cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6

General

Target
cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe
Size 3.6MB
Sample240603-txrydscc61
SHA256 cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6
MD5 3f40207d440c04cd4ee60895d23006cd
SHA1 0b899fb001d16529bb49709843d79a7964af611c
SHA512 6fb3ca6236effaf01b615dd2e441df7ce65687aded08278d5754d96075409ed2a46182092bba74071a8edb5f06480f9e8ddc2503918e2f6e04cb0c43a4817257
SSDEEP 98304:qkLNOkJELlBol4ULw5Mi4JKgJqqNS0+/PvxL5LoUo2qudpoF:lpeLY+/jgVNGvvoPF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2164	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp

Loads dropped DLL 1 IoCs

pid	Process
1244	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe

Modifies system certificate store 2 TTPs 5 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8B4A95E35CB05827B6C748A6EB593B22D77C442\Blob = 190000000100000010000000820d4f36e8fa7f51a33051739fb3412b1400000001000000140000003f5e6c95509bd2409d637f254e7604f97db6b95f030000000100000014000000a8b4a95e35cb05827b6c748a6eb593b22d77c4420f0000000100000020000000995c521c94576d9a9ed04e0496168ca8d2df48974ed8fc4ba6b3023b0e0016460400000001000000100000009bded6aee848edcd9d0e644af44f55a02000000001000000f9020000308202f5308201dda003020102021042fa36ec0bf9c3d6b0d7005f94765ac6300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303531363231303030305a170d3239303531353231303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d3efd2c896bdee4ce9c7f200f65f9d64b68052c84daf9a4f7586b0e4072bb908b3e2ff69c5a36587f81353931c5f0c947b8f0d4f32bd80b3d01ab6511d36bfb98fad841754bc8920367730b52a04b951b4dc09e18bda6cc8402f7493434d13bb328f70c1fa09b64e5a45941eddafc7d065467d1db129920fc8e1aaba1c1c1b0d15ce25463e7351932b767b6019ba27dd5d61f038df42e32b1f618cecdc21a9dbebdbfe206a98819f8e9803b66d5f607fe566534460a0aae5d12f8a0576c5e1af1e7e64539c327fb2c3a0f855ef170268f6a489047057fa7c9647bdfea816896336ddd3a94bf90b59dabe3589f9c74a24ac7ade6a0ad8c50227173a9b33850c9b0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604143f5e6c95509bd2409d637f254e7604f97db6b95f300d06092a864886f70d01010b05000382010100a9a822ef63a2bae46430df2832d3c903bf452bdba85f736658ae1b18c39ce2b7cf6f0d9f36b77885c1aec5655bcbce85558bdeba028d482c96c7cecee6ee5943f8f175c00abc98b6d7f5828871d81550a70be730834ca1684ba691e8016cc346785c0b1580303da8391a61a91229b0429001b0a0f38fb8f91e9e5da21d6bde669b4dc8f03644dbf06cc244ab81b46cef8f1b22ee1c46593ae9d13c7448af10cb3ec1d30891ba8c94773f5c975966bf0cbec8807543d844b9fce5d9b6cca36f9a5a05c8a39e3f2ec2ddc0093af8dfa8fd500e52ed0a6b007188524a7cf5fc692ea2b5e7a77e5192f49ae599e8ec19500ea4b12a110bafb4354b76a6e49923d613	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8B4A95E35CB05827B6C748A6EB593B22D77C442	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8B4A95E35CB05827B6C748A6EB593B22D77C442\Blob = 0f0000000100000020000000995c521c94576d9a9ed04e0496168ca8d2df48974ed8fc4ba6b3023b0e001646030000000100000014000000a8b4a95e35cb05827b6c748a6eb593b22d77c4422000000001000000f9020000308202f5308201dda003020102021042fa36ec0bf9c3d6b0d7005f94765ac6300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303531363231303030305a170d3239303531353231303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d3efd2c896bdee4ce9c7f200f65f9d64b68052c84daf9a4f7586b0e4072bb908b3e2ff69c5a36587f81353931c5f0c947b8f0d4f32bd80b3d01ab6511d36bfb98fad841754bc8920367730b52a04b951b4dc09e18bda6cc8402f7493434d13bb328f70c1fa09b64e5a45941eddafc7d065467d1db129920fc8e1aaba1c1c1b0d15ce25463e7351932b767b6019ba27dd5d61f038df42e32b1f618cecdc21a9dbebdbfe206a98819f8e9803b66d5f607fe566534460a0aae5d12f8a0576c5e1af1e7e64539c327fb2c3a0f855ef170268f6a489047057fa7c9647bdfea816896336ddd3a94bf90b59dabe3589f9c74a24ac7ade6a0ad8c50227173a9b33850c9b0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604143f5e6c95509bd2409d637f254e7604f97db6b95f300d06092a864886f70d01010b05000382010100a9a822ef63a2bae46430df2832d3c903bf452bdba85f736658ae1b18c39ce2b7cf6f0d9f36b77885c1aec5655bcbce85558bdeba028d482c96c7cecee6ee5943f8f175c00abc98b6d7f5828871d81550a70be730834ca1684ba691e8016cc346785c0b1580303da8391a61a91229b0429001b0a0f38fb8f91e9e5da21d6bde669b4dc8f03644dbf06cc244ab81b46cef8f1b22ee1c46593ae9d13c7448af10cb3ec1d30891ba8c94773f5c975966bf0cbec8807543d844b9fce5d9b6cca36f9a5a05c8a39e3f2ec2ddc0093af8dfa8fd500e52ed0a6b007188524a7cf5fc692ea2b5e7a77e5192f49ae599e8ec19500ea4b12a110bafb4354b76a6e49923d613	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8B4A95E35CB05827B6C748A6EB593B22D77C442\Blob = 1400000001000000140000003f5e6c95509bd2409d637f254e7604f97db6b95f030000000100000014000000a8b4a95e35cb05827b6c748a6eb593b22d77c4420f0000000100000020000000995c521c94576d9a9ed04e0496168ca8d2df48974ed8fc4ba6b3023b0e0016462000000001000000f9020000308202f5308201dda003020102021042fa36ec0bf9c3d6b0d7005f94765ac6300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303531363231303030305a170d3239303531353231303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d3efd2c896bdee4ce9c7f200f65f9d64b68052c84daf9a4f7586b0e4072bb908b3e2ff69c5a36587f81353931c5f0c947b8f0d4f32bd80b3d01ab6511d36bfb98fad841754bc8920367730b52a04b951b4dc09e18bda6cc8402f7493434d13bb328f70c1fa09b64e5a45941eddafc7d065467d1db129920fc8e1aaba1c1c1b0d15ce25463e7351932b767b6019ba27dd5d61f038df42e32b1f618cecdc21a9dbebdbfe206a98819f8e9803b66d5f607fe566534460a0aae5d12f8a0576c5e1af1e7e64539c327fb2c3a0f855ef170268f6a489047057fa7c9647bdfea816896336ddd3a94bf90b59dabe3589f9c74a24ac7ade6a0ad8c50227173a9b33850c9b0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604143f5e6c95509bd2409d637f254e7604f97db6b95f300d06092a864886f70d01010b05000382010100a9a822ef63a2bae46430df2832d3c903bf452bdba85f736658ae1b18c39ce2b7cf6f0d9f36b77885c1aec5655bcbce85558bdeba028d482c96c7cecee6ee5943f8f175c00abc98b6d7f5828871d81550a70be730834ca1684ba691e8016cc346785c0b1580303da8391a61a91229b0429001b0a0f38fb8f91e9e5da21d6bde669b4dc8f03644dbf06cc244ab81b46cef8f1b22ee1c46593ae9d13c7448af10cb3ec1d30891ba8c94773f5c975966bf0cbec8807543d844b9fce5d9b6cca36f9a5a05c8a39e3f2ec2ddc0093af8dfa8fd500e52ed0a6b007188524a7cf5fc692ea2b5e7a77e5192f49ae599e8ec19500ea4b12a110bafb4354b76a6e49923d613	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8B4A95E35CB05827B6C748A6EB593B22D77C442\Blob = 0400000001000000100000009bded6aee848edcd9d0e644af44f55a00f0000000100000020000000995c521c94576d9a9ed04e0496168ca8d2df48974ed8fc4ba6b3023b0e001646030000000100000014000000a8b4a95e35cb05827b6c748a6eb593b22d77c4421400000001000000140000003f5e6c95509bd2409d637f254e7604f97db6b95f2000000001000000f9020000308202f5308201dda003020102021042fa36ec0bf9c3d6b0d7005f94765ac6300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303531363231303030305a170d3239303531353231303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100d3efd2c896bdee4ce9c7f200f65f9d64b68052c84daf9a4f7586b0e4072bb908b3e2ff69c5a36587f81353931c5f0c947b8f0d4f32bd80b3d01ab6511d36bfb98fad841754bc8920367730b52a04b951b4dc09e18bda6cc8402f7493434d13bb328f70c1fa09b64e5a45941eddafc7d065467d1db129920fc8e1aaba1c1c1b0d15ce25463e7351932b767b6019ba27dd5d61f038df42e32b1f618cecdc21a9dbebdbfe206a98819f8e9803b66d5f607fe566534460a0aae5d12f8a0576c5e1af1e7e64539c327fb2c3a0f855ef170268f6a489047057fa7c9647bdfea816896336ddd3a94bf90b59dabe3589f9c74a24ac7ade6a0ad8c50227173a9b33850c9b0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604143f5e6c95509bd2409d637f254e7604f97db6b95f300d06092a864886f70d01010b05000382010100a9a822ef63a2bae46430df2832d3c903bf452bdba85f736658ae1b18c39ce2b7cf6f0d9f36b77885c1aec5655bcbce85558bdeba028d482c96c7cecee6ee5943f8f175c00abc98b6d7f5828871d81550a70be730834ca1684ba691e8016cc346785c0b1580303da8391a61a91229b0429001b0a0f38fb8f91e9e5da21d6bde669b4dc8f03644dbf06cc244ab81b46cef8f1b22ee1c46593ae9d13c7448af10cb3ec1d30891ba8c94773f5c975966bf0cbec8807543d844b9fce5d9b6cca36f9a5a05c8a39e3f2ec2ddc0093af8dfa8fd500e52ed0a6b007188524a7cf5fc692ea2b5e7a77e5192f49ae599e8ec19500ea4b12a110bafb4354b76a6e49923d613	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2164	1244	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe	28
PID 1244 wrote to memory of 2164	1244	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe	28
PID 1244 wrote to memory of 2164	1244	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe	28
PID 1244 wrote to memory of 2164	1244	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe	28
PID 1244 wrote to memory of 2164	1244	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe	28
PID 1244 wrote to memory of 2164	1244	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe	28
PID 1244 wrote to memory of 2164	1244	cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe	28

C:\Users\Admin\AppData\Local\Temp\cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe
"C:\Users\Admin\AppData\Local\Temp\cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\is-9U9TB.tmp\cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9U9TB.tmp\cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp" /SL5="$5010A,2869441,899584,C:\Users\Admin\AppData\Local\Temp\cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp

Path \Users\Admin\AppData\Local\Temp\is-9U9TB.tmp\cc008bdf8d9a7d5a44e4f0139c587a8e050dfb3f8a6d75dcd3e05759213539d6.tmp
Size 3.1MB
SHA256 f35b9ece6b624fa003fd01dba263829d9551dd44d79f7e341db774cf61b7b144
MD5 97ab32e351ca03b4ce993265aecab05f
SHA1 7aa3b80e7d416ace5ce1c82f5f144ccf0ffc0152
SHA512 5bcfc31e7753c0b78957edd81158702c433a79a846025753a2358c6e0d2aff2581004039314935b53ee6caf0484eae88d801c53e4a33bc22c86164e74fca0ef2
SSDEEP 49152:SWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTb9333TVOfJ:etLutqgwh4NYxtJpkxhGm333TVOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1244-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/1244-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/1244-14-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/2164-9-0x0000000000400000-0x000000000072C000-memory.dmp

Download

memory/2164-12-0x0000000000400000-0x000000000072C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads