xred | 97b7c2b1f5ffd5bae4799483d416012ceede6b2cff5087220e045af1913747ec

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Size

5.7MB
MD5

6ef27d77f5e163e63bcef83aad488dac
SHA1

e58d1eea2b997c9c57ed917002aa3f180258283d
SHA256

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137
SHA512

73e29cdd50eea7d2dc9ac2fb9f34c030f45e89a45e2e6c9cc2cac027cd70bfb92dcfa2a7bd0db1980df46d3686c18d5105f6c4fc33560c42654ae0ce5e4b8d0a
SSDEEP

98304:snsmtk2a1oiKjvpG51TDyWAYAZkEIVGzUihpHQSUggLFsXmL+uEqZEJh9bkUDRpp:CLO+jvIALYih2SUgpXa+jKEJh9b/9D

Score

10^/10

xred backdoor discovery persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Manipulates Digital Signatures 1 TTPs 5 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae02000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae2000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0b000000010000000e0000006c006900620077006400690000000300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae2000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0f0000000100000020000000c98fab02f4b9e163fbe1a68c8e8b7aa1c7e969297004985b44fb6c65f51bb32c0300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae0b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	DrvInst.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Executes dropped EXE 4 IoCs

pid	Process
4596	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
5096	Synaptics.exe
4644	._cache_Synaptics.exe
2864	installer_x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	installer_x64.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	installer_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	installer_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\WinUSB_Generic_Device.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\amd64\SET7AAB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\amd64\SET7AAC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\amd64\WdfCoInstaller01011.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\WinUSB_Generic_Device.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\SET7A9A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\WinUSB_Generic_Device.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\SET7A9B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\SET7A9B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\amd64\SET7AAB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\amd64\WdfCoInstaller01011.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\amd64\SET7AAC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy	installer_x64.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	installer_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{d57a4bd6-2fbf-1c40-b0c6-5e7b1f0cbc01}\SET7A9A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\WinUSB_Generic_Device.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d000000023b0a-5.dat	upx
behavioral1/memory/4596-60-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4644-189-0x00000000001E0000-0x0000000000854000-memory.dmp	upx
behavioral1/memory/4644-246-0x00000000001E0000-0x0000000000854000-memory.dmp	upx
behavioral1/memory/4596-247-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-258-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-266-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-268-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-403-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-406-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-429-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-431-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-442-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx
behavioral1/memory/4596-446-0x0000000000A50000-0x00000000010C4000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	installer_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0b000000010000000e0000006c006900620077006400690000000300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae2000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae2000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae02000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0f0000000100000020000000c98fab02f4b9e163fbe1a68c8e8b7aa1c7e969297004985b44fb6c65f51bb32c0b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae2000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae2000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0b000000010000000e0000006c006900620077006400690000000300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae2000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A06EB5F46A5164217CC6185B2F1A975C1E619AE\Blob = 0300000001000000140000005a06eb5f46a5164217cc6185b2f1a975c1e619ae02000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a00302010202101aeeb938416981874f527133305e183d300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313335315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100a874ec2ef34e6aa071a9c3b577b51421f8d4133f91c596a6881d4656e24aac80f0c4b58f2958a3e7a05fae01ebf714ff4207e481d8679ae103ef4fb6f3564ed0335275fd3049962a2a38892bcccbb49d5e147c481ccdeb6a7e8e823b89932e07ae17e78d80938b53aa95b04954fd1fc72e5b89f9484712f671f63ef3d64be0774bb3e7941885a6181944ecf57e8582e9385ae2675171b496307408c8e5a152f1d6fbf75644969ef2570ed9a71bdcc6bad048ce1f4bb763c72f9f8df8e90edc1debfb2bc1a8fbea0770a8e5d33555635078d9257f67364e284da420a77ecd233234aecad23f87795d6c826edc54bdb698bef9b10ceb5966ed37b17fc8e25472461762d0f3300a7fb0fa8d52ec691c786e0c7cbfe76b15c0208bca520df0bcf6c05a3a389b8a7013cfbbdfde5d10b10d085b5ea60de115bbc6faf5702e57293eab93e1b51a5c0be1aec69e340f5968780b5aa24a158d1c98d677f351be4fd6a7cc2507ea63aac78ed1cc084ecc4acc6bb0d3ba983e7847b55bc774fe7ee09b227b3511b9ea8670503d4260d65dfaec300cec2aa59a66ae1b38aa7127057b6e788ecc277249e1c9d156e50d1cfa6c9afa98518bcbd2c2cd2f5b8a19f25a85684fc8d256418716bf89348a81d799c0e3e2c2b38c00560e7fa5cacc47fe0ae1917d6eec1424842492bd448df9fa85b28d808b5c30b2d15182f39790ba4970940e6eed0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010050f1a4dbd6fdb3fe1c5ab9d9114dd08b9f29703be80303765eb499967e8dc32a1d12e4655a5e1447f4e7235ad5a6f850481835f21768a04b0669b11a628c253bb1a8eb06dd57773a1d299312aa3c2b6c8c80f3031d406a060cfad5890b9106af6e9048300bbf45a38b1e71157d2be60e184c6d56331ac6fd1d0611467def41eabc34f1b7921ea43612619cc8a0b3283bab33866597eaded210942b49442e804c2c8389f7ce655a9b13d52aba0d8851d24d1f2248082d96b201f97ec08c91a8ed5801e3879d3947bed73cdab4b57de7b24bf2effa2b539366aae92be272fb7b14258b57689eb8a161f05f1dc875b494d2753cc340a7464594af658060599d9ab62946c699d82ff18636e12a801f84e1dee7339b17af2503822daef9ee7f7638192950df7e7982789ca5034e9efd5e33f09fd0407a22bcf94d42c2dcf8b4c7e1844f345378010d6c09f08b2cd6c7d25dd9cc0b07a06eb1d294cf80a09a779ddb75731de8f548ee96986ad4573363608137dffce709cd4bf09355a8bf5fd67916bb72e1aa9f68cf3ff5438350a4141f7958facfe771ef2a7e141618a2f5a2de05e526d3f1351661ecb0c6fa6d8be5054ea1648db27d9baf4adfca62bdf9542813c50bb4ef11ac66829d29ef9bbfcc3ac7458d6be682ed01604030fa2d22c456635e887289a05aff27f374366548a5eba1643aa6fc98ad1864cdbae74f5f7b6c1b78	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2660	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeAuditPrivilege	4580	svchost.exe
Token: SeSecurityPrivilege	4580	svchost.exe
Token: SeLoadDriverPrivilege	2864	installer_x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4596	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4596	3164	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	85
PID 3164 wrote to memory of 4596	3164	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	85
PID 3164 wrote to memory of 4596	3164	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	85
PID 3164 wrote to memory of 5096	3164	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	86
PID 3164 wrote to memory of 5096	3164	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	86
PID 3164 wrote to memory of 5096	3164	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	86
PID 5096 wrote to memory of 4644	5096	Synaptics.exe	87
PID 5096 wrote to memory of 4644	5096	Synaptics.exe	87
PID 5096 wrote to memory of 4644	5096	Synaptics.exe	87
PID 4596 wrote to memory of 2864	4596	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	111
PID 4596 wrote to memory of 2864	4596	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	111
PID 4580 wrote to memory of 2776	4580	svchost.exe	119
PID 4580 wrote to memory of 2776	4580	svchost.exe	119

