Analysis
-
max time kernel
100s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe
Resource
win7-20241010-en
windows7-x64
22 signatures
150 seconds
General
-
Target
425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe
-
Size
834KB
-
MD5
1a6643d549ed0d834a82f90c6db49a70
-
SHA1
29fbf25ecceecef74f1167637215d97f72989926
-
SHA256
425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8
-
SHA512
3d5e771b1f240b8a54563b4aa1e907eeb5f84e79574d80cb700879055aae149a6ed8a4197386a40677f1527397805b5ed4b01e3babe22126dcc8ac21d1aac703
-
SSDEEP
12288:3Swwn4oOZcaQYn3htObKmmOo3/UuSLekt0YAwgeKBjvrEH75:3Re4oG3hAU3/U/Lekt0YAwge8rEH75
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x0010000000023ba3-1.dat floxif -
Manipulates Digital Signatures 1 TTPs 5 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd6302000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd632000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd632000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 0f000000010000001400000035032c76362f413bb5690979f50aedec4bfa1a77030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd630b000000010000000e0000006c006900620077006400690000002000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c DrvInst.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0010000000023ba3-1.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 1008 installer_x64.exe -
Loads dropped DLL 1 IoCs
pid Process 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe -
Drops file in System32 directory 30 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\x86\SET13A4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\your_file.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\your_file.inf_amd64_faae004887a56fc1\x86\libusb0_x86.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\x86 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\your_file.inf_amd64_faae004887a56fc1\amd64\libusb0.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\amd64\SET1394.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\amd64\libusb0.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\x86\libusb0_x86.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\SET13A5.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\amd64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50} DrvInst.exe File opened for modification C:\Windows\System32\GroupPolicy installer_x64.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol installer_x64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\your_file.inf_amd64_faae004887a56fc1\amd64\libusb0.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\your_file.inf_amd64_faae004887a56fc1\your_file.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\amd64\SET1393.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\amd64\SET1394.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\your_file.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\SET13B6.tmp DrvInst.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol installer_x64.exe File created C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\amd64\SET1393.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\your_file.inf_amd64_faae004887a56fc1\your_file.inf DrvInst.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini installer_x64.exe File created C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\SET13A5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI installer_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\amd64\libusb0.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\x86\SET13A4.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e3dd4d8d-8a5f-da4a-8a0b-c7d220f66b50}\SET13B6.tmp DrvInst.exe -
resource yara_rule behavioral2/memory/4252-4-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/files/0x0010000000023ba3-1.dat upx behavioral2/memory/4252-15-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4252-25-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4252-57-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4252-184-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe File created \??\c:\program files\common files\system\symsrv.dll.000 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log installer_x64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe -
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe -
Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd6302000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd6302000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 0f000000010000001400000035032c76362f413bb5690979f50aedec4bfa1a770b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e00650072000000000000000000030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd632000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd632000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd632000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd632000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\EB27BB54D44170DE2CCF4B9F7A41F7361A45FD63\Blob = 030000000100000014000000eb27bb54d44170de2ccf4b9f7a41f7361a45fd632000000001000000cc020000308202c830820231a00302010202107bf67e0b27e94da543a1ba3e285cc5f4300d06092a864886f70d010105050030633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3235303130333232323831315a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310032004100420026005000490044005f003100320041004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cda350af3d556566cda4784e48310879afed09295280a6b9bb8becfc0e796a7ae61f632ca5d6fe4266852b8f8891a376a4e6f56aa40bc47a852d140c6e43dcf4737d055c49882e61b7c788365c7c162052a60a208b937031005b1ab11439167ef4a80e43089d468aa1bcc27ed585abe27efd93092a66cac6c67ae25a9c6ec3590203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181004bbf03591f7d7001e641a922e9f38d361fe836bc4752802558f021d89587361a69355c58edd68f6f5d306c9d34f2cb4ad27c4053f925ff4cbb9574b6a49ff45122cbaf6687a7eb816e8beed25ab0339c5400fdedd65455aeab6d6f956723c274c1ef2185f971af05f6dc17d5ca2bf66b049c7901fc17c16a39b99de645a3790c 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe Token: SeAuditPrivilege 3812 svchost.exe Token: SeSecurityPrivilege 3812 svchost.exe Token: SeLoadDriverPrivilege 1008 installer_x64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4252 wrote to memory of 1008 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe 98 PID 4252 wrote to memory of 1008 4252 425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe 98 PID 3812 wrote to memory of 116 3812 svchost.exe 101 PID 3812 wrote to memory of 116 3812 svchost.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe"C:\Users\Admin\AppData\Local\Temp\425296353f916d4cc81a600dc611268cbb53fe46d02cdad5955cac9628c755d8.exe"1⤵
- Manipulates Digital Signatures
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\Documents\installer_x64.exeC:\Users\Admin\Documents\installer_x64.exe your_file.inf2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{72a27f06-a213-a342-9691-4c96e0399466}\your_file.inf" "9" "4a6f3eb03" "0000000000000140" "WinSta0\Default" "0000000000000148" "208" "C:\Users\Admin\Documents"2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:116
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4776
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
4KB
MD5c67460ed11f3f5144f78cf04a673ecde
SHA1c0c7fc1f1bd45104dce2ebdc0049abba410ddd0d
SHA2568730394b64663d90aeb1344ccbd3a2667fbf5c016b6ed83714a569ea0a521017
SHA51215b57b3f234edc39a0bfb3a5bf3d32ddef3fcdf6bffac36a8b545fb60f6c5ac70e83b1a85d0fbbf9b0d4a60806e30d7364f97768a8328b9bc817be8618212161
-
Filesize
74KB
MD51d8215f7f8cd02a553499b534ccfb4d5
SHA1bab236f840f1521c43bcbaa2a7b92f14f329bc70
SHA2564f18b5d2c28aa66b648c8683c6d09b52b92cbbee85984bbefad5f38a64bc2a14
SHA51279ef4b25f16b2f2f37605298470ba9c4600e724e4b52d589add7d48816f656b93c082b5c65669e50e0546865063a068d26390e6ec7fbab66c3726e49a3779d69
-
Filesize
51KB
MD516e18ced459b1824234890386ee66cd5
SHA181d2b572ec0d24aba11ed6bfa9174ffad54140b7
SHA2568058f2afe6ef96a7d2ded432997fd8655970c9ea75a938ee4557d6a2cb4cc989
SHA512b0e67d040d39f043305b0c172906bbea8341f1326108f5c5a0379cd6b287d62cbd86270385713d0f6a14c5106a5a6c23f6247a303e6124cb3e33982978505c98
-
Filesize
66KB
MD5535779909a40b42f4f3e48598f5778a5
SHA13a238468009a6dea3e4f70821339185e56ea3b69
SHA25600caca07869b19d10b370552ac7cc2f6f2ee246fc15db11650f6cd3f4ef9b666
SHA512723b42c3df960f031343b9bb74a55ab874cd1f740a187a58bfecdad78876dd227392f18f6faea33e743593511a12635ef6419bb68d4361c6631584ebc8838e80
-
Filesize
24KB
MD54781fd8602709818be5725872bf05081
SHA1747f3ebf9c91d9d704f860203f8e0fb0eb29250d
SHA25646ae5cf5110626589c1d1688ef9d7fdf6e57983f97fd554b9a6179ad57a533d4
SHA5126bf77032c9b4a41148b2d24d799ae68e0a05abd864b8e77df2338b0400ff04c64d9baf81f67cbddd5078e4f59801bdd2d644ceb9653a16779d3a877354589d25
-
Filesize
41KB
MD5c8c9800179af00c90629514e30873d80
SHA19438573aee178c68f49bfa5ad71132d06c4dfa9b
SHA256aa7d75a4d01b405aab7c848674bbed392b64c6e374e20fd72adc3c96294e2f00
SHA5121db533b4ed8e4ae2ff55ef8b93b9186e30f8711e91bf07051c70423bac76d8ef29ebe578483029f83dcb619f94fd8abf453aab78328a876fc88188671be522c2
-
Filesize
7KB
MD55c25115998ac8ba65637e3bdf31dba29
SHA11ff8d4ed1148342b622dabe53dc9ef5fb0aed8fb
SHA256d5a0a8afee7d7f5378a63df0db1d1437537b82cff9757bf165cab695da0cd39b
SHA512cda9dc67e73b63a9188d3d71a35a5ee839e1e0f4358f87fd9bf3f161b02940060e6ebca757c3b2f0b4cd3dba15129b4d6fee870bee2323be2f7b85e40c54cb67