xred | 97b7c2b1f5ffd5bae4799483d416012ceede6b2cff5087220e045af1913747ec

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Size

5.7MB
MD5

6ef27d77f5e163e63bcef83aad488dac
SHA1

e58d1eea2b997c9c57ed917002aa3f180258283d
SHA256

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137
SHA512

73e29cdd50eea7d2dc9ac2fb9f34c030f45e89a45e2e6c9cc2cac027cd70bfb92dcfa2a7bd0db1980df46d3686c18d5105f6c4fc33560c42654ae0ce5e4b8d0a
SSDEEP

98304:snsmtk2a1oiKjvpG51TDyWAYAZkEIVGzUihpHQSUggLFsXmL+uEqZEJh9bkUDRpp:CLO+jvIALYih2SUgpXa+jKEJh9b/9D

Score

10^/10

xred backdoor discovery macro persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Manipulates Digital Signatures 1 TTPs 5 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exeDrvInst.exe

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000b38e2f34e781134983168b703e5014121c5afd792000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 0f000000010000002000000025d161e179a415a397a4621c4d93d6b2da7d901430542c5bc8509581809ff5d9030000000100000014000000b38e2f34e781134983168b703e5014121c5afd790b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 030000000100000014000000b38e2f34e781134983168b703e5014121c5afd7902000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 030000000100000014000000b38e2f34e781134983168b703e5014121c5afd792000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

Processes:

resource
behavioral2/files/0x00020000000229c5-375.dat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exeSynaptics.exe._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Executes dropped EXE 4 IoCs

Processes:

._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exeSynaptics.exe._cache_Synaptics.exeinstaller_x64.exe

pid	Process
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
3584	Synaptics.exe
564	._cache_Synaptics.exe
5076	installer_x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Drops file in System32 directory 25 IoCs

Processes:

installer_x64.exeDrvInst.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	installer_x64.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	installer_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\SETDB9B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\SETDB9C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\amd64\SETDBAC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\amd64\SETDBAD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\amd64\WdfCoInstaller01011.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\SETDB9C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\amd64\SETDBAC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\amd64\WdfCoInstaller01011.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\WinUSB_Generic_Device.cat	DrvInst.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	installer_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\amd64\SETDBAD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_fe40995985fc6047\WinUSB_Generic_Device.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy	installer_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\SETDB9B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\WinUSB_Generic_Device.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}\WinUSB_Generic_Device.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1986d0a5-7df3-6346-a3c5-833178c08b48}	DrvInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	installer_x64.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x0008000000023ca7-5.dat	upx
behavioral2/memory/1136-69-0x0000000000D20000-0x0000000001394000-memory.dmp	upx
behavioral2/memory/564-189-0x0000000000900000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/564-191-0x0000000000900000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/1136-235-0x0000000000D20000-0x0000000001394000-memory.dmp	upx
behavioral2/memory/1136-243-0x0000000000D20000-0x0000000001394000-memory.dmp	upx
behavioral2/memory/1136-386-0x0000000000D20000-0x0000000001394000-memory.dmp	upx
behavioral2/memory/1136-392-0x0000000000D20000-0x0000000001394000-memory.dmp	upx
behavioral2/memory/1136-395-0x0000000000D20000-0x0000000001394000-memory.dmp	upx
behavioral2/memory/1136-404-0x0000000000D20000-0x0000000001394000-memory.dmp	upx
behavioral2/memory/1136-408-0x0000000000D20000-0x0000000001394000-memory.dmp	upx
behavioral2/memory/1136-445-0x0000000000D20000-0x0000000001394000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

Processes:

installer_x64.exesvchost.exeDrvInst.exe

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	installer_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exeSynaptics.exe._cache_Synaptics.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DrvInst.exesvchost.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies data under HKEY_USERS 41 IoCs

Processes:

DrvInst.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 41 IoCs

Processes:

._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exeSynaptics.exe1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000007559512a100054656d7000003a0009000400efbe475986487559512a2e0000006ce10100000001000000000000000000000000000000c5ac1500540065006d007000000014000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000047598648120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe475986487559512a2e00000058e10100000001000000000000000000000000000000d2fecc004100700070004400610074006100000042000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000004759a34a10004c6f63616c003c0009000400efbe475986487559512a2e0000006be10100000001000000000000000000000000000000f82ccb004c006f00630061006c00000014000000	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 030000000100000014000000b38e2f34e781134983168b703e5014121c5afd7902000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B38E2F34E781134983168B703E5014121C5AFD79	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 030000000100000014000000b38e2f34e781134983168b703e5014121c5afd792000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 030000000100000014000000b38e2f34e781134983168b703e5014121c5afd792000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B38E2F34E781134983168B703E5014121C5AFD79	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 030000000100000014000000b38e2f34e781134983168b703e5014121c5afd7902000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000b38e2f34e781134983168b703e5014121c5afd792000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B38E2F34E781134983168B703E5014121C5AFD79\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000b38e2f34e781134983168b703e5014121c5afd792000000001000000c5050000308205c1308203a9a003020102021032c3d1db7d2aee864448ce47c2d4d9db300d06092a864886f70d01010b0500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3234313132313035313834325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100d510e1ab9fdc6524809646d7ed1b80cc96790f394db9f85cd39dc39d97ccc395cd8640f35cbfe9a09492c09a3f12e76c2f91efd519084766fcecc6b9f30c138469949c8dddba628e05053cb54ef2cf8baf4a5bd6a11324cbf7c99c8710ad770d95b23e5735ed173fff0e1d3f6caeb30f6619ec34c1a3297b7bd3a7a4eb10584403aeaf5dc7ea8adb1aa8b2e31ab486c5773f43257c869b4191ec5fc58d397ef52569fe25905a46227c118180e98492247409e446de68b05abd696d8b046f42b176ab2af82507c86a90dd30d3528ac6601aaf3d24d2774d9dc1dea059f9e926e6089fefd57b21499c818ebaa959b5f0c8768146917a9a5883ce4b8636eefb4d621d0abd85a9aa912b7787bb9bb09861a536e5b32590839afd2a7c68fe338d3a4987a8f13f8960b068a428236b4d4765365e3039d85619671e36004316cddce91f65b2240070ab5171e5f73dbc4420575eebb341b012e670cb8f8032be28904583d580ed2f25b17b8030831d786e9010d1ef2a7b85c2e2d0c58f422f26f188aa5acc5eb631be3f7c8f7f4d31ff629c570bbccb87470db419a745c8ead8665ece33c259d576ecc75fafbc448dcbc9dcbf98378378efd026f4afac24ee16fed2acd89bd44902fccd07e57ee0cf6b5cec2d2e401b94118b29f122fc837ad86d25a155a3e9d5386a1e1c36900489a2bce0a0fcab2fbefda7317e928609e055e4bd9f7d0203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100071d7489670b3937ad746af6c2433f31a0f672dbcac50c204b81f065c765242dd7ed858fe9aa101f98bd819f16b8278fec349f679ff78011a4d4effdc64a4bf87f48e3e2f8f4389fec5af0dfcab5852d6490b5abea95bec5c28d42ea19d80e85fe1734f05524e01aad283f375af22ff37bbffab757c020fc90d52b4d437ebcbd98323b3e366eab8bc242b6a04f1e4dee8944f7dcf0004666061c586593c4073f3fcb50ee1e8ab676ee90e97530c71af5f134a4cbebebce58fc892d4c52ffc4aa3fadbd37d3a6a218d52dd14b6e729e4de39a8bb22a9ef5e8c566aef5bb9a4dbf6db99e1966f063c77210b050bda1ab9b5a2442c52dd75257aff085234df185419470459308994ee3069168146483d7e7b518a48b6f7e7f52b0367b5a2e4014e8789ea2360a79b1ac863bbfc4fb86de9f52a34dd8a8614868101fe4eeb6d869ebd0774f06db5fabf8fd54a2abb203d618ee3c7c98fdac084f38fa80a0edf434459bbd78353b5bb5f42f9ec571dc3b065b0662f6e4659b23d31e3a5c76b603e17618e968d871d81e9b41d99cbcf841ef6d82c4ac8199512e343935b5163b4e37ffbed8c67b1d2af13ff61a7d407f2a0eb4b031c950b5e6ea16c7a521f53bcc34fa3826aa849a5cc9a0bb758de73da9b1b6e9da2875d87f9ca428cce4495d6940c454ea6d5268c0e6048566e705636f94687b2afb5f06f0ffd6e74acff099d94ef7	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B38E2F34E781134983168B703E5014121C5AFD79	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
2140	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

svchost.exeinstaller_x64.exe

description	pid	Process
Token: SeAuditPrivilege	2992	svchost.exe
Token: SeSecurityPrivilege	2992	svchost.exe
Token: SeLoadDriverPrivilege	5076	installer_x64.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exeEXCEL.EXE

pid	Process
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exeSynaptics.exe._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exesvchost.exe

description	pid	Process	procid_target
PID 5040 wrote to memory of 1136	5040	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	82
PID 5040 wrote to memory of 1136	5040	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	82
PID 5040 wrote to memory of 1136	5040	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	82
PID 5040 wrote to memory of 3584	5040	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	83
PID 5040 wrote to memory of 3584	5040	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	83
PID 5040 wrote to memory of 3584	5040	1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	83
PID 3584 wrote to memory of 564	3584	Synaptics.exe	84
PID 3584 wrote to memory of 564	3584	Synaptics.exe	84
PID 3584 wrote to memory of 564	3584	Synaptics.exe	84
PID 1136 wrote to memory of 5076	1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	92
PID 1136 wrote to memory of 5076	1136	._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe	92
PID 2992 wrote to memory of 1160	2992	svchost.exe	98
PID 2992 wrote to memory of 1160	2992	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
"C:\Users\Admin\AppData\Local\Temp\1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe"
  2⤵
  - Manipulates Digital Signatures
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Users\Admin\usb_driver\installer_x64.exe
    "C:\Users\Admin\usb_driver\installer_x64.exe" "WinUSB_Generic_Device.inf"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7c4b2610-a0e6-d348-9323-b094a45aa31d}\WinUSB_Generic_Device.inf" "9" "494de428f" "0000000000000140" "WinSta0\Default" "0000000000000150" "208" "C:\Users\Admin\usb_driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1160

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
5.7MB

MD5
6ef27d77f5e163e63bcef83aad488dac

SHA1
e58d1eea2b997c9c57ed917002aa3f180258283d

SHA256
1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137

SHA512
73e29cdd50eea7d2dc9ac2fb9f34c030f45e89a45e2e6c9cc2cac027cd70bfb92dcfa2a7bd0db1980df46d3686c18d5105f6c4fc33560c42654ae0ce5e4b8d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_1ce6e133b0aee819669af334b31e321a44f74020d2e36e43183f7aedd87cc137.exe

Filesize
4.9MB

MD5
8364578c40b5a7f379adba1bad2521ec

SHA1
7e2bac877385ef86efd9d54d1b89ff4e9e18243a

SHA256
4b7c58696b7a809525f6abcea9b3e9c1bf91518ebdc0d19af31e219654074342

SHA512
034093ece4f6020e6dee686ebd7e197ba4bdcf10c96f5c1934cd0c8120c1e229b7832d26421802c2d572b322e7ed3fa00d495c7dbf1bad73d70d22aa7e71219c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7IuYTeZG.xlsm

Filesize
22KB

MD5
e03418d66312ad7216c4711ff53d70fd

SHA1
45fecd914f21fcc4d2f7ee4d5673257bceafd1bc

SHA256
3bd8c7c5eea9ae6e6f909286725836793654fea6b6193dcce1cfa55ed0abecf7

SHA512
a4758a913033dd8c02d76049ac316d907c1e8535410e70cd943549f43b008647e9b1956908fcfdf5ae6008f10c6191885c358d78d6ff06a8a6aa635995cce9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7IuYTeZG.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zadig.log

Filesize
14KB

MD5
636552e3cbca2c8baf6fa6c916149d70

SHA1
be00bba49768d4a42811b51b6740601b3ceff2fe

SHA256
b7a351b7f5c4d24a7c59d7f566ecbd3d752f0799d5dd778a30548f47642d3315

SHA512
cdd62e49b6230f95fb8dc9c73d6765ed4e29a39ed7c15971b748d918d9a90e1bf97dd7c5c7ed01d9d4dd3a83297634df5516bfbafa6ec7c01cbe1dbe8c6161f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\winusbcoinstaller2.dll

Filesize
831KB

MD5
8e7b9f81e8823fee2d82f7de3a44300b

SHA1
1633b3715014c90d1c552cd757ef5de33c161dee

SHA256
ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c

SHA512
9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{7c4b2610-a0e6-d348-9323-b094a45aa31d}\amd64\WinUSBCoInstaller2.dll

Filesize
979KB

MD5
246900ce6474718730ecd4f873234cf5

SHA1
0c84b56c82e4624824154d27926ded1c45f4b331

SHA256
981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6

SHA512
6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c

Download Submit
C:\Users\Admin\USB_DR~1\WINUSB~1.CAT

Filesize
4KB

MD5
721c4177c21038e09329d8e30a36153a

SHA1
74687d524a5af5a0ec6645d4ccf8b6e203603adb

SHA256
b9b89e98bf543bb7b864b6802f3c524006d421c0818d0801046ceb517656d865

SHA512
956733d9dfbce367eaadb70d4cab0564dceb7267256df982552ac2e2f8cfc1cf83d663618a442804d3b032e4d7961f37c15fa1cf1cd1f71d44005d8d14286966

Download Submit
C:\Users\Admin\USB_DR~1\amd64\WdfCoInstaller01011.dll

Filesize
1.7MB

MD5
d10864c1730172780c2d4be633b9220a

SHA1
b85d02ba0e8de4aeded1a2f5679505cd403bd201

SHA256
f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2

SHA512
c161bfa9118e04eb60a885bf99758843c4b1349ac58d2e501dabbd7efc0480ec902ac9a2be16f850b218e97b022a90fcc44925d7b6e5113766621f7ade38b040

Download Submit
C:\Users\Admin\usb_driver\WinUSB_Generic_Device.inf

Filesize
4KB

MD5
c7973895547877629e6651a693699dc8

SHA1
a6d023050e00cd171cb54b57605ac078488d8875

SHA256
2e2ceb01dd904b8103b9ec84d5169a9f491492b3ed9c8954cd302feef14eca5e

SHA512
d15c13155a38e25b6b99feb85d16313955b6869aed3d42d2985f5532f52bc2b90e13d67a895cf2bc175b0d3590690c1e337812f04b4596077b91189894d33e62

Download Submit
C:\Users\Admin\usb_driver\installer_x64.exe

Filesize
129KB

MD5
5de36bf46030e08135bd9fbddca7613c

SHA1
8b0c6f66fc3a7eb151bf2f52b27557d02e6c6d69

SHA256
25e24cf299644001835fad6125562cd0054d1acce412505b0cc3b82444c0efb2

SHA512
a35cc0341660af29c3c803d5d3a4520e3032febc3178abacf4dc108bc1679d79e50a7015fcc5cd9956b7a2bc04736fae6d0f791da45d122adee352df6af4d1b8

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
cead048a81341e7f91c31f96a82e98e3

SHA1
32f24dda3c3774957c623df11c1237c36ded44fd

SHA256
07956deed8284ce2dc1ff98f4a0fc3776df4b2299f53fac42962fe6f8de39836

SHA512
34c2887a34a65befe377822c93c662f26ace734b74628c77334d019f22633ecde948ceba29dad5d2b38685bfd90bbdc9817887f1f5a7bd4d3d68fbde38611a7a

Download Submit
memory/564-189-0x0000000000900000-0x0000000000F74000-memory.dmp

Filesize
6.5MB

Download
memory/564-191-0x0000000000900000-0x0000000000F74000-memory.dmp

Filesize
6.5MB

Download
memory/1136-243-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/1136-235-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/1136-445-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/1136-404-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/1136-408-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/1136-395-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/1136-392-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/1136-386-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/1136-69-0x0000000000D20000-0x0000000001394000-memory.dmp

Filesize
6.5MB

Download
memory/2140-335-0x00007FFDCCE10000-0x00007FFDCCE20000-memory.dmp

Filesize
64KB

Download
memory/2140-336-0x00007FFDCCE10000-0x00007FFDCCE20000-memory.dmp

Filesize
64KB

Download
memory/2140-338-0x00007FFDCA9E0000-0x00007FFDCA9F0000-memory.dmp

Filesize
64KB

Download
memory/2140-337-0x00007FFDCCE10000-0x00007FFDCCE20000-memory.dmp

Filesize
64KB

Download
memory/2140-339-0x00007FFDCA9E0000-0x00007FFDCA9F0000-memory.dmp

Filesize
64KB

Download
memory/2140-333-0x00007FFDCCE10000-0x00007FFDCCE20000-memory.dmp

Filesize
64KB

Download
memory/2140-334-0x00007FFDCCE10000-0x00007FFDCCE20000-memory.dmp

Filesize
64KB

Download
memory/3584-387-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/3584-393-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/3584-406-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/3584-244-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/3584-129-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3584-440-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/5040-0-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/5040-128-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download