Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 12:24
Behavioral task
behavioral1
Sample
support.client.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
support.client.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target support.client.exe
- Size 306KB
- Sample260505-plcbcafy7x
- SHA256 582a4bf0759f88a4c8a45143e7df2acb9ebe8bfe647fd7f754699f9db9d3f354
- MD5 0eee2f58e295129000e0ffbdf7ebf299
- SHA1 bb6fbe8e77031762481e7ce2a6ed7d371f80389a
- SHA512 445b1eda1054416a43bdcc992106b19dbfd0419b356f01e8ec594e40f31875aea57bf005195b1535e23cb5bb82881492c8a6ef5776bac4099357ccb94674b8a7
- SSDEEP 6144:gmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9S:r1iw7gryNkSV1hy1Z1u2JLI9S
- TLSH T111646C11B9C48432C673383107B9E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 6 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A937510DB52D325C764357DE3F0FB332E9CAAA72\Blob = 030000000100000014000000a937510db52d325c764357de3f0fb332e9caaa7220000000010000009a060000308206963082047ea00302010202100adb378e581d07f476045921b8b8ff54300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3232303331373030303030305a170d3337303331363233353935395a304f310b30090603550406130241553110300e060355040a13075665726f6b6579312e302c060355040313255665726f6b65792048696768204173737572616e63652053656375726520436f646520455630820222300d06092a864886f70d01010105000382020f003082020a0282020100bec4da95d0945a8ce7edab266625ca153461b5f177b8fef7eed1899e5f7434260d6de761d48ec04adaca01292e68c7f84209ccb2651b132d5687eebe041d3dbd48bb6de7b82848d5842b51a94862db911fec0d591a16bc1c6794fbe3a7258a52cc109b1340d8dcd86a36a0e102bdefa489b7b1899d665c27e78c8d473848aa4d9f92b83e99406a6369a8ee363407854a797195bfc0ccf848c624f04f1040a4a99cdd13c7d7e2fb5c555ccfcf094050bdd10b6385cae27d2508c735e942ea868076864a2ef64d450e7e5747093560f8ad5e15001b99691358a00837ed3ac921991dd80f81b75be2432c7310f5395b69cb0030aebf9c54479d17b9a975e9ebe9fa9604fa2b2375c9d0c7f16314bf4ad6d7c99e2b2c6149d93b791dcb14a6d895823702542d16edbd8b1d411c671ec31e41574c31df15d981b8e434565cd9641ad8b6c16dd5fa5cee0a68b39927366a46a1d0309132f895d794a749bc317effcd66e131500fa08a00b92be464f117994b89ee00e03c8e4794fa9db0cdb9a74d733813015b45e72b5b6dbf9e9c5f40982bec8aed61a84b82e55ca1a9f5286072ef059938d60112b64ca63b2c5d56e587092e2d45eec5afde53dfa38de474f658132e020979eed4cd6f41a3227001737914741820972e2aa0745032a33ac3be4be72dda471d5ab5ff694a4a8958ce96d0b29b17031b5409aea9046b81712cac60f2310203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e0416041436f397560fb55c8e9fa35afc42c54475de5bca89301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201001a2ce7902322ee3862be175a1edb260abd1f9692e2b3c641c961ad8ec0b211f58245eb6785e5dd66a60f7a902d3dfba98fb3ada5bccda13cba63bffb52de47ebb18a1f86505ac834de4decfc71045ddf8e31a59a84c1708a066d2c221a831c326d6188d718b7ee16a9915fd338d1b6a875ae99f8a3a2dc80d7a2f2742104861c3edca0f37990b5cbb78dbb3e5cc0c7e8276e98fecfc4d939f27004679b50e4853efce08a29da66d9d549ea248273f390762dc3562286218e40ef75220b8ea73d4bce6c3a5ec616d321a92ce23e99985b96ef86a26eb4dea6891072299727ecec49ed2110bb4f59b7e4a31c22d071483e024c29d21fcd203de7496f55ec61bd15dff805f5bf22345864c68019ad1edc2c084371804dfa5f0a0bc0207d5ce5f123463e925adaba71e2709833613754bd18cb90ee0ec4676a88ef0b49c17dbfea9fb32cb28adfa220b2d0401effa3e2dc236f54e81ea6bff4b4e4326267b81ac77bd1951d19f21a864c9777b5e0225dda5f291ef5d2c8a2c3e493fb6237a34be357d20797ba730c856c7704bc9d6cad7cdfae2b10b092cb7df25e6b634249f44c1ea0ff89fdc753864d8deb357a28e27a3b1cb068b312a10e772692f5c779affe5971cef940776f0c4e54f325e61efaf2ca5add835d64278038c9f478b3b940ce27a11c5bb76b524c5aefded7c9977a7a88b698c4a10e585eedc50ada23fe02eaec support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A4177F522638026FEDE55003DFC5475F890DF43A\Blob = 030000000100000014000000a4177f522638026fede55003dfc5475f890df43a20000000010000007a070000308207763082055ea00302010202100126669732acec9b2fd03ae3c0c4f6d0300d06092a864886f70d01010b0500304f310b30090603550406130241553110300e060355040a13075665726f6b6579312e302c060355040313255665726f6b65792048696768204173737572616e63652053656375726520436f6465204556301e170d3235303831393030303030305a170d3236303831383233353935395a3081ca31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3111300f060355040513083130323639323432310b30090603550406130255533111300f0603550408130844656c6177617265310e300c06035504071305446f766572311a3018060355040a13114261626169616e2074656368204c4c432e311a3018060355040313114261626169616e2074656368204c4c432e30820222300d06092a864886f70d01010105000382020f003082020a0282020100a1f931387c7fe384fec6e714e32e9a46397bb65f008dd46306755c4d626e8fa3d42fb07eabd5695aa07a6daa90fc69e3578b456b60b2802360fc5c50c403eceaef08b9470b755f9f647080f4cd7b84d43f100739d5f31a2df9c25e63feb8d0cebf3b069aa01cb89dddb3fa40ade0b53e5c8f68a0f2395a18ba3ff2bc00e14b88830c9623e605439ef3b0388ab86579fb4b32d8a9734ca26abd6f58009223300609d3f797f3fe58441baeecf57074405a7b82ead98a5979537bc99496e3d38923e0f307ab729ac6f46935c51a1e0266268e31232c5a8e7df2fdceff500700bcacd4215b239bdbe0396d21efaeeec9d97607106e253b18478f3d0796329172e185a5a6786a84122f623940a8e0720a25099c8d3c26f8ea0c4731f7cfbebe9690792197b8d3d3a2f750ec1d9680a0cc0e419a77bcaeab528926a24fed56f5809703eb37620fb813f752e6cf2a314b44f8bdd93e9f941dbc6fd8e5deb83bad93ca3183431007019c566116d12f223525f8e0514350a1e9cd7523095e37ea84ed3520ccb32aee65434bc990ed47434f506720eba846f691105efb01de484c47c651480ea1935aef76de5597525cec7811cc0eef6d73e6b74d071b1f5fa517a9cc2b9ab6d0661d1b6ee9e40792e0bfede1915f78ad3d1438c9edcc91cfc1505fccb05a1afc135b56286c2665c9d79395ba5a72ee5f5b6a0530652f5ab093dacd170e630203010001a38201d0308201cc301f0603551d2304183016801436f397560fb55c8e9fa35afc42c54475de5bca89301d0603551d0e041604140eaf3cfb9ceebe1cebc185649e8a41fe0fdc1331303d0603551d20043630343032060567810c01033029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081950603551d1f04818d30818a3043a041a03f863d687474703a2f2f63726c332e64696769636572742e636f6d2f5665726f6b6579486967684173737572616e6365536563757265436f646545562e63726c3043a041a03f863d687474703a2f2f63726c342e64696769636572742e636f6d2f5665726f6b6579486967684173737572616e6365536563757265436f646545562e63726c30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f5665726f6b6579486967684173737