2427c122897ee5dd465db796a62d9e00d2dac8d0812007334e14ec76ad7baf15

Analysis

max time kernel
63s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2023, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2.1/XboxOneGamePad.exe
Size

609KB
MD5

3096291e785c07eec28d751321ddb495
SHA1

4b7d83e826c129b5f98b4667f0584dddf5fd54af
SHA256

3eba90986be52f7f17d4be2630eec0dc6f2fc1f4c38e0ffa6db6ab39ee3d9278
SHA512

3351e8a17ef8daba756c7efff6fb9a8173e7637c064e00950c9dd821d78e9d93cbb737d69f7c8d2547207478ee3795c7b9a6392a4d477f0ea94a7a8b7d749c38
SSDEEP

12288:WZLwrTd+z4fGpbOfBofQ1iX/math/rgYdB4mklf3Ys6Mcw9L8dBfenw5bP/5tJBT:WZLqMVfh+AlBShf3R6E94dcng/5tJB73

Score

8^/10

discovery

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 5 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0f000000010000001400000074966765eaa92430728588de512ad65c4bc002f8030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1470b000000010000000e0000006c006900620077006400690000002000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d14702000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	XboxOneGamePad.exe

Executes dropped EXE 2 IoCs

pid	Process
3748	dpscat.exe
1160	dpinst64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\amd64\libusb0.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	dpinst64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\libusbK.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB450.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\xbox_one_gamepad.PNF	dpinst64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB43F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\xbox_one_gamepad.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB43E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\libusb0.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\SETB462.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\Xbox_One_GamePad.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\SETB451.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\libusb0.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\SETB42E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\libusb0_x86.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\SETB462.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\x86\libusb0_x86.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\Xbox_One_GamePad.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\SETB42E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\SETB451.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\libusbK_x86.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\amd64\libusbK.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\SETB42D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\xbox_one_gamepad.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\SETB42D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB43F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB450.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\amd64\libusb0.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\x86\libusbK_x86.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB43E.tmp	DrvInst.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~1\DIFX\4A7292F75FEBBD3C\dpinst64.exe	dpinst64.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DPINST.LOG	dpinst64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	dpinst64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	dpinst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dpinst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dpinst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	dpinst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dpinst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	dpinst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	dpinst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	dpinst64.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d14702000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d14702000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0f000000010000001400000074966765eaa92430728588de512ad65c4bc002f80b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e00650072000000000000000000030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086	dpscat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147	dpscat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeAuditPrivilege	4252	svchost.exe
Token: SeSecurityPrivilege	4252	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3748	3172	XboxOneGamePad.exe	91
PID 3172 wrote to memory of 3748	3172	XboxOneGamePad.exe	91
PID 3172 wrote to memory of 3748	3172	XboxOneGamePad.exe	91
PID 3172 wrote to memory of 1160	3172	XboxOneGamePad.exe	92
PID 3172 wrote to memory of 1160	3172	XboxOneGamePad.exe	92
PID 4252 wrote to memory of 636	4252	svchost.exe	94
PID 4252 wrote to memory of 636	4252	svchost.exe	94

C:\Users\Admin\AppData\Local\Temp\2.1\XboxOneGamePad.exe
"C:\Users\Admin\AppData\Local\Temp\2.1\XboxOneGamePad.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe"
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Modifies system certificate store
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{ea00bcd4-b3e7-be40-9efb-87a6a998be48}\xbox_one_gamepad.inf" "9" "46304250f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\local\temp\7zipsfx_000"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\Xbox_One_GamePad.inf

Filesize
8KB

MD5
b1b6aef89c26a6bfbe44ec849b441d9e

SHA1
fb8290b90cdec6361473612a6c091cc81802576b

SHA256
390e4f6264039b8648742e294b3576af253fffdb83fe73cfec227c77e67ec61a

SHA512
5fd6cb7b0877453c039c6264fb892119a2b7c8f3abdec09e1a4fd397a4e1df69fc4add1b7b168ea8bce5ba32d68ff525660529056f717c019b1bfa2b999f6bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\amd64\libusb0.dll

Filesize
74KB

MD5
1d8215f7f8cd02a553499b534ccfb4d5

SHA1
bab236f840f1521c43bcbaa2a7b92f14f329bc70

SHA256
4f18b5d2c28aa66b648c8683c6d09b52b92cbbee85984bbefad5f38a64bc2a14

SHA512
79ef4b25f16b2f2f37605298470ba9c4600e724e4b52d589add7d48816f656b93c082b5c65669e50e0546865063a068d26390e6ec7fbab66c3726e49a3779d69

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\amd64\libusb0.sys

Filesize
51KB

MD5
16e18ced459b1824234890386ee66cd5

SHA1
81d2b572ec0d24aba11ed6bfa9174ffad54140b7

SHA256
8058f2afe6ef96a7d2ded432997fd8655970c9ea75a938ee4557d6a2cb4cc989

SHA512
b0e67d040d39f043305b0c172906bbea8341f1326108f5c5a0379cd6b287d62cbd86270385713d0f6a14c5106a5a6c23f6247a303e6124cb3e33982978505c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\amd64\libusbk.dll

Filesize
96KB

MD5
c7ddca593b4b77627b82043ba3b496cf

SHA1
d6bb0fa60556afd6d7fde70e5a1e53e364460e81

SHA256
83a9a1c6a09bcef78c7336ad9f27ae74e47672b974efdcda7c8ea9f169dd20e1

SHA512
aebd28d1f01d0a3093451712f819eedb32220a4b7651cb70be27c444552f36d4a6fa3de9d3f54b68c84ac51fdba1442d2983a7fa458dd6c1abe07f7a8442842d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst.xml

Filesize
160B

MD5
6137422c5d76cfac8a2bff771aeb8e1c

SHA1
a2d2c3face6964912ae6c6449d338dc08c9e673d

SHA256
11fb671ef239b3b3553320d63254904f5941d7c20f872c8be2509e04f1976087

SHA512
d43bec5b2e7b587ad9ec366924a773cf4506954b3b6fbb6d138a4c8adae154c876474325b9181e33cddd2bda892d4961a61c3562c7eea549c04b6a5883ffe074

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe

Filesize
119KB

MD5
e8d2db3e1bae316ceaae09482f1647f5

SHA1
791bec58419eba734e1073e099818a925c31c6bc

SHA256
46a6b22c25fd875265ae63b3b661e444afe528beabe2a3144cad296a24e8b1e6

SHA512
089a1fb8172590367f8ec66e77447288ff1773c744b491a1c4f11a14df9a72b1638d5b3085422054955906d34f537457683792182333686ad7255f7d6f80a795

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe

Filesize
1.0MB

MD5
be3c79033fa8302002d9d3a6752f2263

SHA1
a01147731f2e500282eca5ece149bcc5423b59d6

SHA256
181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab

SHA512
77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe

Filesize
35KB

MD5
365257a15aee00a58921d0b633b8b916

SHA1
4b72312e2253c42ce9dd7ce29390ca93313d1baa

SHA256
35b2cfde5f214fd4cb7579960060e0cf3148428f927c035dbda253e4d00943b2

SHA512
53dfa9332ddf2a265a529d2a46de9e79f8f8c7264a6bd507856a7fd223e0a5de8dcd8752b10fd8cbff4de8ad1aab7d880bde4ef8c48af1c1a2b8e30d303ebc70

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\x86\libusb0_x86.dll

Filesize
66KB

MD5
535779909a40b42f4f3e48598f5778a5

SHA1
3a238468009a6dea3e4f70821339185e56ea3b69

SHA256
00caca07869b19d10b370552ac7cc2f6f2ee246fc15db11650f6cd3f4ef9b666

SHA512
723b42c3df960f031343b9bb74a55ab874cd1f740a187a58bfecdad78876dd227392f18f6faea33e743593511a12635ef6419bb68d4361c6631584ebc8838e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\x86\libusbk_x86.dll

Filesize
81KB

MD5
f513a9294b0347fa30b739f9f9bff866

SHA1
f4b0408f2922251adde0656c7b9f4c1e8e60b0ef

SHA256
d1a8bded0b4a57bdee0b87c569a665c432f41dfa47ff4489d69847845cb7a31c

SHA512
e819afa7296739a9b2c0a198ea3e6a57fab98146caca7de9c2dfc9dcc94be3828201de7559928dc9064371a7c3adb70d86e1d6a6f462860b7160cb377605e4b3

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
151KB

MD5
3df0d93e84c2ad8516231e54145e86d0

SHA1
df5198a1a195e6e1649af3fe8f77562c57ec191c

SHA256
1ea4dfbffe6d7ca10cbad1437736583ee1a132ab7d9ad52201d0143cd573b16c

SHA512
098236955fc6819c51f7bcd40b592579cc15016a3aa0780c73cf6c7f8ed03e7b186c0a0cc24ca0f7c2a494ecb77cb347400dc368c6623c138c45e456cf3e7312

Download Submit
\??\c:\users\admin\appdata\local\temp\7ZIPSF~1\XBOX_O~1.CAT

Filesize
4KB

MD5
4d9cb53cda70e2fae11e9ae418ef4cf0

SHA1
931941cb7b609c045e74b3ca48c3e1192827c42e

SHA256
296bdfc8d018b06d67b91eba6d03507bbf6a2bc95063e2aff632fcb1456181e0

SHA512
5f42bc5392d43226d512bfce216fe5f57c7d42f6d6a68fc6f8beac5c5efe82492e3becd51b000145f6ed5fa858f7e5bc7df75cd50a1a50587a36a563774e3983

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads