300fe6224578b1254a43444f7e1783dd608a6c065d4e6089e7560e719fc787b2

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pcast.exe
Size

542KB
MD5

dad4aede2fd849808e65c571c3bac6d9
SHA1

f070fe992379247e50105cae1a418d7e0e898876
SHA256

ff2a609b9fa369dc77d410b56fd3f0f16758aad6c3c21702e325cc5a2d133c9a
SHA512

7eff93e06144857e8633023c7c0a8f84adf06aa412b56c41d9a42f1d0e9e93d356898629930b6d01d4807153a39afda57e4034f19a04b2b754e922171e191a8f
SSDEEP

12288:SKoFAyW66UYsvrVN4ARGMJhBworlrHzC10K8+TqPE3l8OQxD:noFAM7oAlhB7r5TCSj+OPM8OqD

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

PodcastBarMini.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	PodcastBarMini.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\PROGRA~2\pcast\PODCAS~1\PODCAS~1.EXE = "C:\\PROGRA~2\\pcast\\PODCAS~1\\PODCAS~1.EXE:*:Enabled:Share Streaming"	PodcastBarMini.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

pcast.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\BC1F6A4D2D237C0C86152E1482B2026AAD912592\Blob = 030000000100000014000000bc1f6a4d2d237c0c86152e1482b2026aad91259204000000010000001000000021b95f50fc271b95e96fe8745943fd7c1900000001000000100000005996a7c1471ef385ca88fdecb02eeb990f00000001000000140000008bf79719c6ed6f882de19abdea037b89a41e3b0620000000010000001f0500003082051b30820403a003020102021066a83d9b70cff9b3791431edce6d8ec5300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293034312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303034204341301e170d3035303732363030303030305a170d3036303732363233353935395a3081de310b300906035504061302434e3110300e060355040813074265696a696e673110300e060355040713074265696a696e67312c302a060355040a142331303030204f616b7320496e7465726e657420546563686e6f6c6f6769657320436f2e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632310f300d060355040b14066f6e6c696e65312c302a0603550403142331303030204f616b7320496e7465726e657420546563686e6f6c6f6769657320436f2e30819f300d06092a864886f70d010101050003818d0030818902818100c83574c77d9e2268b98d6136fccd329d056dab6c8f70006f46dd4471b5a2b25609f85c6fde9c717a537ce7711a8d7f2a03cb68e44d02b3eee533ab5b38192761f21290838d1cbe73e04daae8c13d0f0c11bc2765c62c5337a2b19bd794b474c66de76463b7146ead81129cc7f4338556797e6f9e8b4eaef9f98328d81fadc5a90203010001a382017f3082017b30090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f435343332d323030342d63726c2e766572697369676e2e636f6d2f435343332d323030342e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f435343332d323030342d6169612e766572697369676e2e636f6d2f435343332d323030342d6169612e636572301f0603551d2304183016801408f551e8fbfe3d3d64367c68cf5b78a8dfb9c537301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d01010505000382010100850f265cbcf0dc1b11ef1ec6950d94f93f853a0d678e9d47e12a5e02aca9e47ec818a009e7cdd4962d52e2d62115f79141e64753977a3cde5030410467c9db7fbffeadda9205cbfa975575bee48857b561a2f5048d79802fe8d4987ca190bf38e300935f6dc3663b582c3582842089a23819ff3189c37840de399cc8f1ea6aa64d79ca12e2c9084d908dfa1baecf6816471bd66c5601d7cd4fb88da11edbea34e8b0d0e7f38a0bff59214f7571fccf44bde0f6caa8c0274fa3e2451061e9238e2d0203e0c1152388e6fb8327e03ab0fc33202db64956ae4c228bca02707c70d7989d9a0e20befcc595f02b9ba163ba09f3e5b3676bfe5e2fdff2808b3b779444	pcast.exe

Executes dropped EXE 2 IoCs

Processes:

start.exePodcastBarMini.exe

pid	Process
2720	start.exe
2684	PodcastBarMini.exe

Loads dropped DLL 13 IoCs

Processes:

pcast.exestart.exePodcastBarMini.exe

pid	Process
2372	pcast.exe
2372	pcast.exe
2372	pcast.exe
2372	pcast.exe
2720	start.exe
2720	start.exe
2720	start.exe
2720	start.exe
2720	start.exe
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pcast.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MiniPcast = "C:\\Program Files (x86)\\pcast\\PodcastbarMini\\start.exe"	pcast.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

Processes:

pcast.exePodcastBarMini.exe

description	ioc	Process
File created	C:\Program Files (x86)\pcast\PodcastbarMini\pCastCtl.dll	pcast.exe
File created	C:\Program Files (x86)\pcast\PodcastbarMini\uninst.exe	pcast.exe
File opened for modification	C:\Program Files (x86)\pcast\PodcastbarMini\version.ini	pcast.exe
File created	C:\Program Files (x86)\pcast\PodcastbarMini\pbmini.config.xml	PodcastBarMini.exe
File created	C:\Program Files (x86)\pcast\PodcastbarMini\version.ini	pcast.exe
File created	C:\Program Files (x86)\pcast\PodcastbarMini\Start.exe	pcast.exe
File created	C:\Program Files (x86)\pcast\PodcastbarMini\PodcastBarMini.exe	pcast.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

pcast.exePodcastBarMini.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\ProxyStubClsid32	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\TypeLib	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}\1.0\0	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\ = "pCastPanel Class"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\VersionIndependentProgID	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\Version\ = "1.0"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\TypeLib	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pcast\URL Protocol	PodcastBarMini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCastControl.pCastPanel\CurVer	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\TypeLib\ = "{C7F88C1A-DF17-423B-B960-108AB7551FAA}"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\TypeLib\Version = "1.0"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pcast\ = "URL: PCast Protocol"	PodcastBarMini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\MiscStatus	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\pcast\\PodcastbarMini\\pcastctl.dll, 104"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}\1.0\ = "pCastControl 1.0 Type Library"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pcast\shell	PodcastBarMini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCastControl.pCastPanel\ = "pCastPanel Class"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\MiscStatus\ = "0"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\ToolboxBitmap32	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\TypeLib	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\ProgID\ = "PCastControl.pCastPanel.1"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCastControl.pCastPanel.1\CLSID\ = "{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\Programmable	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\TypeLib\ = "{C7F88C1A-DF17-423B-B960-108AB7551FAA}"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\TypeLib\ = "{C7F88C1A-DF17-423B-B960-108AB7551FAA}"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\TypeLib\Version = "1.0"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pcast	PodcastBarMini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCastControl.pCastPanel.1	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\Control	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\MiscStatus\1	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}\1.0\FLAGS\ = "0"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\InprocServer32\ = "C:\\Program Files (x86)\\pcast\\PodcastbarMini\\pcastctl.dll"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}\1.0\FLAGS	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\ProgID	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCastControl.pCastPanel\CLSID\ = "{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}\1.0\0\win32	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCastControl.pCastPanel\CLSID	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCastControl.pCastPanel\CurVer\ = "PCastControl.pCastPanel.1"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}\1.0\HELPDIR	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\pcast\\PodcastbarMini\\"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\ = "_IpCastPanelEvents"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\ProxyStubClsid32	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\TypeLib\Version = "1.0"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCastControl.pCastPanel.1\ = "pCastPanel Class"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\ = "_IpCastPanelEvents"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\ProxyStubClsid32	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pcast\shell\open	PodcastBarMini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\MiscStatus\1\ = "131473"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\ = "IpCastPanel"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\ = "IpCastPanel"	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\TypeLib\ = "{C7F88C1A-DF17-423B-B960-108AB7551FAA}"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0BC0BC-362E-4E43-95B6-5D166D3EE595}\TypeLib	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A}\Version	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7F88C1A-DF17-423B-B960-108AB7551FAA}\1.0	pcast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68BEA531-2D55-4FF6-9B40-CDD285C44F7A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	pcast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pcast\shell\open\command	PodcastBarMini.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

pcast.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\BC1F6A4D2D237C0C86152E1482B2026AAD912592	pcast.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\BC1F6A4D2D237C0C86152E1482B2026AAD912592\Blob = 030000000100000014000000bc1f6a4d2d237c0c86152e1482b2026aad91259204000000010000001000000021b95f50fc271b95e96fe8745943fd7c1900000001000000100000005996a7c1471ef385ca88fdecb02eeb990f00000001000000140000008bf79719c6ed6f882de19abdea037b89a41e3b0620000000010000001f0500003082051b30820403a003020102021066a83d9b70cff9b3791431edce6d8ec5300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293034312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303034204341301e170d3035303732363030303030305a170d3036303732363233353935395a3081de310b300906035504061302434e3110300e060355040813074265696a696e673110300e060355040713074265696a696e67312c302a060355040a142331303030204f616b7320496e7465726e657420546563686e6f6c6f6769657320436f2e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632310f300d060355040b14066f6e6c696e65312c302a0603550403142331303030204f616b7320496e7465726e657420546563686e6f6c6f6769657320436f2e30819f300d06092a864886f70d010101050003818d0030818902818100c83574c77d9e2268b98d6136fccd329d056dab6c8f70006f46dd4471b5a2b25609f85c6fde9c717a537ce7711a8d7f2a03cb68e44d02b3eee533ab5b38192761f21290838d1cbe73e04daae8c13d0f0c11bc2765c62c5337a2b19bd794b474c66de76463b7146ead81129cc7f4338556797e6f9e8b4eaef9f98328d81fadc5a90203010001a382017f3082017b30090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f435343332d323030342d63726c2e766572697369676e2e636f6d2f435343332d323030342e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f435343332d323030342d6169612e766572697369676e2e636f6d2f435343332d323030342d6169612e636572301f0603551d2304183016801408f551e8fbfe3d3d64367c68cf5b78a8dfb9c537301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d01010505000382010100850f265cbcf0dc1b11ef1ec6950d94f93f853a0d678e9d47e12a5e02aca9e47ec818a009e7cdd4962d52e2d62115f79141e64753977a3cde5030410467c9db7fbffeadda9205cbfa975575bee48857b561a2f5048d79802fe8d4987ca190bf38e300935f6dc3663b582c3582842089a23819ff3189c37840de399cc8f1ea6aa64d79ca12e2c9084d908dfa1baecf6816471bd66c5601d7cd4fb88da11edbea34e8b0d0e7f38a0bff59214f7571fccf44bde0f6caa8c0274fa3e2451061e9238e2d0203e0c1152388e6fb8327e03ab0fc33202db64956ae4c228bca02707c70d7989d9a0e20befcc595f02b9ba163ba09f3e5b3676bfe5e2fdff2808b3b779444	pcast.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pcast.exe

description	pid	Process
Token: SeRestorePrivilege	2372	pcast.exe
Token: SeBackupPrivilege	2372	pcast.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

PodcastBarMini.exe

pid	Process
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

PodcastBarMini.exe

pid	Process
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

PodcastBarMini.exe

pid	Process
2684	PodcastBarMini.exe
2684	PodcastBarMini.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

pcast.exestart.exe

description	pid	Process	procid_target
PID 2372 wrote to memory of 2720	2372	pcast.exe	20
PID 2372 wrote to memory of 2720	2372	pcast.exe	20
PID 2372 wrote to memory of 2720	2372	pcast.exe	20
PID 2372 wrote to memory of 2720	2372	pcast.exe	20
PID 2372 wrote to memory of 2720	2372	pcast.exe	20
PID 2372 wrote to memory of 2720	2372	pcast.exe	20
PID 2372 wrote to memory of 2720	2372	pcast.exe	20
PID 2720 wrote to memory of 2684	2720	start.exe	19
PID 2720 wrote to memory of 2684	2720	start.exe	19
PID 2720 wrote to memory of 2684	2720	start.exe	19
PID 2720 wrote to memory of 2684	2720	start.exe	19
PID 2720 wrote to memory of 2684	2720	start.exe	19
PID 2720 wrote to memory of 2684	2720	start.exe	19
PID 2720 wrote to memory of 2684	2720	start.exe	19

C:\Users\Admin\AppData\Local\Temp\pcast.exe
"C:\Users\Admin\AppData\Local\Temp\pcast.exe"
1⤵
- Manipulates Digital Signatures
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\pcast\PodcastbarMini\start.exe
  "C:\Program Files (x86)\pcast\PodcastbarMini\start.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2720

C:\Program Files (x86)\pcast\PodcastbarMini\PodcastBarMini.exe
"C:\Program Files (x86)\pcast\PodcastbarMini\PodcastBarMini.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\pcast\PodcastbarMini\version.ini

Filesize
56B

MD5
90afa1d476f2595d4ee854ad63dcf486

SHA1
e9fef886f4bfe95a29956d8715aef9e7c1209616

SHA256
61f69ddf2a15dcb75133cd8e0a1353424f694f9f44816b78fa04384410903696

SHA512
8203235d538ef81e98cfa657ac67ace2f6ae7a13a496c716d5be857679325fff4fb8ffff57e61d55ab9b732c8000d5a71ffed54ce2009681a5ae7bbdaf41ffe0

Download Submit
\Program Files (x86)\pcast\PodcastbarMini\PodcastBarMini.exe

Filesize
356KB

MD5
018e7c1c54de447436a978c26fe1c5fc

SHA1
373888daf7cf03673a5b68f62dc8e6b56182fcae

SHA256
92534286413fee4cb015da8a2b498d47fb7a533df69ef3576aeaeefa5186c22e

SHA512
2e113883ba62fce7e45adb3c5ee0829207e24bde7e9220c388a7237a11100d60dcb16c3e1f3b50f2051bd3378109fca7d7a7cab333135ba96eb2e0b8ac59d4bd

Download Submit
\Program Files (x86)\pcast\PodcastbarMini\Start.exe

Filesize
128KB

MD5
02f0fa087aabb8fc3ec4163718f904c0

SHA1
6664d84709929a094968b440d60bbc02b6cacf4e

SHA256
913c17db5fced9e152d1b6cf91ef9ba12c160cfd54142eef5aae2de8770c2bc9

SHA512
3d92e75d49a47e1ac52d23359b7ee6fc0753dba527a6ee98a7fd43507f066362caa50267b5b698ea40f5ca46d7ea879054d88cfd13a7d77bda049fe9c0d5f366

Download Submit
\Program Files (x86)\pcast\PodcastbarMini\pCastCtl.dll

Filesize
708KB

MD5
ad989d530b72dd1d5a5a0294f9add513

SHA1
8092dfabf4b0dd7abd1ecc9827b9f14222598d6f

SHA256
8888b9f192e44b3db636ba26966d374ec849d1f7508491244ca68f98da6dc388

SHA512
b0efd7918946572d80833ee938e3b0473309a40efe915845f8df26237b5221a4db176d2d66d75d21a68a0965a1395039fc1270422bb760953a5aadb64611212e

Download Submit