C:\Users\Admin\AppData\Local\Temp\1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
"C:\Users\Admin\AppData\Local\Temp\1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe"
  2⤵
  - Manipulates Digital Signatures
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\usb_driver\installer_x64.exe
    "C:\Users\Admin\usb_driver\installer_x64.exe" "WinUSB_Generic_Device.inf"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4644

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4ffe6ecc-e07b-ec43-967d-d0b97a125b3b}\WinUSB_Generic_Device.inf" "9" "494de428f" "0000000000000148" "WinSta0\Default" "0000000000000150" "208" "C:\Users\Admin\usb_driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
5.7MB

MD5
6ef27d77f5e163e63bcef83aad488dac

SHA1
e58d1eea2b997c9c57ed917002aa3f180258283d

SHA256
1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137

SHA512
73e29cdd50eea7d2dc9ac2fb9f34c030f45e89a45e2e6c9cc2cac027cd70bfb92dcfa2a7bd0db1980df46d3686c18d5105f6c4fc33560c42654ae0ce5e4b8d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Filesize
4.9MB

MD5
8364578c40b5a7f379adba1bad2521ec

SHA1
7e2bac877385ef86efd9d54d1b89ff4e9e18243a

SHA256
4b7c58696b7a809525f6abcea9b3e9c1bf91518ebdc0d19af31e219654074342

SHA512
034093ece4f6020e6dee686ebd7e197ba4bdcf10c96f5c1934cd0c8120c1e229b7832d26421802c2d572b322e7ed3fa00d495c7dbf1bad73d70d22aa7e71219c

Download Submit
C:\Users\Admin\AppData\Local\Temp\C5C75E00

Filesize
24KB

MD5
79198b194111677f5cc1c513de2da755

SHA1
a34ec312442b01312222962e4d971d5124df263a

SHA256
714bc23683550ca50c85101c30e0260d2c23c4ef76c86565c7e03564313f8990

SHA512
f94358a91decc44bfe3bf4d288c97d09598e9ad7d1fc1921e03910cda08515500a2898a818281357eca51af58bb3dbdec8bc6d5fa73e7bfb141345e66011469a

Download Submit
C:\Users\Admin\AppData\Local\Temp\E2t7ecZe.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\winusbcoinstaller2.dll

Filesize
831KB

MD5
8e7b9f81e8823fee2d82f7de3a44300b

SHA1
1633b3715014c90d1c552cd757ef5de33c161dee

SHA256
ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c

SHA512
9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9

Download Submit
C:\Users\Admin\USB_DR~1\WINUSB~1.CAT

Filesize
4KB

MD5
85f222fcef1a37ffcc47adfdad6649ea

SHA1
d66bfbed331d50813831589b4cff5ea5559816ae

SHA256
f7e71a8d196436fea2aae235070fc98b7a1372b5b27b5ba16d302a7e42d2770b

SHA512
87ae523154b6a3e180c817ac91cb73a25fe88cad3fec0fd64484450574dda55c93947ecb5f01a77c068f12ebded6c298a2814f73a27ff1899ab164bb674b1b0f

Download Submit
C:\Users\Admin\USB_DR~1\amd64\WdfCoInstaller01011.dll

Filesize
1.7MB

MD5
d10864c1730172780c2d4be633b9220a

SHA1
b85d02ba0e8de4aeded1a2f5679505cd403bd201

SHA256
f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2

SHA512
c161bfa9118e04eb60a885bf99758843c4b1349ac58d2e501dabbd7efc0480ec902ac9a2be16f850b218e97b022a90fcc44925d7b6e5113766621f7ade38b040

Download Submit
C:\Users\Admin\USB_DR~1\amd64\WinUSBCoInstaller2.dll

Filesize
979KB

MD5
246900ce6474718730ecd4f873234cf5

SHA1
0c84b56c82e4624824154d27926ded1c45f4b331

SHA256
981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6

SHA512
6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c

Download Submit
C:\Users\Admin\usb_driver\WinUSB_Generic_Device.inf

Filesize
4KB

MD5
c7973895547877629e6651a693699dc8

SHA1
a6d023050e00cd171cb54b57605ac078488d8875

SHA256
2e2ceb01dd904b8103b9ec84d5169a9f491492b3ed9c8954cd302feef14eca5e

SHA512
d15c13155a38e25b6b99feb85d16313955b6869aed3d42d2985f5532f52bc2b90e13d67a895cf2bc175b0d3590690c1e337812f04b4596077b91189894d33e62

Download Submit
C:\Users\Admin\usb_driver\installer_x64.exe

Filesize
129KB

MD5
5de36bf46030e08135bd9fbddca7613c

SHA1
8b0c6f66fc3a7eb151bf2f52b27557d02e6c6d69

SHA256
25e24cf299644001835fad6125562cd0054d1acce412505b0cc3b82444c0efb2

SHA512
a35cc0341660af29c3c803d5d3a4520e3032febc3178abacf4dc108bc1679d79e50a7015fcc5cd9956b7a2bc04736fae6d0f791da45d122adee352df6af4d1b8

Download Submit
memory/2660-193-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp

Filesize
64KB

Download
memory/2660-194-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp

Filesize
64KB

Download
memory/2660-195-0x00007FFF076C0000-0x00007FFF076D0000-memory.dmp

Filesize
64KB

Download
memory/2660-196-0x00007FFF076C0000-0x00007FFF076D0000-memory.dmp

Filesize
64KB

Download
memory/2660-191-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp

Filesize
64KB

Download
memory/2660-190-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp

Filesize
64KB

Download
memory/2660-192-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp

Filesize
64KB

Download
memory/3164-0-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/3164-128-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/4596-247-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-429-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-266-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-268-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-446-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-258-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-442-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-60-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-403-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-431-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4596-406-0x0000000000A50000-0x00000000010C4000-memory.dmp

Filesize
6.5MB

Download
memory/4644-189-0x00000000001E0000-0x0000000000854000-memory.dmp

Filesize
6.5MB

Download
memory/4644-246-0x00000000001E0000-0x0000000000854000-memory.dmp

Filesize
6.5MB

Download
memory/5096-249-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/5096-430-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/5096-404-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/5096-129-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/5096-443-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/5096-250-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads