744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f

General

Target
744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe
Size 3.2MB
Sample260421-mf12eafy5v
SHA256 744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f
MD5 583ff7e34cc7e85c2ab23d3f00729e16
SHA1 f5fa7a2061a621d24cc0a082ef01cda976ace1d6
SHA512 2253beec2d85ece066b5ebb76ba4b4e41a6930ce0ecdc4e6bf9bef503ee424a22bffade543e19fae37259215913d3480c9b508c303da12ca2a1ad30d6e3bf015
SSDEEP 98304:aVUJvifD33WEFWHiDNIM5IGXzv2jKu8rm:aVUOGEFWHINIM5IGXzfJa
TLSH
T100E5338B0462EC5BF502627A46FAE535F027FC041A8DA56346D03E1B3BBF3D5992C876
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DEFE98DBED143E72525829F183B00733925E8FFC\Blob = 030000000100000014000000defe98dbed143e72525829f183b00733925e8ffc200000000100000029050000308205253082040da00302010202100c5f956bce16d66a70f60e2819af50ce300d06092a864886f70d01010505003073310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d313230300603550403132944696769436572742048696768204173737572616e636520436f6465205369676e696e672043412d31301e170d3134313131313030303030305a170d3138303131373132303030305a3077310b3009060355040613024155311830160603550408130f4e657720536f7574682057616c6573310e300c060355040713054d616e6c79311e301c060355040a13155669727475616c48657265205074792e204c74642e311e301c060355040313155669727475616c48657265205074792e204c74642e30820122300d06092a864886f70d01010105000382010f003082010a0282010100be6f9602d0b1c82710db5784e2931c0b872e7c92ee6b346caf47b0a8fd6f005c21aa3777d05b70a2dfbbdb321ddaaa6b2642adf5fab9e0836b0888c21ac7648f2971dcbae4aff2d18e1e8ad3c8ae9d7c0174efb03371c44977e1b9d582bbf491d48363e0fcf66af24606f962806edfb7a6628fcaec27de92782b43e91ed82fc6c06b9f1832587bd43a2fbd2524f40660e3760c4e8a03472a11f604199cf6f8dabc073ace635f82a87761430bdb952512c0ed00f894fdd17cbe4b1ba9a01245b12554348549fad84cd81d1d7b4f687daa21f9105c3e5275008a79b170e11e21c7ba6fbae5b7b2694baab22fef872d1504722d8580d4801e41e51ef26b89cd24390203010001a38201af308201ab301f0603551d23041830168014974803eb15086bb9b25823cc942ef1c665d2648e301d0603551d0e0416041401f4de35b0f66dcb3a3f576005ea10d724884afe300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330690603551d1f04623060302ea02ca02a8628687474703a2f2f63726c332e64696769636572742e636f6d2f68612d63732d32303131612e63726c302ea02ca02a8628687474703a2f2f63726c342e64696769636572742e636f6d2f68612d63732d32303131612e63726c30420603551d20043b3039303706096086480186fd6c0301302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818606082b06010505070101047a3078302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305006082b060105050730028644687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e6365436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100ae0461da8d6a9965d3ed23707b3cc3f60dbd686f129521b93da554e70dd9082648898809d4463c0b5f3cbb64ad49ef969469ba4054377351fb58b57c4f5c1712aebbebc35dbbe186b9d740e12106491d567c2f9cbe5e5def5631d3eb0197c8b373a2f410c9acd4191c356badd878aa8a310a65f64b027f084f35b934ae975c9afef2130e954f2db2e32608346518d25bc31ba6a2298787caaec027d8ae5ad16317e43f5c105a6c196479c3e507eb25721a4c33a2af8989d82ea04d5d2c562f903b0aeedd533c1e8da16a7c785d41dc679592bf00efe91d8b4a3f8c3b60c28d0e3bf2d4a61a863806980181f215e513bf3cbb902f8e7985a5d88ef649b14a4ed9	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4156-0-0x00007FF68E6A0000-0x00007FF68F091000-memory.dmp	upx
behavioral2/memory/4156-5-0x00007FF68E6A0000-0x00007FF68F091000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\INF\oem2.PNF	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe
File created	C:\Windows\INF\oem0.PNF	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe
File created	C:\Windows\INF\oem1.PNF	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DEFE98DBED143E72525829F183B00733925E8FFC	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DEFE98DBED143E72525829F183B00733925E8FFC\Blob = 030000000100000014000000defe98dbed143e72525829f183b00733925e8ffc200000000100000029050000308205253082040da00302010202100c5f956bce16d66a70f60e2819af50ce300d06092a864886f70d01010505003073310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d313230300603550403132944696769436572742048696768204173737572616e636520436f6465205369676e696e672043412d31301e170d3134313131313030303030305a170d3138303131373132303030305a3077310b3009060355040613024155311830160603550408130f4e657720536f7574682057616c6573310e300c060355040713054d616e6c79311e301c060355040a13155669727475616c48657265205074792e204c74642e311e301c060355040313155669727475616c48657265205074792e204c74642e30820122300d06092a864886f70d01010105000382010f003082010a0282010100be6f9602d0b1c82710db5784e2931c0b872e7c92ee6b346caf47b0a8fd6f005c21aa3777d05b70a2dfbbdb321ddaaa6b2642adf5fab9e0836b0888c21ac7648f2971dcbae4aff2d18e1e8ad3c8ae9d7c0174efb03371c44977e1b9d582bbf491d48363e0fcf66af24606f962806edfb7a6628fcaec27de92782b43e91ed82fc6c06b9f1832587bd43a2fbd2524f40660e3760c4e8a03472a11f604199cf6f8dabc073ace635f82a87761430bdb952512c0ed00f894fdd17cbe4b1ba9a01245b12554348549fad84cd81d1d7b4f687daa21f9105c3e5275008a79b170e11e21c7ba6fbae5b7b2694baab22fef872d1504722d8580d4801e41e51ef26b89cd24390203010001a38201af308201ab301f0603551d23041830168014974803eb15086bb9b25823cc942ef1c665d2648e301d0603551d0e0416041401f4de35b0f66dcb3a3f576005ea10d724884afe300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330690603551d1f04623060302ea02ca02a8628687474703a2f2f63726c332e64696769636572742e636f6d2f68612d63732d32303131612e63726c302ea02ca02a8628687474703a2f2f63726c342e64696769636572742e636f6d2f68612d63732d32303131612e63726c30420603551d20043b3039303706096086480186fd6c0301302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818606082b06010505070101047a3078302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305006082b060105050730028644687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e6365436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100ae0461da8d6a9965d3ed23707b3cc3f60dbd686f129521b93da554e70dd9082648898809d4463c0b5f3cbb64ad49ef969469ba4054377351fb58b57c4f5c1712aebbebc35dbbe186b9d740e12106491d567c2f9cbe5e5def5631d3eb0197c8b373a2f410c9acd4191c356badd878aa8a310a65f64b027f084f35b934ae975c9afef2130e954f2db2e32608346518d25bc31ba6a2298787caaec027d8ae5ad16317e43f5c105a6c196479c3e507eb25721a4c33a2af8989d82ea04d5d2c562f903b0aeedd533c1e8da16a7c785d41dc679592bf00efe91d8b4a3f8c3b60c28d0e3bf2d4a61a863806980181f215e513bf3cbb902f8e7985a5d88ef649b14a4ed9	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4156	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4156	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4156	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe
4156	744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe

C:\Users\Admin\AppData\Local\Temp\744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe
"C:\Users\Admin\AppData\Local\Temp\744dcebacd6c72a8b4a9842234d0fea702719d167e0bf1484a5858b6286a219f.exe"
1⤵
- Manipulates Digital Signatures
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

1

T1553.004

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-0-0x00007FF68E6A0000-0x00007FF68F091000-memory.dmp

Download

memory/4156-5-0x00007FF68E6A0000-0x00007FF68F091000-memory.dmp