572616e6365536563757265436f646545562e63727430090603551d1304023000300d06092a864886f70d01010b050003820201000766db3e25bc76c0195810a574bd07da180778ec656977b99015c1c7233efdba9e35de2ec68e444115611a659e21c481723ce8cae617062703081a8a82e3266872beb97529bddede87ae5de7f229526a3f03a753283e370d802adf1c66855637aff6c70b19e0134c70c005ba320b5db49635243247e8a246a669df583db0ec3b5a054ae6a8c8ff8946646029a2383bbe92f97ad0e4332875afd301d87c267fa4d9ce3600b2f9dab700625a33a45160730c58afe3bef6bd25325b11239a6ded612aaa581b4d006a71b2f4d8e7c940c75c6765fc2da5046f33b58bd8c5fe6fdf369be80a875f155c6387d49de549d4415928b19251d78bcaf967e43a83fc08c988d5c87519880f0d54b2dee983c6841fb63931c249e9a1b8137533656b362b2a5c283336fc869f57038f7a6257feeb1fd96899fff0004e53875faf29c7eac8781cfd917b1c149095fa97c3031eba838c62e6dc905b2c3801e232a821abb1bc745ec5f896c89a6ee9ce15822eff19a4d609b2c4b1f6162a8533e43e54d8b944f289f7c36c767e83c11c30ccbae5b5ae5c2a0f6c2c63251ed097f88a0516853d55ae8934a70617d6c73f31bf90023b3c1997bd74eb463ba9ce941e34c382afdf2d3ca0ef942bda615077ed6a5ae519683bc520255ce7616f2008c2cf323cfe5bb0a7557bf0ca2236fb0146643ca306d82496a10dd08b091ef3740e357489dc42cc02 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A937510DB52D325C764357DE3F0FB332E9CAAA72 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A4177F522638026FEDE55003DFC5475F890DF43A support.client.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language support.client.exe - Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "W9J609ZZOB60QHW5W30ZL5AZ" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "G4GJPK2BC0A1RKG9DR67E07B" dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "T8HHTB4JE794A6M3WB0CWY6X" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment dfsvc.exe Key deleted \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe - Modifies system certificate store 2 TTPs 9 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A937510DB52D325C764357DE3F0FB332E9CAAA72\Blob = 030000000100000014000000a937510db52d325c764357de3f0fb332e9caaa7220000000010000009a060000308206963082047ea00302010202100adb378e581d07f476045921b8b8ff54300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3232303331373030303030305a170d3337303331363233353935395a304f310b30090603550406130241553110300e060355040a13075665726f6b6579312e302c060355040313255665726f6b65792048696768204173737572616e63652053656375726520436f646520455630820222300d06092a864886f70d01010105000382020f003082020a0282020100bec4da95d0945a8ce7edab266625ca153461b5f177b8fef7eed1899e5f7434260d6de761d48ec04adaca01292e68c7f84209ccb2651b132d5687eebe041d3dbd48bb6de7b82848d5842b51a94862db911fec0d591a16bc1c6794fbe3a7258a52cc109b1340d8dcd86a36a0e102bdefa489b7b1899d665c27e78c8d473848aa4d9f92b83e99406a6369a8ee363407854a797195bfc0ccf848c624f04f1040a4a99cdd13c7d7e2fb5c555ccfcf094050bdd10b6385cae27d2508c735e942ea868076864a2ef64d450e7e5747093560f8ad5e15001b99691358a00837ed3ac921991dd80f81b75be2432c7310f5395b69cb0030aebf9c54479d17b9a975e9ebe9fa9604fa2b2375c9d0c7f16314bf4ad6d7c99e2b2c6149d93b791dcb14a6d895823702542d16edbd8b1d411c671ec31e41574c31df15d981b8e434565cd9641ad8b6c16dd5fa5cee0a68b39927366a46a1d0309132f895d794a749bc317effcd66e131500fa08a00b92be464f117994b89ee00e03c8e4794fa9db0cdb9a74d733813015b45e72b5b6dbf9e9c5f40982bec8aed61a84b82e55ca1a9f5286072ef059938d60112b64ca63b2c5d56e587092e2d45eec5afde53dfa38de474f658132e020979eed4cd6f41a3227001737914741820972e2aa0745032a33ac3be4be72dda471d5ab5ff694a4a8958ce96d0b29b17031b5409aea9046b81712cac60f2310203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e0416041436f397560fb55c8e9fa35afc42c54475de5bca89301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201001a2ce7902322ee3862be175a1edb260abd1f9692e2b3c641c961ad8ec0b211f58245eb6785e5dd66a60f7a902d3dfba98fb3ada5bccda13cba63bffb52de47ebb18a1f86505ac834de4decfc71045ddf8e31a59a84c1708a066d2c221a831c326d6188d718b7ee16a9915fd338d1b6a875ae99f8a3a2dc80d7a2f2742104861c3edca0f37990b5cbb78dbb3e5cc0c7e8276e98fecfc4d939f27004679b50e4853efce08a29da66d9d549ea248273f390762dc3562286218e40ef75220b8ea73d4bce6c3a5ec616d321a92ce23e99985b96ef86a26eb4dea6891072299727ecec49ed2110bb4f59b7e4a31c22d071483e024c29d21fcd203de7496f55ec61bd15dff805f5bf22345864c68019ad1edc2c084371804dfa5f0a0bc0207d5ce5f123463e925adaba71e2709833613754bd18cb90ee0ec4676a88ef0b49c17dbfea9fb32cb28adfa220b2d0401effa3e2dc236f54e81ea6bff4b4e4326267b81ac77bd1951d19f21a864c9777b5e0225dda5f291ef5d2c8a2c3e493fb6237a34be357d20797ba730c856c7704bc9d6cad7cdfae2b10b092cb7df25e6b634249f44c1ea0ff89fdc753864d8deb357a28e27a3b1cb068b312a10e772692f5c779affe5971cef940776f0c4e54f325e61efaf2ca5add835d64278038c9f478b3b940ce27a11c5bb76b524c5aefded7c9977a7a88b698c4a10e585eedc50ada23fe02eaec support.client.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A4177F522638026FEDE55003DFC5475F890DF43A support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A4177F522638026FEDE55003DFC5475F890DF43A\Blob = 030000000100000014000000a4177f522638026fede55003dfc5475f890df43a20000000010000007a070000308207763082055ea00302010202100126669732acec9b2fd03ae3c0c4f6d0300d06092a864886f70d01010b0500304f310b30090603550406130241553110300e060355040a13075665726f6b6579312e302c060355040313255665726f6b65792048696768204173737572616e63652053656375726520436f6465204556301e170d3235303831393030303030305a170d3236303831383233353935395a3081ca31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3111300f060355040513083130323639323432310b30090603550406130255533111300f0603550408130844656c6177617265310e300c06035504071305446f766572311a3018060355040a13114261626169616e2074656368204c4c432e311a3018060355040313114261626169616e2074656368204c4c432e30820222300d06092a864886f70d01010105000382020f003082020a0282020100a1f931387c7fe384fec6e714e32e9a46397bb65f008dd46306755c4d626e8fa3d42fb07eabd5695aa07a6daa90fc69e3578b456b60b2802360fc5c50c403eceaef08b9470b755f9f647080f4cd7b84d43f100739d5f31a2df9c25e63feb8d0cebf3b069aa01cb89dddb3fa40ade0b53e5c8f68a0f2395a18ba3ff2bc00e14b88830c9623e605439ef3b0388ab86579fb4b32d8a9734ca26abd6f58009223300609d3f797f3fe58441baeecf57074405a7b82ead98a5979537bc99496e3d38923e0f307ab729ac6f46935c51a1e0266268e31232c5a8e7df2fdceff500700bcacd4215b239bdbe0396d21efaeeec9d97607106e253b18478f3d0796329172e185a5a6786a84122f623940a8e0720a25099c8d3c26f8ea0c4731f7cfbebe9690792197b8d3d3a2f750ec1d9680a0cc0e419a77bcaeab528926a24fed56f5809703eb37620fb813f752e6cf2a314b44f8bdd93e9f941dbc6fd8e5deb83bad93ca3183431007019c566116d12f223525f8e0514350a1e9cd7523095e37ea84ed3520ccb32aee65434bc990ed47434f506720eba846f691105efb01de484c47c651480ea1935aef76de5597525cec7811cc0eef6d73e6b74d071b1f5fa517a9cc2b9ab6d0661d1b6ee9e40792e0bfede1915f78ad3d1438c9edcc91cfc1505fccb05a1afc135b56286c2665c9d79395ba5a72ee5f5b6a0530652f5ab093dacd170e630203010001a38201d0308201cc301f0603551d2304183016801436f397560fb55c8e9fa35afc42c54475de5bca89301d0603551d0e041604140eaf3cfb9ceebe1cebc185649e8a41fe0fdc1331303d0603551d20043630343032060567810c01033029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081950603551d1f04818d30818a3043a041a03f863d687474703a2f2f63726c332e64696769636572742e636f6d2f5665726f6b6579486967684173737572616e6365536563757265436f646545562e63726c3043a041a03f863d687474703a2f2f63726c342e64696769636572742e636f6d2f5665726f6b6579486967684173737572616e6365536563757265436f646545562e63726c30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f5665726f6b6579486967684173737572616e6365536563757265436f646545562e63727430090603551d1304023000300d06092a864886f70d01010b050003820201000766db3e25bc76c0195810a574bd07da180778ec656977b99015c1c7233efdba9e35de2ec68e444115611a659e21c481723ce8cae617062703081a8a82e3266872beb97529bddede87ae5de7f229526a3f03a753283e370d802adf1c66855637aff6c70b19e0134c70c005ba320b5db49635243247e8a246a669df583db0ec3b5a054ae6a8c8ff8946646029a2383bbe92f97ad0e4332875afd301d87c267fa4d9ce3600b2f9dab700625a33a45160730c58afe3bef6bd25325b11239a6ded612aaa581b4d006a71b2f4d8e7c940c75c6765fc2da5046f33b58bd8c5fe6fdf369be80a875f155c6387d49de549d4415928b19251d78bcaf967e43a83fc08c988d5c87519880f0d54b2dee983c6841fb63931c249e9a1b8137533656b362b2a5c283336fc869f57038f7a6257feeb1fd96899fff0004e53875faf29c7eac8781cfd917b1c149095fa97c3031eba838c62e6dc905b2c3801e232a821abb1bc745ec5f896c89a6ee9ce15822eff19a4d609b2c4b1f6162a8533e43e54d8b944f289f7c36c767e83c11c30ccbae5b5ae5c2a0f6c2c63251ed097f88a0516853d55ae8934a70617d6c73f31bf90023b3c1997bd74eb463ba9ce941e34c382afdf2d3ca0ef942bda615077ed6a5ae519683bc520255ce7616f2008c2cf323cfe5bb0a7557bf0ca2236fb0146643ca306d82496a10dd08b091ef3740e357489dc42cc02 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A937510DB52D325C764357DE3F0FB332E9CAAA72 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A4177F522638026FEDE55003DFC5475F890DF43A support.client.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 support.client.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A937510DB52D325C764357DE3F0FB332E9CAAA72 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 support.client.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2976 dfsvc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3328 wrote to memory of 2976 3328 support.client.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\support.client.exe"C:\Users\Admin\AppData\Local\Temp\support.client.exe"1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2976
-