Analysis
- max time kernel
149s - max time network
129s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 18:25
Behavioral task
behavioral1
Sample
support.client.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
support.client.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target support.client.exe
- Size 305KB
- Sample260504-w2y9daev5l
- SHA256 e9f9f4577c614ede1c77b359afef44afb83ceac8ac986d9101596d047a33d7ad
- MD5 93d4e0a1921da70b3acec07a14501036
- SHA1 70870ec95bc3799e9f6a3b4ad8f8dae89ae124cd
- SHA512 af83d7cab59a032b8b681f55b270de51fe0b60ad6a7b1b1972eec7db6acc17afe57f1df4bbbe6bc2c473bc8ff5ba6ec6e5505d518bdaeebfaca937f3f115573a
- SSDEEP 6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti98H:A1iw7gryNkSV1hy1Z1u2JLI9Y
- TLSH T13B646C11B9C48432C673383107B8E2B28DBDB8301D655B9F57A81D7A9F741D0EA29B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 4 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\Blob = 030000000100000014000000ff8bfafa697459874fb9843b1efda5c91871a44c2000000001000000640700003082076030820548a00302010202100fc890218ebc1b3c4b8521f655979371300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303731333030303030305a170d3235303731323233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100da5d7b6eb44d5d8c63f7c47c18a1bf98759158e061191810be4001b75443bd96e1de68459fd72f7fe20abcdab9d10541d5b333a191c8694e70eadeb590a46fbacc4bf1e580e3d49900107f31a44bb0761c26e95f32d3d2076fc1ce1550fcc9b80d3a9e126cf948f5d78907f82795bd1c5437f87f582a9cfa3c9adfb079d3af1b267a35c2fed12b99aa072db1a974d8b3704831f91c07c343f8bdfe52a88a5a9ba1ce87a957eed596ea5af8dc2821f8970898355d467621f188cda371cbf194625ac45e7682afc4a7687dfdf58fa12f67da9f8868f8f1bbafaa5455922fce755cceeee2c4caa8c74350420396f445e5b8e2340ddca227ce4846a787150ff50b982a02fac5722e2630da9e7f4f11f61d46c4a3a741834de00ba96fe8d0eec53b8d7332fc8567d59dae58c9da2b4cd394391f1a35c075ce76e4f58118f42cffd0f9d097d86e6e40e7174583b89ea38de2885b9aeed147efa57ddc17ad421b2c9323575a9e0194576825aed3b586a072b2f4dc6194a5566976865079ac988b1c0cadfd10851be62b1f79cad6a937f874eab8cb3651e29e862d5cafe9d1b42a83f335d2aba6ec4ef9d9aa115a069c24916d645de415844dc365c616628665ba45d57e5a4e9ac0a5b414e8833ed77e4591647937e6f496d5cb708e29e3ca60ed81d594c9954186e08e7dbf3555f0a0a4e56625b4dfdc46577d88321b4719cc21b0a7ad0203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414294f9bff00edb7d66b2218307d77a83f5c2b0d85300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201004e334e35453d2ec365082bd7e988392596a078b66cc91a7d52995886d9d2ef5eb1160e611ab54b00704e0cd7fdf1271871d56584ce06413b96e26d0396eb657cbbd5c12039d0130d52e31d1a7a186ca20878378c832655db9af8fc8e0672ca942d35fd13ee8803a7a747a502ff39ce8bbb6b054d78be49edb5a70f7c5c9a0edf3a6a7e3de78ac01b08a05198c6a4ccd6443ced8f4d9a65a23e67b09a93afe01c2e3f3d90581cf5138f931a3af8a15f27ce1a515a1a47f177392d6d3729bc62ce606793d202b89ff88531f035675680e405b49414971bf9f36528c1c44ed17ced9dee353c14465719a0391e3197d851df01ae8e36cb7918a26ca2eec0da555c4fa072f05a7ee59382e093a4edd2698645c04a17a3903ca9fdab62e033fec0f8653dd193b9050a78b0e1101b73ce2caf73a677373783d2a1ee3ce794055e0535ac1edc9eb133e043d16cb6f811f2d7cc855f098673920d0948c2f93a705eea762ca78afd8d4b47a5f4f5ec02b34d77defbbe7e854b50b26182dc05ba265fe3bde3fbd6a12f2aa9656d39361d93425789714323d74ffef6347a5ae3e44a6322d76e604bf759bee5f7a8023d55a2356fd9ed1041d584fed8c27697369a1be159c96722b21a92a6c4d9d17dac189b047538f099b1a3d1ef72882f0e09a767d622f371976cd4b95e6357c2c7b97499b81f04607c9fe72a0bd13f1c899107531d4785b7 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C support.client.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language support.client.exe - Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "5KR1H3J8O1YVDH6P9AA6GMD3" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "7KWCR0B79840K9NWB4JM406P" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide dfsvc.exe Key deleted \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "RTRPGH02P65BRRCOX9JQTQ5Z" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components dfsvc.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e support.client.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\Blob = 030000000100000014000000ff8bfafa697459874fb9843b1efda5c91871a44c2000000001000000640700003082076030820548a00302010202100fc890218ebc1b3c4b8521f655979371300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303731333030303030305a170d3235303731323233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100da5d7b6eb44d5d8c63f7c47c18a1bf98759158e061191810be4001b75443bd96e1de68459fd72f7fe20abcdab9d10541d5b333a191c8694e70eadeb590a46fbacc4bf1e580e3d49900107f31a44bb0761c26e95f32d3d2076fc1ce1550fcc9b80d3a9e126cf948f5d78907f82795bd1c5437f87f582a9cfa3c9adfb079d3af1b267a35c2fed12b99aa072db1a974d8b3704831f91c07c343f8bdfe52a88a5a9ba1ce87a957eed596ea5af8dc2821f8970898355d467621f188cda371cbf194625ac45e7682afc4a7687dfdf58fa12f67da9f8868f8f1bbafaa5455922fce755cceeee2c4caa8c74350420396f445e5b8e2340ddca227ce4846a787150ff50b982a02fac5722e2630da9e7f4f11f61d46c4a3a741834de00ba96fe8d0eec53b8d7332fc8567d59dae58c9da2b4cd394391f1a35c075ce76e4f58118f42cffd0f9d097d86e6e40e7174583b89ea38de2885b9aeed147efa57ddc17ad421b2c9323575a9e0194576825aed3b586a072b2f4dc6194a5566976865079ac988b1c0cadfd10851be62b1f79cad6a937f874eab8cb3651e29e862d5cafe9d1b42a83f335d2aba6ec4ef9d9aa115a069c24916d645de415844dc365c616628665ba45d57e5a4e9ac0a5b414e8833ed77e4591647937e6f496d5cb708e29e3ca60ed81d594c9954186e08e7dbf3555f0a0a4e56625b4dfdc46577d88321b4719cc21b0a7ad0203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414294f9bff00edb7d66b2218307d77a83f5c2b0d85300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201004e334e35453d2ec365082bd7e988392596a078b66cc91a7d52995886d9d2ef5eb1160e611ab54b00704e0cd7fdf1271871d56584ce06413b96e26d0396eb657cbbd5c12039d0130d52e31d1a7a186ca20878378c832655db9af8fc8e0672ca942d35fd13ee8803a7a747a502ff39ce8bbb6b054d78be49edb5a70f7c5c9a0edf3a6a7e3de78ac01b08a05198c6a4ccd6443ced8f4d9a65a23e67b09a93afe01c2e3f3d90581cf5138f931a3af8a15f27ce1a515a1a47f177392d6d3729bc62ce606793d202b89ff88531f035675680e405b49414971bf9f36528c1c44ed17ced9dee353c14465719a0391e3197d851df01ae8e36cb7918a26ca2eec0da555c4fa072f05a7ee59382e093a4edd2698645c04a17a3903ca9fdab62e033fec0f8653dd193b9050a78b0e1101b73ce2caf73a677373783d2a1ee3ce794055e0535ac1edc9eb133e043d16cb6f811f2d7cc855f098673920d0948c2f93a705eea762ca78afd8d4b47a5f4f5ec02b34d77defbbe7e854b50b26182dc05ba265fe3bde3fbd6a12f2aa9656d39361d93425789714323d74ffef6347a5ae3e44a6322d76e604bf759bee5f7a8023d55a2356fd9ed1041d584fed8c27697369a1be159c96722b21a92a6c4d9d17dac189b047538f099b1a3d1ef72882f0e09a767d622f371976cd4b95e6357c2c7b97499b81f04607c9fe72a0bd13f1c899107531d4785b7 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C support.client.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2796 dfsvc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2796 1368 support.client.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\support.client.exe"C:\Users\Admin\AppData\Local\Temp\support.client.exe"1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2796
-