Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe
Resource
win10v2004-20240226-en
General
-
Target
SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe
-
Size
435KB
-
MD5
2ff5504c8b803e79dade34401c89701d
-
SHA1
87d626130cfcb4f3984a4b7ab74f956fe4f13b60
-
SHA256
ee6411869e495253cbbfc96932f262dbe199277a319aad8654c30f54534da109
-
SHA512
c2c11c0075efb5b2a72cb10ad17221482790b0081fdefb1512df8cddfe7f50aa13a22d9e654c4461109ff8c5063cb3f49e5f890afce2c2f0e46d5117895d74d2
-
SSDEEP
12288:TDr0C0xkXVXvNxeNOo2nLNsllllJsllllhi:TDr0C0xkXVXiNMnL4
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SET8632.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET8632.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\dfmirage.sys DrvInst.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe -
Executes dropped EXE 1 IoCs
pid Process 3284 MirrInst64.exe -
Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\x64\dfmirage.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\SET8346.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\dfmirage.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\dfmirage.inf_amd64_83b5f055f9286973\dfmirage.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\x64 DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\x64\SET8325.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\x64\SET8336.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\x64\SET8336.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\x64\dfmirage.dll DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\dfmirage.inf_amd64_83b5f055f9286973\dfmirage.PNF MirrInst64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\dfmirage.inf_amd64_83b5f055f9286973\x64\dfmirage.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\dfmirage.inf_amd64_83b5f055f9286973\x64\dfmirage.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7} DrvInst.exe File opened for modification C:\Windows\System32\SET8643.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\x64\SET8325.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\SET8347.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\dfmirage.inf DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\SET8643.tmp DrvInst.exe File opened for modification C:\Windows\System32\dfmirage.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\SET8346.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5faf49a5-306f-1b44-8fb5-1950a575b6b7}\SET8347.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\dfmirage.inf_amd64_83b5f055f9286973\dfmirage.cat DrvInst.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\INF\oem3.PNF MirrInst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log MirrInst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID MirrInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom MirrInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 MirrInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 MirrInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 MirrInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 MirrInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs MirrInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom MirrInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID MirrInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID MirrInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID MirrInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs MirrInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags MirrInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs MirrInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs MirrInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 59 