xred | 97b7c2b1f5ffd5bae4799483d416012ceede6b2cff5087220e045af1913747ec

Analysis

max time kernel
141s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Size

5.7MB
MD5

6ef27d77f5e163e63bcef83aad488dac
SHA1

e58d1eea2b997c9c57ed917002aa3f180258283d
SHA256

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137
SHA512

73e29cdd50eea7d2dc9ac2fb9f34c030f45e89a45e2e6c9cc2cac027cd70bfb92dcfa2a7bd0db1980df46d3686c18d5105f6c4fc33560c42654ae0ce5e4b8d0a
SSDEEP

98304:snsmtk2a1oiKjvpG51TDyWAYAZkEIVGzUihpHQSUggLFsXmL+uEqZEJh9bkUDRpp:CLO+jvIALYih2SUgpXa+jKEJh9b/9D

Score

10^/10

xred backdoor discovery persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Manipulates Digital Signatures 1 TTPs 5 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0b000000010000000e0000006c006900620077006400690000000300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef692000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0f00000001000000200000005d3817b364c8ce384bad27539e06db5650cf6674a2d251d5a58e28965d845a9d0300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef690b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef6902000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef692000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Executes dropped EXE 4 IoCs

pid	Process
3644	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
4516	Synaptics.exe
2812	._cache_Synaptics.exe
2588	installer_x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\WinUSB_Generic_Device.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\amd64\WdfCoInstaller01011.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\amd64\WdfCoInstaller01011.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}	DrvInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy	installer_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\WinUSB_Generic_Device.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\amd64\SETD034.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\amd64\SETD034.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\SETD021.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\SETD032.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	installer_x64.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	installer_x64.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	installer_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\SETD032.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\amd64\SETD033.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\amd64\SETD033.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\WinUSB_Generic_Device.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\WinUSB_Generic_Device.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	installer_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{0ac1979e-2690-4f46-98df-6d57e6cb43b4}\SETD021.tmp	DrvInst.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000029ccb-5.dat	upx
behavioral2/memory/3644-70-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/2812-188-0x00000000009F0000-0x0000000001064000-memory.dmp	upx
behavioral2/memory/2812-205-0x00000000009F0000-0x0000000001064000-memory.dmp	upx
behavioral2/memory/3644-250-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/3644-249-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/3644-351-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/3644-354-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/3644-356-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/3644-365-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/3644-370-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/3644-397-0x00000000009D0000-0x0000000001044000-memory.dmp	upx
behavioral2/memory/3644-399-0x00000000009D0000-0x0000000001044000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	installer_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000004759996010004c6f63616c003c0009000400efbe47594d5e7559a2292e0000004d5702000000010000000000000000000000000000001f5441004c006f00630061006c00000014000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000047594d5e120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe47594d5e7559a2292e000000395702000000010000000000000000000000000000002a3a98004100700070004400610074006100000042000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000007559a429100054656d7000003a0009000400efbe47594d5e7559a4292e0000004e57020000000100000000000000000000000000000086f9be00540065006d007000000014000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\Registry\User\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\NotificationData	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef6902000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef6902000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef692000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0b000000010000000e0000006c006900620077006400690000000300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef692000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0b000000010000000e0000006c006900620077006400690000000300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef692000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef692000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1F71BB426CB088CBE4550A0023BD5D782F43EF69\Blob = 0f00000001000000200000005d3817b364c8ce384bad27539e06db5650cf6674a2d251d5a58e28965d845a9d0b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000300000001000000140000001f71bb426cb088cbe4550a0023bd5d782f43ef692000000001000000c5050000308205c1308203a9a00302010202103bf30c773703c3b843723701454d22ae300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313331345a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100b8396bf7d48e4bb58e55741ed776f5648fdf974d6e6cd85249e0418801eb7f2793bd841bc87b7c89c0d90c4821e41e6b7df38ee7233445f36073a51b0781aaa65731fe64b2cb6b6bb68c997274f50d450bc0efc7bcf23b8b3e0c0bf83359f41b2a20c447d204b419aeb258b1560bc275743adce3a42b5c1545ff1da4f0acc7c6538e28e75166a283d10638a1c1412c9bd6153d02ef0319b6b1a7862b2de5b25d8a058da207220143a9d1ee878a3712bf3bda081fd3ed9a3d10b24f94da43783244a5e7791770f19583587e387227ee31cc79475544c36b464d320443e355192b328f07f23602879995a97cad8081d779a935d8bd1a188d0ed6e86230399cc5a1651f2977deaa974081ddc49d7aec0ce1ef70b973bda98ae1df797f675bac7695f3a38a4f41326c8e1ea039feaba62237eb4a1ef83bbd8d89300234d05fc3fee258466bbba4a4b2a48d0ff08f09005fa350f2e0daab2af418a7b1fa4ce6baaf192677410e13190c15095142f8212bbb69ee1548661cad0dcb5cb6e552e5052972368307f4327746dcfa2ae7f09c69b728c7b6f19fa1fc4668c1a96e6e1aaa8e44c2f1eef536afb40adef5ef73e5a612b3231c7cfece3b89a93a5f8f1a6cf2acdab2a9140ec78ff2ef16f3e10c42939dc97f6402e74aeaa95fa9cb92e00cd120ff2b95e38b4f473591981e7d86f53c6e45feea16c2553e8755150931bf55ee49a90203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b0500038202010021022704f5bd1fe083acb6ead4c5bab88023012a27c34c12768a9132d3744ef3cd29b0410ada104a447ae508f6dfe31b82338a458117b882f7123a3f10ac323c6f0a7d4a3535568e696f5e22c3c1fb1b2ffd073260fb73f00030e11fd9cf6e543bb519951bc2cd285fbc5bbcccb4bfa3eda15b61f93a44cf2bc4de67627743142a5e20acf4c79869c4496fb0c03d46bde0fcdaa7bb8c220585652d0b20d8e8c5f4cb4dadcca1e3f97a74c2cad519a776df8a0fa0aed774f09c7e77bfdb89c643dad70c0cf16e88bc9e3122959f03e823d3a43d34c1ab2195ac92a682f8282ee8e9fffdf671eab5262de95f3f48475baefcf184d3c80dd8ae263a91d166c46933c781241488f33fc745c65d114ef51394a7fb41287e4679908758c28aa62e5c22e049b3480685fe400aa2d2fd373473617a7eb90e9cc5a89735ff4975d403a3fda40f542326b0e9c6dd345676a836bd715a89b1d39367e9920553decd15d295b522430813c67ace5df15fc10b1fcc255789e321fe1ade8fcb48cf5dde18a4ae77833c73d428f0057bad39c056f16c0a69891b5b914d27f65e993527321a9c848b99c7b1181715f2ae22bca64b31c0f768f2035c5f13ef4c0145f9b23cb4ef21933917416ec2fcd273b102e3d423bb5cf344f7c53cacad97f3a482033895fac382e235743f012d45c7567dc31c276d1111cc96a4f0aeb1a25300afb8c41b897074	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2228	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeAuditPrivilege	4996	svchost.exe
Token: SeSecurityPrivilege	4996	svchost.exe
Token: SeLoadDriverPrivilege	2588	installer_x64.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
3644	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
3644	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3644	1608	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	79
PID 1608 wrote to memory of 3644	1608	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	79
PID 1608 wrote to memory of 3644	1608	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	79
PID 1608 wrote to memory of 4516	1608	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	80
PID 1608 wrote to memory of 4516	1608	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	80
PID 1608 wrote to memory of 4516	1608	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	80
PID 4516 wrote to memory of 2812	4516	Synaptics.exe	81
PID 4516 wrote to memory of 2812	4516	Synaptics.exe	81
PID 4516 wrote to memory of 2812	4516	Synaptics.exe	81
PID 3644 wrote to memory of 2588	3644	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	85
PID 3644 wrote to memory of 2588	3644	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	85
PID 4996 wrote to memory of 3112	4996	svchost.exe	90
PID 4996 wrote to memory of 3112	4996	svchost.exe	90

C:\Users\Admin\AppData\Local\Temp\1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
"C:\Users\Admin\AppData\Local\Temp\1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe"
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Users\Admin\usb_driver\installer_x64.exe
    "C:\Users\Admin\usb_driver\installer_x64.exe" "WinUSB_Generic_Device.inf"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2812

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f88e4dd5-514c-c147-bdc8-10aed22ad8e3}\WinUSB_Generic_Device.inf" "9" "494de428f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Users\Admin\usb_driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
5.7MB

MD5
6ef27d77f5e163e63bcef83aad488dac

SHA1
e58d1eea2b997c9c57ed917002aa3f180258283d

SHA256
1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137

SHA512
73e29cdd50eea7d2dc9ac2fb9f34c030f45e89a45e2e6c9cc2cac027cd70bfb92dcfa2a7bd0db1980df46d3686c18d5105f6c4fc33560c42654ae0ce5e4b8d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Filesize
4.9MB

MD5
8364578c40b5a7f379adba1bad2521ec

SHA1
7e2bac877385ef86efd9d54d1b89ff4e9e18243a

SHA256
4b7c58696b7a809525f6abcea9b3e9c1bf91518ebdc0d19af31e219654074342

SHA512
034093ece4f6020e6dee686ebd7e197ba4bdcf10c96f5c1934cd0c8120c1e229b7832d26421802c2d572b322e7ed3fa00d495c7dbf1bad73d70d22aa7e71219c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z4L5TNan.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\winusbcoinstaller2.dll

Filesize
831KB

MD5
8e7b9f81e8823fee2d82f7de3a44300b

SHA1
1633b3715014c90d1c552cd757ef5de33c161dee

SHA256
ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c

SHA512
9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{f88e4dd5-514c-c147-bdc8-10aed22ad8e3}\amd64\WinUSBCoInstaller2.dll

Filesize
979KB

MD5
246900ce6474718730ecd4f873234cf5

SHA1
0c84b56c82e4624824154d27926ded1c45f4b331

SHA256
981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6

SHA512
6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c

Download Submit
C:\Users\Admin\USB_DR~1\WINUSB~1.CAT

Filesize
4KB

MD5
a15572671faf3a6bccf4e2927e3c2142

SHA1
288aca80b42ad8d3af80ecfcfb0e4458c26a46d2

SHA256
ce82b1904ccea1953f336cb7fa334ed5afdcaf7cf346f9bd60130c87b382724f

SHA512
1b2b716cd51b624d8b6d916e3f721083d88270ef693cf59bf0ae93dfba699d48d82d8d2b8c4c521aa0e4904514acac2841d663a7809b35135f3d2a4599001651

Download Submit
C:\Users\Admin\USB_DR~1\amd64\WdfCoInstaller01011.dll

Filesize
1.7MB

MD5
d10864c1730172780c2d4be633b9220a

SHA1
b85d02ba0e8de4aeded1a2f5679505cd403bd201

SHA256
f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2

SHA512
c161bfa9118e04eb60a885bf99758843c4b1349ac58d2e501dabbd7efc0480ec902ac9a2be16f850b218e97b022a90fcc44925d7b6e5113766621f7ade38b040

Download Submit
C:\Users\Admin\usb_driver\WinUSB_Generic_Device.inf

Filesize
4KB

MD5
c7973895547877629e6651a693699dc8

SHA1
a6d023050e00cd171cb54b57605ac078488d8875

SHA256
2e2ceb01dd904b8103b9ec84d5169a9f491492b3ed9c8954cd302feef14eca5e

SHA512
d15c13155a38e25b6b99feb85d16313955b6869aed3d42d2985f5532f52bc2b90e13d67a895cf2bc175b0d3590690c1e337812f04b4596077b91189894d33e62

Download Submit
C:\Users\Admin\usb_driver\installer_x64.exe

Filesize
129KB

MD5
5de36bf46030e08135bd9fbddca7613c

SHA1
8b0c6f66fc3a7eb151bf2f52b27557d02e6c6d69

SHA256
25e24cf299644001835fad6125562cd0054d1acce412505b0cc3b82444c0efb2

SHA512
a35cc0341660af29c3c803d5d3a4520e3032febc3178abacf4dc108bc1679d79e50a7015fcc5cd9956b7a2bc04736fae6d0f791da45d122adee352df6af4d1b8

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
f9a49a3e2415016fa85ddff0b8b38419

SHA1
f8c987119269e58d22a6b17ae2e8eca7744fb385

SHA256
14694dbee3897b6bd5aa596ebfd893e727179b67811920c174dc70e6eee8e579

SHA512
91ea129a51d2c3b342287c1250f5b0da6ba2a61eff11791d1cfae1f5c6dd2654c935be1452f4a681e794fd723a3c295e9bc9e59b9005aa4d8bd55ed36c9ad91c

Download Submit
memory/1608-128-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/1608-0-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/2228-193-0x00007FF85B370000-0x00007FF85B380000-memory.dmp

Filesize
64KB

Download
memory/2228-195-0x00007FF858CB0000-0x00007FF858CC0000-memory.dmp

Filesize
64KB

Download
memory/2228-194-0x00007FF858CB0000-0x00007FF858CC0000-memory.dmp

Filesize
64KB

Download
memory/2228-192-0x00007FF85B370000-0x00007FF85B380000-memory.dmp

Filesize
64KB

Download
memory/2228-189-0x00007FF85B370000-0x00007FF85B380000-memory.dmp

Filesize
64KB

Download
memory/2228-190-0x00007FF85B370000-0x00007FF85B380000-memory.dmp

Filesize
64KB

Download
memory/2228-191-0x00007FF85B370000-0x00007FF85B380000-memory.dmp

Filesize
64KB

Download
memory/2812-205-0x00000000009F0000-0x0000000001064000-memory.dmp

Filesize
6.5MB

Download
memory/2812-188-0x00000000009F0000-0x0000000001064000-memory.dmp

Filesize
6.5MB

Download
memory/3644-250-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-370-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-399-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-351-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-397-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-354-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-356-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-70-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-249-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/3644-365-0x00000000009D0000-0x0000000001044000-memory.dmp

Filesize
6.5MB

Download
memory/4516-366-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/4516-352-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/4516-398-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/4516-281-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads