22aef8c68e8296ecd77dc0529cb35131dd3506bc2f0370e52b2895055b6631876aa408e0e01e5924d92ac53494ec8e22cd87ee5f64de6f14ac8148bd01ea9

Download Submit
C:\Windows\BTaMgTczIr3G9f.sys

Filesize
165KB

MD5
8b0a776615a75b367b7e2a86a4d0bc8f

SHA1
2bfa5ca0afdf8c36039553c652eaee2de9e011d2

SHA256
affdfa1299ff3219da4847d9c14326a0a42cd8c1c4a128e4b486b1103c2e1586

SHA512
4ce2564fc8e21f6b8e97cd481bdc88c8fbe8928001e926bbaca0ada8e2d8b4243049e61f33d100d02e93e49abeeea235e0b1fb61b2f870f991eff1f7eb154c75

Download Submit
C:\Windows\IcB8SXybqA.sys

Filesize
165KB

MD5
240fe254754a2fe23cfb1dfb7ab292d9

SHA1
dd4945ee3955c1bb1e2a54aa13a235b41ffae57a

SHA256
466fdedb0a54e3502f3d1a8cac0646729c55f17a808fcfb51c8cb489012fa978

SHA512
5a418e34ba794c11203a174e47f1a822b42efd452d3bcf1a6e656f6b970a08f1e4b42d1aab08866f5b08348114343803a8baa47946d725bfdde069757099a739

Download Submit
C:\Windows\PM0KVQGWJ6xh.sys

Filesize
165KB

MD5
a9147d9136c83671340463124184052c

SHA1
e6cb150312bc325ff89030b75ba9c5da9bd24760

SHA256
ca5e6188650898e3481ba599a737bb8bf3ad23e2bfffb15a34e55b5fc3e36188

SHA512
9aa4f70a8399a9e56ceedf418e77d1cc731a05fa53d25667604f11500211c643486ceb79b6f8ddcda52955d7da0083838d103992ae77770695aba1b7eb2cd009

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
da65b3b3f21c5f70732bbf76cee3bb2f

SHA1
85c801b4c22eb021c3269c0d322b8a0fb6bdf0c3

SHA256
dc92ff6c6a20f6fe6635a05536809ca21b49727aa2c9a6bc44d6348fc3eb6a44

SHA512
64197abd6bcc268dd379ef9b3d30f4e94ae6b5fb595df38a448e5eba85c0ef586a3dd17a72dfe461ee4bd6be70c1a375ee6c99c35a9b686b39ebac1c077b865e

Download Submit
C:\Windows\TpmInit.exe

Filesize
112KB

MD5
8b5eb38e08a678afa129e23129ca1e6d

SHA1
a27d30bb04f9fabdb5c92d5150661a75c5c7bc42

SHA256
4befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c

SHA512
a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d

Download Submit
C:\Windows\TpmInit.exe

Filesize
112KB

MD5
8b5eb38e08a678afa129e23129ca1e6d

SHA1
a27d30bb04f9fabdb5c92d5150661a75c5c7bc42

SHA256
4befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c

SHA512
a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d

Download Submit
C:\Windows\TpmInit.exe

Filesize
112KB

MD5
8b5eb38e08a678afa129e23129ca1e6d

SHA1
a27d30bb04f9fabdb5c92d5150661a75c5c7bc42

SHA256
4befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c

SHA512
a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d

Download Submit
C:\Windows\mnKCgBswYN.sys

Filesize
165KB

MD5
37532811e219d315d089aa4cc338d212

SHA1
145328ba2fa5ef5ac9a5d20fb22f3f52a0f6883e

SHA256
3e75c174c47394761319e8d59f0e99141bb00288b58c785854e389a3550957b9

SHA512
dbb954d5debd27a1f95036d564d3eae42fe6e4ef43ba93ecc9c34706efbf922c8223de528544fcbee06835d6ac02237f08d914f4021266e9c5f1c8c66f8baea8

Download Submit
memory/420-94-0x0000000000870000-0x0000000000898000-memory.dmp

Filesize
160KB

Download
memory/420-40-0x0000000000870000-0x0000000000898000-memory.dmp

Filesize
160KB

Download
memory/1152-612-0x00000000023E0000-0x0000000002503000-memory.dmp

Filesize
1.1MB

Download
memory/1152-598-0x00000000023E0000-0x0000000002503000-memory.dmp

Filesize
1.1MB

Download
memory/1152-601-0x0000000001A20000-0x0000000001A21000-memory.dmp

Filesize
4KB

Download
memory/1204-599-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Filesize
4KB

Download
memory/1204-395-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1204-83-0x0000000007450000-0x0000000007547000-memory.dmp

Filesize
988KB

Download
memory/1204-596-0x0000000002ED0000-0x0000000002ED3000-memory.dmp

Filesize
12KB

Download
memory/1204-595-0x0000000008E20000-0x0000000008F43000-memory.dmp

Filesize
1.1MB

Download
memory/1204-66-0x0000000007450000-0x0000000007547000-memory.dmp

Filesize
988KB

Download
memory/1204-600-0x0000000008F50000-0x0000000008F54000-memory.dmp

Filesize
16KB

Download
memory/1204-610-0x0000000008E20000-0x0000000008F43000-memory.dmp

Filesize
1.1MB

Download
memory/1204-449-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1204-105-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1204-20-0x0000000007450000-0x0000000007547000-memory.dmp

Filesize
988KB

Download
memory/1204-421-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1204-17-0x0000000002BE0000-0x0000000002BE3000-memory.dmp

Filesize
12KB

Download
memory/1204-408-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1204-172-0x0000000002010000-0x0000000002021000-memory.dmp

Filesize
68KB

Download
memory/1204-18-0x0000000002BE0000-0x0000000002BE3000-memory.dmp

Filesize
12KB

Download
memory/1204-19-0x0000000007450000-0x0000000007547000-memory.dmp

Filesize
988KB

Download
memory/1204-16-0x0000000002BE0000-0x0000000002BE3000-memory.dmp

Filesize
12KB

Download
memory/2744-166-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/2744-164-0x00000000055F0000-0x00000000057B5000-memory.dmp

Filesize
1.8MB

Download
memory/2744-152-0x0000000004060000-0x0000000004183000-memory.dmp

Filesize
1.1MB

Download
memory/2744-103-0x00000000055F0000-0x00000000057B5000-memory.dmp

Filesize
1.8MB

Download
memory/2744-101-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/2744-100-0x0000000004060000-0x0000000004183000-memory.dmp

Filesize
1.1MB

Download
memory/2744-97-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/2744-577-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/2744-591-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/2744-96-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/2744-592-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/2744-95-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/2744-93-0x0000000000870000-0x0000000000898000-memory.dmp

Filesize
160KB

Download
memory/2744-91-0x0000000037650000-0x0000000037660000-memory.dmp

Filesize
64KB

Download
memory/2744-84-0x0000000001DC0000-0x0000000001E8B000-memory.dmp

Filesize
812KB

Download
memory/2744-37-0x000007FEBF5A0000-0x000007FEBF5B0000-memory.dmp

Filesize
64KB

Download
memory/2744-36-0x0000000001DC0000-0x0000000001E8B000-memory.dmp

Filesize
812KB

Download
memory/2744-34-0x0000000001DC0000-0x0000000001E8B000-memory.dmp

Filesize
812KB

Download
memory/2744-608-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/2744-609-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/2744-30-0x0000000000110000-0x0000000000113000-memory.dmp

Filesize
12KB

Download
memory/2744-611-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/2744-24-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2744-23-0x00000000001A0000-0x0000000000263000-memory.dmp

Filesize
780KB

Download