3c832729574cc265b686cd3b77b86739bb1d65562b3f09b66798e73f718d5ec0

General

Target

Google Web Designer.exe
Size

606KB
MD5

0e77b4b765c41d8453e488b69f7256c2
SHA1

2d3e3de822ddbd093bdd0d874c82a1a3eefbe3ff
SHA256

3c832729574cc265b686cd3b77b86739bb1d65562b3f09b66798e73f718d5ec0
SHA512

01da6e84a4d5759ef1d9dfa3531f4bd5bc63aea53494dae119f8eb51eac4452b72314f401e1d5eb75b4a11f30f120890ded5acc33d32ef434e9c634a3db91de9
SSDEEP

12288:3Gmm2a914hG/JDHoUtu9bD+y3QPMB9JFuEJdFF0d4sjJLf8id+TwqU6QEx67U0kE:Wm21cQ62lrPU0kw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2492	JYQZGPOUSN1TJ.exe

Loads dropped DLL 2 IoCs

pid	Process
3020	Google Web Designer.exe
3020	Google Web Designer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	JYQZGPOUSN1TJ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	JYQZGPOUSN1TJ.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2492	3020	Google Web Designer.exe	28
PID 3020 wrote to memory of 2492	3020	Google Web Designer.exe	28
PID 3020 wrote to memory of 2492	3020	Google Web Designer.exe	28
PID 3020 wrote to memory of 2492	3020	Google Web Designer.exe	28

C:\Users\Admin\AppData\Local\Temp\Google Web Designer.exe
"C:\Users\Admin\AppData\Local\Temp\Google Web Designer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020
- C:\ProgramData\JYQZGPOUSN1TJ.exe
  "C:\ProgramData\JYQZGPOUSN1TJ.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\JYQZGPOUSN1TJ.exe

Filesize
159KB

MD5
0820b1d34fb9c3ea2831e889d8e1d477

SHA1
21f55497fec08821cfa22ffc9f8c2afa08cfa11a

SHA256
4f16c358a21341ad3fb5a46dc87e1cedb74759373ef97df755b8660ff1e6211c

SHA512
8ce4fd4dfb033100982865c11a496a9645427dfb031e31a376c48a74440d342b4b13349f701d3bf2deedd37e29069da9fe36f65fb788510e9b002d388fa95b03

Download Submit
memory/3020-0-0x00000000002C0000-0x000000000035C000-memory.dmp

Filesize
624KB

Download
memory/3020-1-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/3020-2-0x00000000003F0000-0x0000000000430000-memory.dmp

Filesize
256KB

Download
memory/3020-7-0x00000000006A0000-0x00000000006DD000-memory.dmp

Filesize
244KB

Download
memory/3020-12-0x00000000006A0000-0x00000000006DD000-memory.dmp

Filesize
244KB

Download
memory/3020-14-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing