Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
72s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23/12/2023, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
2.1/XINPUT/LibUsbDotNet.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
2.1/XINPUT/XboxOneDriver.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
2.1/XINPUT/XboxOneDriver.exp
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
2.1/XINPUT/XboxOneDriver.lib
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
2.1/XINPUT/xinput1_3.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
2.1/XboxOneGamePad.exe
Resource
win10v2004-20231215-en
General
-
Target
2.1/XboxOneGamePad.exe
-
Size
609KB
-
MD5
3096291e785c07eec28d751321ddb495
-
SHA1
4b7d83e826c129b5f98b4667f0584dddf5fd54af
-
SHA256
3eba90986be52f7f17d4be2630eec0dc6f2fc1f4c38e0ffa6db6ab39ee3d9278
-
SHA512
3351e8a17ef8daba756c7efff6fb9a8173e7637c064e00950c9dd821d78e9d93cbb737d69f7c8d2547207478ee3795c7b9a6392a4d477f0ea94a7a8b7d749c38
-
SSDEEP
12288:WZLwrTd+z4fGpbOfBofQ1iX/math/rgYdB4mklf3Ys6Mcw9L8dBfenw5bP/5tJBT:WZLqMVfh+AlBShf3R6E94dcng/5tJB73
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 5 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0f000000010000001400000074966765eaa92430728588de512ad65c4bc002f8030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1470b000000010000000e0000006c006900620077006400690000002000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 DrvInst.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d14702000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation XboxOneGamePad.exe -
Executes dropped EXE 2 IoCs
pid Process 3748 dpscat.exe 1160 dpinst64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\amd64\libusb0.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt dpinst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\libusbK.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB450.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\xbox_one_gamepad.PNF dpinst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB43F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\xbox_one_gamepad.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB43E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\libusb0.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\SETB462.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\Xbox_One_GamePad.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\SETB451.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\libusb0.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\SETB42E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\libusb0_x86.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\SETB462.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\x86\libusb0_x86.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\Xbox_One_GamePad.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\SETB42E.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\SETB451.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\x86\libusbK_x86.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\amd64\libusbK.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\SETB42D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\xbox_one_gamepad.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\SETB42D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB43F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB450.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\amd64\libusb0.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\xbox_one_gamepad.inf_amd64_31448a1345450cd2\x86\libusbK_x86.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab390f21-b78c-364e-967d-1978ecdec9c6}\amd64\SETB43E.tmp DrvInst.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~1\DIFX\4A7292F75FEBBD3C\dpinst64.exe dpinst64.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\DPINST.LOG dpinst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log dpinst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom dpinst64.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d14702000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d14702000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0f000000010000001400000074966765eaa92430728588de512ad65c4bc002f80b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e00650072000000000000000000030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000c68bb6c5df2098cb57ae7c061fa60bb75084d1472000000001000000c4020000308202c030820229a003020102021061f87fb41d03f2ab458486a5018d8bbc300d06092a864886f70d0101050500305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d301e170d3233313232333137343634365a170d3239303130313030303030305a305f315d305b06035504031e54006c00690062007500730062002d00770069006e003300320020002800580062006f0078005f004f006e0065005f00470061006d0065005000610064002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100d3ae16f02830b433be80b934b867f52dbfe1863210c27b6ec7ac8606aa4f6cb7df182a6a82e8de80f03b4076daf0d8bfa8817c9f1b9731d8a67359e01451d2e34386a2ae66f1bff0e28532787e001fc5687fca4091e9ff734643a844446334ae35eb00750737678c4cc33129f676d2f5e14b6f2f3607db4c15f068836d49329d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181000be630720557c50c3245e04cb786ce75b93ac1e3d858651418378bc9e11458809fb8e627e4e0324d52335f3540fdd7eb23184999bbe2b91bc5ed6daf402a5be81ff0bc7551facb5af5bf2f03b7a039810ce94424b01bfa29f6fc9ca339d24e745b8d567db57cf2ce6afeff91f3f854b05ff2645c0b39c6a1ea22251f72837086 