Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/06/2026, 16:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
support.client.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
support.client.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target support.client.exe
- Size 83KB
- Sample260623-vc31laew3v
- SHA256 0128796cc2b8849ba974e79ee44de0a8761550082e8c7ef920690e9b5c3dc99c
- MD5 aba7b8104bf632cc981fa45dfaa4deca
- SHA1 5fff4425a71e724195071545de4e08bdc3941a5a
- SHA512 163708f641654c699340c5b5619a695540e467faff9534bcc5d34e685e56e1356b53266bd2df5f9453913ca510d5c4f8d0bace43540b6b7e9792aa6b3db8038d
- SSDEEP 1536:VXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWeuHi6:lE3x5KBDYiKWm/iSw0fRMvyge4
- TLSH T1DB837C43B5D19871E9721D3118B1C9A15E3FB9211E348EBB239802AE5F741D0AE35F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 6 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03A5B14663EB12023091B84A6D6A68BC871DE66B\Blob = 03000000010000001400000003a5b14663eb12023091b84a6d6a68bc871de66b20000000010000009d0400003082049930820381a003020102020f1688f039255e638e69143907e6330b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3135313233313030303030305a170d3139303730393138343033365a308184310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312a302806035504031321434f4d4f444f205348412d312054696d65205374616d70696e67205369676e657230820122300d06092a864886f70d01010105000382010f003082010a0282010100e9e93ddfd73708c91e38b25253426d22f1b1c406046b9efd827450437dc6a0bb1f4ef9027126b1ef43d8838c48fce70f977a9aeb9cdea6a30e3b1c4418758e78a51769fe4918a4e2bb5c4efe8e2a547a50f0d5f6cc91e79979d7de7994d79633fe0e83be22bf63162ca3dd281baf3dabea97d2f1bf0410e73d4845fd1f6865c17f599969c022310c626ea75c650121b063c4221827eee6fcd2003d472ea8b886565d04dc1317256e1cdf440f15cdb7dba55776426f00688299d2e3c1def08b94574cec08902221ce222b980c42e64293949893effd06d93fbc5b9b543c20b1ee6ad6477ac5ab80e9309adef1a43f554d0a09348a7529d269ad970f50bff8ca090203010001a381f43081f1301f0603551d23041830168014daed6474149c143cabdd99a9bd5b284d8b3cc9d8301d0603551d0e041604148e6b2d336bf433a793b3139aa5e00af712356a88300e0603551d0f0101ff0404030206c0300c0603551d130101ff0402300030160603551d250101ff040c300a06082b0601050507030830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010505000382010100ba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6 support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A41A37D0270D8433C3CD0220248AD84A5A6A1A26\Blob = 030000000100000014000000a41a37d0270d8433c3cd0220248ad84a5a6a1a26200000000100000078050000308205743082045ca003020102021004a03dbce32c5a34420a419fb740aa1a300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3136303230323030303030305a170d3139303230313233353935395a3081b7310b3009060355040613025553310e300c06035504110c0533333633343110300e06035504080c07466c6f72696461310e300c06035504070c0554616d70613124302206035504090c1b343131302047656f72676520526f61642c20537569746520323030310e300c06035504120c053333363334311f301d060355040a0c1653637265656e436f6e6e65637420536f667477617265311f301d06035504030c1653637265656e436f6e6e65637420536f66747761726530820122300d06092a864886f70d01010105000382010f003082010a0282010100ef53c03e3946aad66d87a2a761dd3f45401caf1ffa02df7f15d94dc61b6a7873d2671714d6c382d635025045ffb484bc2a50ebee0053c614226009d186cbdfb1f4ac68ff6648734c6deeb8dd82842ba107519322fd8d2a2767d1e370053ce48ea776b6bc137cc903a30dafff6e63c58cdc7fe40c832d16474f96631cb88141223a4cb6541e33675296fa57637f295553fb34409a00408613052e54935b092cbb303b1bec674753d044c9d2e260f6a1cd4eb4e176e0cb09fc271b79a0872df10746c8522969d8e30ed3a4bda84876713faa1534f00caee19b514ca24b5835742a636a281f82d8d2bf307bfb325ac1c087751dea457befec4f60847871122067cf0203010001a38201b3308201af301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e04160414dbab147ed014c81e0b99b50dec9abfc46911e7eb300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30240603551d11041d301b81196a6d6f7267616e4073637265656e636f6e6e6563742e636f6d300d06092a864886f70d01010b05000382010100501d24454fc8f1494e7d2858f99bf3d1532953cdd01c2868cfd790bf19100f9ad202ef66ee3dbb8db48912f6b127f549b1cca2e125897352f83cd72d4ad95566cc911a1becfc64b0199760970f06c28fc99352206e21e9a7bfe58a9c5ce29fe51bfed0e9b8262ca6bcac3cf0151b5cd5400391169a22a95fc747587c48fb70d7df0410c27d68dbce05bc9a0c6af54361f7a5879a4d11bf8d8826e58bdd9526706ec1044745a53a2d3af4aba2082964213659d372a28dd13cd37d5ba766410f33d04333257ff70db9fb4514859b335b5c4e9b932c2df3f7894b961f5c01cbc94e531290bd572e56b749fda0b4a78e4a22611e9942f4e776389e1a1fa76638cfb6 support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47\Blob = 030000000100000014000000b69e752bbe88b4458200a7c0f4f5b3cce6f35b472000000001000000e4050000308205e0308203c8a00302010202102e7c87cc0e934a52fe94fd1cb7cd34af300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3133303530393030303030305a170d3238303530383233353935395a307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a69890637791347f8ad1dde9673111ebcc1efd311db3b962573f93bc5be39f1e243211276bbc5191a7cf9e9e25b35f81a8180f1d1e20300efb617b8609b3e3fda2689d1c2c9dbf72e3e475a0e535238ec98aee1a0c64c7d842a17bb552034b3ab08e234b4b63e02294377bd579900a1418512ce6fec112f01c3f61610a8ca2dcf6c330aacd28187548c1795a08cdbb8c558cf7d476903a33465073985cf4854a6b0f80dd5ed6bdfda92fc025f5f978d78d5f10c244553c903c3146cb70ae07a90ae3afc1016f901a23e25f38dbc6085d47b38341f02e003714b912aa799252cd870f7bd86229a47e30bd1bb58c72b448f2e3e821f95e4c62798b02069f7fd50b0203010001a38201513082014d301f0603551d23041830168014bbaf7e023dfaa6f13c848eadee3898ecd93232d4301d0603551d0e04160414299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff02010030130603551d25040c300a06082b0601050507030330110603551d20040a300830060604551d2000304c0603551d1f044530433041a03fa03d863b687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f52534143657274696669636174696f6e417574686f726974792e63726c307106082b0601050507010104653063303b06082b06010505073002862f687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341416464547275737443412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382020100023f0239c3eef8ca3b89de0c6d4db1f14e924fafc2382c04ccc56311ab0963afaba2d7023fcc6f19c33dd61a0894ff25d8a988a72b101ae09bb107221a511c3ad4e1e909bfe62474af1e7b16316e23ef54512d5202e27508054cf1b751e15100c687f66cee104476576af1df586b21aa49d47c374ebdffb67554401836576711cd4f02e4fef3dafc7517dbecb7f7650923491f435783ea7e207761c84df2bb654da8f7854507af7a6927659029408bdf7b3a51398ca81f7079ad6d4220a2cf0c6c038c4ccd730794e75a8e3a04baa2a17c1fcb633a15a7d4151ba7524732a9f4bf6447d1aa1f534e323073c26fb778829d5cff46bb6b221d880bf81baa34a6fc8cf5dd7f658c8c315731d036ec47a1cfcb8ba8ef1c1858c50677ca4b9b51af4c084a7a8fe2a352e28e8ecc26e4b2d8e538c2a8edc6819c356ba958614a0a97b44b42b6559dbe99e7706d59f86d2a0c7f19605f0c9a886c30ac520990161bff2b9ddbd020ca89ea287e328e19df7b48331ed765f8aec9f8831493767d64d08ecebe357dff72314d9f9ebd1e6c2fa88f0c0650fb8c27b376c9f4e6d7c334e28c87218661febf5574e12177030a686cbbe4c9a9e6cf5925eb7cec450e796668e822cdb8ef98854d96113c098ad07fbc282813fb6aca548d925ccdc26598069ece485bd4b5379346417c07ddcffa43efba6761ff7d49e0bb307d5c80e3e616394ba7 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03A5B14663EB12023091B84A6D6A68BC871DE66B support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A41A37D0270D8433C3CD0220248AD84A5A6A1A26 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47 support.client.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language support.client.exe - Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows dfsvc.exe Key deleted \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "CGL3W4QNXRPQAY778J40X05O" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "91EAWJK6LAD2HWVW1QMLETL0" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "6RELDRTEM3BTM8EK8AREKVK7" dfsvc.exe - Modifies system certificate store 2 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03A5B14663EB12023091B84A6D6A68BC871DE66B support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03A5B14663EB12023091B84A6D6A68BC871DE66B\Blob = 03000000010000001400000003a5b14663eb12023091b84a6d6a68bc871de66b20000000010000009d0400003082049930820381a003020102020f1688f039255e638e69143907e6330b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3135313233313030303030305a170d3139303730393138343033365a308184310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312a302806035504031321434f4d4f444f205348412d312054696d65205374616d70696e67205369676e657230820122300d06092a864886f70d01010105000382010f003082010a0282010100e9e93ddfd73708c91e38b25253426d22f1b1c406046b9efd827450437dc6a0bb1f4ef9027126b1ef43d8838c48fce70f977a9aeb9cdea6a30e3b1c4418758e78a51769fe4918a4e2bb5c4efe8e2a547a50f0d5f6cc91e79979d7de7994d79633fe0e83be22bf63162ca3dd281baf3dabea97d2f1bf0410e73d4845fd1f6865c17f599969c022310c626ea75c650121b063c4221827eee6fcd2003d472ea8b886565d04dc1317256e1cdf440f15cdb7dba55776426f00688299d2e3c1def08b94574cec08902221ce222b980c42e64293949893effd06d93fbc5b9b543c20b1ee6ad6477ac5ab80e9309adef1a43f554d0a09348a7529d269ad970f50bff8ca090203010001a381f43081f1301f0603551d23041830168014daed6474149c143cabdd99a9bd5b284d8b3cc9d8301d0603551d0e041604148e6b2d336bf433a793b3139aa5e00af712356a88300e0603551d0f0101ff0404030206c0300c0603551d130101ff0402300030160603551d250101ff040c300a06082b0601050507030830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010505000382010100ba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6 support.client.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A41A37D0270D8433C3CD0220248AD84A5A6A1A26 support.client.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47 support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47\Blob = 030000000100000014000000b69e752bbe88b4458200a7c0f4f5b3cce6f35b472000000001000000e4050000308205e0308203c8a00302010202102e7c87cc0e934a52fe94fd1cb7cd34af300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3133303530393030303030305a170d3238303530383233353935395a307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a69890637791347f8ad1dde9673111ebcc1efd311db3b962573f93bc5be39f1e243211276bbc5191a7cf9e9e25b35f81a8180f1d1e20300efb617b8609b3e3fda2689d1c2c9dbf72e3e475a0e535238ec98aee1a0c64c7d842a17bb552034b3ab08e234b4b63e02294377bd579900a1418512ce6fec112f01c3f61610a8ca2dcf6c330aacd28187548c1795a08cdbb8c558cf7d476903a33465073985cf4854a6b0f80dd5ed6bdfda92fc025f5f978d78d5f10c244553c903c3146cb70ae07a90ae3afc1016f901a23e25f38dbc6085d47b38341f02e003714b912aa799252cd870f7bd86229a47e30bd1bb58c72b448f2e3e821f95e4c62798b02069f7fd50b0203010001a38201513082014d301f0603551d23041830168014bbaf7e023dfaa6f13c848eadee3898ecd93232d4301d0603551d0e04160414299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff02010030130603551d25040c300a06082b0601050507030330110603551d20040a300830060604551d2000304c0603551d1f044530433041a03fa03d863b687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f52534143657274696669636174696f6e417574686f726974792e63726c307106082b0601050507010104653063303b06082b06010505073002862f687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341416464547275737443412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382020100023f0239c3eef8ca3b89de0c6d4db1f14e924fafc2382c04ccc56311ab0963afaba2d7023fcc6f19c33dd61a0894ff25d8a988a72b101ae09bb107221a511c3ad4e1e909bfe62474af1e7b16316e23ef54512d5202e27508054cf1b751e15100c687f66cee104476576af1df586b21aa49d47c374ebdffb67554401836576711cd4f02e4fef3dafc7517dbecb7f7650923491f435783ea7e207761c84df2bb654da8f7854507af7a6927659029408bdf7b3a51398ca81f7079ad6d4220a2cf0c6c038c4ccd730794e75a8e3a04baa2a17c1fcb633a15a7d4151ba7524732a9f4bf6447d1aa1f534e323073c26fb778829d5cff46bb6b221d880bf81baa34a6fc8cf5dd7f658c8c315731d036ec47a1cfcb8ba8ef1c1858c50677ca4b9b51af4c084a7a8fe2a352e28e8ecc26e4b2d8e538c2a8edc6819c356ba958614a0a97b44b42b6559dbe99e7706d59f86d2a0c7f19605f0c9a886c30ac520990161bff2b9ddbd020ca89ea287e328e19df7b48331ed765f8aec9f8831493767d64d08ecebe357dff72314d9f9ebd1e6c2fa88f0c0650fb8c27b376c9f4e6d7c334e28c87218661febf5574e12177030a686cbbe4c9a9e6cf5925eb7cec450e796668e822cdb8ef98854d96113c098ad07fbc282813fb6aca548d925ccdc26598069ece485bd4b5379346417c07ddcffa43efba6761ff7d49e0bb307d5c80e3e616394ba7 support.client.exe Set value (data) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A41A37D0270D8433C3CD0220248AD84A5A6A1A26\Blob = 030000000100000014000000a41a37d0270d8433c3cd0220248ad84a5a6a1a26200000000100000078050000308205743082045ca003020102021004a03dbce32c5a34420a419fb740aa1a300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3136303230323030303030305a170d3139303230313233353935395a3081b7310b3009060355040613025553310e300c06035504110c0533333633343110300e06035504080c07466c6f72696461310e300c06035504070c0554616d70613124302206035504090c1b343131302047656f72676520526f61642c20537569746520323030310e300c06035504120c053333363334311f301d060355040a0c1653637265656e436f6e6e65637420536f667477617265311f301d06035504030c1653637265656e436f6e6e65637420536f66747761726530820122300d06092a864886f70d01010105000382010f003082010a0282010100ef53c03e3946aad66d87a2a761dd3f45401caf1ffa02df7f15d94dc61b6a7873d2671714d6c382d635025045ffb484bc2a50ebee0053c614226009d186cbdfb1f4ac68ff6648734c6deeb8dd82842ba107519322fd8d2a2767d1e370053ce48ea776b6bc137cc903a30dafff6e63c58cdc7fe40c832d16474f96631cb88141223a4cb6541e33675296fa57637f295553fb34409a00408613052e54935b092cbb303b1bec674753d044c9d2e260f6a1cd4eb4e176e0cb09fc271b79a0872df10746c8522969d8e30ed3a4bda84876713faa1534f00caee19b514ca24b5835742a636a281f82d8d2bf307bfb325ac1c087751dea457befec4f60847871122067cf0203010001a38201b3308201af301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e04160414dbab147ed014c81e0b99b50dec9abfc46911e7eb300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30240603551d11041d301b81196a6d6f7267616e4073637265656e636f6e6e6563742e636f6d300d06092a864886f70d01010b05000382010100501d24454fc8f1494e7d2858f99bf3d1532953cdd01c2868cfd790bf19100f9ad202ef66ee3dbb8db48912f6b127f549b1cca2e125897352f83cd72d4ad95566cc911a1becfc64b0199760970f06c28fc99352206e21e9a7bfe58a9c5ce29fe51bfed0e9b8262ca6bcac3cf0151b5cd5400391169a22a95fc747587c48fb70d7df0410c27d68dbce05bc9a0c6af54361f7a5879a4d11bf8d8826e58bdd9526706ec1044745a53a2d3af4aba2082964213659d372a28dd13cd37d5ba766410f33d04333257ff70db9fb4514859b335b5c4e9b932c2df3f7894b961f5c01cbc94e531290bd572e56b749fda0b4a78e4a22611e9942f4e776389e1a1fa76638cfb6 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03A5B14663EB12023091B84A6D6A68BC871DE66B support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A41A37D0270D8433C3CD0220248AD84A5A6A1A26 support.client.exe Key deleted \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47 support.client.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5080 dfsvc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1392 wrote to memory of 5080 1392 support.client.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\support.client.exe"C:\Users\Admin\AppData\Local\Temp\support.client.exe"1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5080
-