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\CBFE9EB43B3B37FE0DFBC4C2EB2D4E07D08BD8E8\Blob = 030000000100000014000000cbfe9eb43b3b37fe0dfbc4c2eb2d4e07d08bd8e81400000001000000140000000cdb6c82490f4a670ab814ee7ac4485288eb563804000000010000001000000098eb0b62c3fe53eac8caa8fdb58020ee0f0000000100000020000000b4e0a8c98b0aae43b7383037accd11a1c964971f6b74fcbc370cd030fb328ddd19000000010000001000000058f4c3aea49be319eaff0e54cef46cd35c00000001000000040000000008000018000000010000001000000014c3bd3549ee225aece13734ad8ca0b82000000001000000b7040000308204b33082039ba00302010202100b259422ced9812a15a04e99528a0efa300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3137313130323132323433335a170d3237313130323132323433335a3060310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d311f301d06035504031316526170696453534c20544c532052534120434120473130820122300d06092a864886f70d01010105000382010f003082010a0282010100bfb9592544123516e25d5049050ae0cbfc8dda25089a67a6a26d11e36a9fdaa7dcf2d5a60dae985eed871a3703283ec66f5c347e84d24ea3d81b80e6154cfabc81773ce08ef960a38789503836b249419ea9dac250caac7ad07904223cc837ed4b40b7d74e5a6ece74e839ad61c930f4cb28ad172398c1444cfbf088f05345329061c36da1a5e01090e38b9aca93e5064961e8a4eea96f9fc81f0fe5dd0e7937924baebb4786fafbb2ad21abe6e5f92d18455a5bf5cc5403721fc42a6775eb79bacffc9cc7fa8b6bdcf2bc82dcedc4296fe93b4cbadaf56135ed83d29fd00d8c6f840a8f4f0d6dcdf65c2129008dbf0d601a882ec8242eec713b0675bc7924850203010001a382016630820162301d0603551d0e041604140cdb6c82490f4a670ab814ee7ac4485288eb5638301f0603551d230418301680144e2254201895e6e36ee60ffafab912ed06178f39300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d30420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63726c30630603551d20045c305a303706096086480186fd6c0101302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300b06096086480186fd6c01023008060667810c0102013008060667810c010202300d06092a864886f70d01010b050003820101001944a539be0add6b664a56e6139d146011d733448a5cfa8733393a5d05290a1785ff8a94f1a3a16a3b324501435758a1fee3c883b60746d162093ab81becdbe375f54fbee726048e23da6afd3a82c2dba467bbbd54b2f7240ab759dcb69a828bbef0bcb55991ce401ed314029112888db046f34312c835ff478b98823e9988d4ff660e8623a4687e0aa0a4376cb0b7345c8450128b7121970accfde9189f4509b30798c2cbcae05dfae096bd5705da881801ac2e7c2852fcf4fad43f6bab33d14b9236baa6b7b66213e382612605a106714c6fb006424bcdabd28d4bd75ddc659cd7b1ff7576b57a7a31cd68c4d2105d163c4f8546f45b7c22f28df8fe6f05c7 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\CBFE9EB43B3B37FE0DFBC4C2EB2D4E07D08BD8E8 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeAuditPrivilege 4028 svchost.exe Token: SeSecurityPrivilege 4028 svchost.exe Token: SeLoadDriverPrivilege 3284 MirrInst64.exe Token: SeRestorePrivilege 1132 DrvInst.exe Token: SeBackupPrivilege 1132 DrvInst.exe Token: SeRestorePrivilege 1132 DrvInst.exe Token: SeBackupPrivilege 1132 DrvInst.exe Token: SeLoadDriverPrivilege 1132 DrvInst.exe Token: SeLoadDriverPrivilege 1132 DrvInst.exe Token: SeLoadDriverPrivilege 1132 DrvInst.exe Token: SeCreateGlobalPrivilege 2020 dwm.exe Token: SeChangeNotifyPrivilege 2020 dwm.exe Token: 33 2020 dwm.exe Token: SeIncBasePriorityPrivilege 2020 dwm.exe Token: SeShutdownPrivilege 2020 dwm.exe Token: SeCreatePagefilePrivilege 2020 dwm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1424 wrote to memory of 4008 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 103 PID 1424 wrote to memory of 4008 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 103 PID 1424 wrote to memory of 4008 1424 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 103 PID 4008 wrote to memory of 2408 4008 cmd.exe 105 PID 4008 wrote to memory of 2408 4008 cmd.exe 105 PID 4008 wrote to memory of 2408 4008 cmd.exe 105 PID 4008 wrote to memory of 4960 4008 cmd.exe 106 PID 4008 wrote to memory of 4960 4008 cmd.exe 106 PID 4008 wrote to memory of 4960 4008 cmd.exe 106 PID 4008 wrote to memory of 5020 4008 cmd.exe 107 PID 4008 wrote to memory of 5020 4008 cmd.exe 107 PID 4008 wrote to memory of 5020 4008 cmd.exe 107 PID 4008 wrote to memory of 3592 4008 cmd.exe 108 PID 4008 wrote to memory of 3592 4008 cmd.exe 108 PID 4008 wrote to memory of 3592 4008 cmd.exe 108 PID 4008 wrote to memory of 3284 4008 cmd.exe 109 PID 4008 wrote to memory of 3284 4008 cmd.exe 109 PID 4028 wrote to memory of 4596 4028 svchost.exe 111 PID 4028 wrote to memory of 4596 4028 svchost.exe 111 PID 4028 wrote to memory of 1132 4028 svchost.exe 112 PID 4028 wrote to memory of 1132 4028 svchost.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\Install.cmd"2⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "3⤵PID:2408
-
-
C:\Windows\SysWOW64\find.exefind "5.0"3⤵PID:4960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "3⤵PID:5020
-
-
C:\Windows\SysWOW64\find.exefind "5.1"3⤵PID:3592
-
-
C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\MirrInst64.exe"C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\MirrInst64.exe" -i "dfmirage" "Mirage Driver" "C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\105\" "C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\105\dfmirage.inf"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{871512c5-eda1-2847-9755-5ef8a4a3e50d}\dfmirage.inf" "9" "4fc89b15f" "0000000000000148" "WinSta0\Default" "0000000000000144" "208" "C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\105"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4596
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:db3e5b3e044cf517:DFMirage:2.0.105.0:dfmirage," "470102fe7" "0000000000000158"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5964bd2583871d246f0a01ca9e51abd9d
SHA1a871efcba882911684e39a6220557a2d3e7e5cc5
SHA25628200fbd0236e2b1ab2d0d615d45c1672ee4f4b7521fcaae52f7225eb124303c
SHA5121e91007a578b3da6ea278f5d61cb60e91e16077df2f68bf47424bb76175c12b88c003aee3e3b639510f61f20d22596cfb61bbe516383d02df546eea67a6409a9
-
Filesize
39KB
MD54e7cd3d45fe3c9c60a8163c66de156cc
SHA10a6278e6ec7c4c3a75ec25cc47d19f643cee4927
SHA25687308c9b7ecd835c7ae58a3eb6e5b8474977a420e5e3c978b798ff8d175779f1
SHA512bbc4bf06fcb45efac7ac41a9d5fd8c7b1601c9a948966c250677e2e6793d6d56bd1a87854387a81b3ad7b70ad39573f4a14a345bbd1c119ee7af9beb4f6b0cd7
-
Filesize
35KB
MD5178a6e9a0dce42959fc5ad129f60cba9
SHA1f1f29ad0ac605d4afda852f57401d762ab20b49b
SHA256215cb36c6178d47caa6600b4ca7036dceff412141be4511ed7220a1831820355
SHA512f6af4d204b49f4d5ad84d64f9ccb2676a8a2ba51794e0220beeda7dd5d7702200b3c04f7d5a8290f3f7f24cfb1036a87aba2a829137fbf54fd904f36d0bcd5f4
-
Filesize
2KB
MD5fca869ed2e4441a235ee85ef3c35e92f
SHA1f8710a2bfc7091b909ef990f18e70630b3ddea84
SHA25671aa40b8a284ea119da69dfcc2e1bf79eda0a1696c09934c93ea2109ca806c4f
SHA5128df3820fa92dd7acb70d2ecb09a38fc262ad6acae97a4dd7fb1594fb02aa0ea9e175c373aa536dc5e063cf4e9b6f82e4c107a1551781fe03571c259579094601
-
Filesize
899B
MD5e5b4d641c72c9938595a4fd224e6ad1f
SHA1222bee618179b66437e0d9c4be3a52b159eeef06
SHA2566dd2494e7619d54ab4c817b5f0933d0b0ac90a6781d79d0d76b9b190bbb1f74c
SHA512d3712675bf26af6762406b3fe2a1bebccc0187a93ad3752c8845a2a50462297657221aa655671c4048e5114cfc5a3fd3665b6c84f9af7373af7f30242e6021d7
-
Filesize
155KB
MD5f6e2d04ee7babdb2dfd80e6c5b79724c
SHA125c35e90ad036ef69d57041293401328187b209c
SHA25627e90fb741b042c3ea596b8323f42fec9fd6432a24efa0d3553cfcf381eebca9
SHA51261be219951000bf95393129a97f19dfdf3f94159d097c6f20a6aef991b8f1d3b8e0533ba33e0cae647c48962d9aa5b385e5934b62b514b175e398c5d64665a94