dpscat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C68BB6C5DF2098CB57AE7C061FA60BB75084D147 dpscat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeAuditPrivilege 4252 svchost.exe Token: SeSecurityPrivilege 4252 svchost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3172 wrote to memory of 3748 3172 XboxOneGamePad.exe 91 PID 3172 wrote to memory of 3748 3172 XboxOneGamePad.exe 91 PID 3172 wrote to memory of 3748 3172 XboxOneGamePad.exe 91 PID 3172 wrote to memory of 1160 3172 XboxOneGamePad.exe 92 PID 3172 wrote to memory of 1160 3172 XboxOneGamePad.exe 92 PID 4252 wrote to memory of 636 4252 svchost.exe 94 PID 4252 wrote to memory of 636 4252 svchost.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.1\XboxOneGamePad.exe"C:\Users\Admin\AppData\Local\Temp\2.1\XboxOneGamePad.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe"2⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Modifies system certificate store
PID:3748
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1160
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{ea00bcd4-b3e7-be40-9efb-87a6a998be48}\xbox_one_gamepad.inf" "9" "46304250f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\local\temp\7zipsfx_000"2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b1b6aef89c26a6bfbe44ec849b441d9e
SHA1fb8290b90cdec6361473612a6c091cc81802576b
SHA256390e4f6264039b8648742e294b3576af253fffdb83fe73cfec227c77e67ec61a
SHA5125fd6cb7b0877453c039c6264fb892119a2b7c8f3abdec09e1a4fd397a4e1df69fc4add1b7b168ea8bce5ba32d68ff525660529056f717c019b1bfa2b999f6bb6
-
Filesize
74KB
MD51d8215f7f8cd02a553499b534ccfb4d5
SHA1bab236f840f1521c43bcbaa2a7b92f14f329bc70
SHA2564f18b5d2c28aa66b648c8683c6d09b52b92cbbee85984bbefad5f38a64bc2a14
SHA51279ef4b25f16b2f2f37605298470ba9c4600e724e4b52d589add7d48816f656b93c082b5c65669e50e0546865063a068d26390e6ec7fbab66c3726e49a3779d69
-
Filesize
51KB
MD516e18ced459b1824234890386ee66cd5
SHA181d2b572ec0d24aba11ed6bfa9174ffad54140b7
SHA2568058f2afe6ef96a7d2ded432997fd8655970c9ea75a938ee4557d6a2cb4cc989
SHA512b0e67d040d39f043305b0c172906bbea8341f1326108f5c5a0379cd6b287d62cbd86270385713d0f6a14c5106a5a6c23f6247a303e6124cb3e33982978505c98
-
Filesize
96KB
MD5c7ddca593b4b77627b82043ba3b496cf
SHA1d6bb0fa60556afd6d7fde70e5a1e53e364460e81
SHA25683a9a1c6a09bcef78c7336ad9f27ae74e47672b974efdcda7c8ea9f169dd20e1
SHA512aebd28d1f01d0a3093451712f819eedb32220a4b7651cb70be27c444552f36d4a6fa3de9d3f54b68c84ac51fdba1442d2983a7fa458dd6c1abe07f7a8442842d
-
Filesize
160B
MD56137422c5d76cfac8a2bff771aeb8e1c
SHA1a2d2c3face6964912ae6c6449d338dc08c9e673d
SHA25611fb671ef239b3b3553320d63254904f5941d7c20f872c8be2509e04f1976087
SHA512d43bec5b2e7b587ad9ec366924a773cf4506954b3b6fbb6d138a4c8adae154c876474325b9181e33cddd2bda892d4961a61c3562c7eea549c04b6a5883ffe074
-
Filesize
119KB
MD5e8d2db3e1bae316ceaae09482f1647f5
SHA1791bec58419eba734e1073e099818a925c31c6bc
SHA25646a6b22c25fd875265ae63b3b661e444afe528beabe2a3144cad296a24e8b1e6
SHA512089a1fb8172590367f8ec66e77447288ff1773c744b491a1c4f11a14df9a72b1638d5b3085422054955906d34f537457683792182333686ad7255f7d6f80a795
-
Filesize
1.0MB
MD5be3c79033fa8302002d9d3a6752f2263
SHA1a01147731f2e500282eca5ece149bcc5423b59d6
SHA256181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab
SHA51277097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea
-
Filesize
35KB
MD5365257a15aee00a58921d0b633b8b916
SHA14b72312e2253c42ce9dd7ce29390ca93313d1baa
SHA25635b2cfde5f214fd4cb7579960060e0cf3148428f927c035dbda253e4d00943b2
SHA51253dfa9332ddf2a265a529d2a46de9e79f8f8c7264a6bd507856a7fd223e0a5de8dcd8752b10fd8cbff4de8ad1aab7d880bde4ef8c48af1c1a2b8e30d303ebc70
-
Filesize
66KB
MD5535779909a40b42f4f3e48598f5778a5
SHA13a238468009a6dea3e4f70821339185e56ea3b69
SHA25600caca07869b19d10b370552ac7cc2f6f2ee246fc15db11650f6cd3f4ef9b666
SHA512723b42c3df960f031343b9bb74a55ab874cd1f740a187a58bfecdad78876dd227392f18f6faea33e743593511a12635ef6419bb68d4361c6631584ebc8838e80
-
Filesize
81KB
MD5f513a9294b0347fa30b739f9f9bff866
SHA1f4b0408f2922251adde0656c7b9f4c1e8e60b0ef
SHA256d1a8bded0b4a57bdee0b87c569a665c432f41dfa47ff4489d69847845cb7a31c
SHA512e819afa7296739a9b2c0a198ea3e6a57fab98146caca7de9c2dfc9dcc94be3828201de7559928dc9064371a7c3adb70d86e1d6a6f462860b7160cb377605e4b3
-
Filesize
151KB
MD53df0d93e84c2ad8516231e54145e86d0
SHA1df5198a1a195e6e1649af3fe8f77562c57ec191c
SHA2561ea4dfbffe6d7ca10cbad1437736583ee1a132ab7d9ad52201d0143cd573b16c
SHA512098236955fc6819c51f7bcd40b592579cc15016a3aa0780c73cf6c7f8ed03e7b186c0a0cc24ca0f7c2a494ecb77cb347400dc368c6623c138c45e456cf3e7312
-
Filesize
4KB
MD54d9cb53cda70e2fae11e9ae418ef4cf0
SHA1931941cb7b609c045e74b3ca48c3e1192827c42e
SHA256296bdfc8d018b06d67b91eba6d03507bbf6a2bc95063e2aff632fcb1456181e0
SHA5125f42bc5392d43226d512bfce216fe5f57c7d42f6d6a68fc6f8beac5c5efe82492e3becd51b000145f6ed5fa858f7e5bc7df75cd50a1a50587a36a563774e3983