75a6455b0c7a5cbadfde645bd70bed91656c831ae0b0539dda362bc9c36f273f

General

Target
wayglass.exe
Size 9.6MB
Sample261024-mg2dkahs9w
SHA256 75a6455b0c7a5cbadfde645bd70bed91656c831ae0b0539dda362bc9c36f273f
MD5 29836ca7eebc037cb1b056642b21987f
SHA1 c1db517fc5995d600cb01866c94d8f74742aab02
SHA512 84c2df6587e2530e661f8a6c9b65bd0c0295802c92915ef7785bce50a4cf0f0a8a28f3507b5241a89de3093854e198f95fdff6188d0d7c8b59dd3a09007a0745
SSDEEP 49152:TwDqDBlApVnwFxUpr/Mbf1eBl3vqtj8p416M7K7k+Gh2MyXq1e3tXfZSKJr7/AtY:TwWNiTdF388mz+pXtLZRPE
TLSH
T188A64947ECA554E8C1ADC5358A7296237B627C485B3123D32BA0B7253F77BD0AEB9310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	wayglass.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	wayglass.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wayglass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wayglass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wayglass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wayglass.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	wayglass.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5752 wrote to memory of 3568	5752	cmd.exe	94
PID 5752 wrote to memory of 3292	5752	cmd.exe	95
PID 5752 wrote to memory of 1880	5752	cmd.exe	96
PID 5752 wrote to memory of 1580	5752	cmd.exe	97
PID 5752 wrote to memory of 3756	5752	cmd.exe	98
PID 5752 wrote to memory of 4692	5752	cmd.exe	99
PID 5752 wrote to memory of 4644	5752	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\wayglass.exe
"C:\Users\Admin\AppData\Local\Temp\wayglass.exe"
1⤵
PID:4296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Users\Admin\AppData\Local\Temp\wayglass.exe
  wayglass.exe install -code 12345-67890
  2⤵
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\wayglass.exe
  wayglass.exe
  2⤵
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\wayglass.exe
  wayglass.exe status
  2⤵
  PID:1880
- C:\Users\Admin\AppData\Local\Temp\wayglass.exe
  wayglass.exe log
  2⤵
  PID:1580
- C:\Users\Admin\AppData\Local\Temp\wayglass.exe
  wayglass.exe version
  2⤵
  PID:3756
- C:\Users\Admin\AppData\Local\Temp\wayglass.exe
  wayglass.exe install -agent
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\wayglass.exe
  wayglass.exe diag-recipient
  2⤵
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wayglass.log

Path C:\Users\Admin\AppData\Local\Wayglass\Logs\wayglass.log
Size 2KB
SHA256 0656f655866d139c0c0e01dd5109bf16b18e26d0fe82153d4c56ea7bc7933f32
MD5 91cdd89db8951b844cfa2f3654c1ace3
SHA1 ad2ea1c270fc8628493d5da63837beb1348ff29e
SHA512 8146a7d708e471e7a48d9cbb0c0e8da2bec0490df002c9b501fbad3b4b2f9b6ad6d06784827fbcd461d5cc902d61e8bb6781611bf17e2886e256dde2af67b559
TLSH
T11241CC191239E47EAB094367C34E68D8377972A352C0C6FDD76AAF7C841D33A511D88A
MD5 SHA1 SHA512 TLSH

Submit Download

wayglass.log

Path C:\Users\Admin\AppData\Local\Wayglass\Logs\wayglass.log
Size 2KB
SHA256 675e9621b902e7902b98e203a9ed75680d515f63ca49c0bd260bf412026a8f6d
MD5 60b0e590ce0ecb6f7b6868b18212df21
SHA1 7cc5fba22c01fbba1443f1ffce312acfb33201ed
SHA512 cbf5f9e437c942ea397b9202d28d77f4b66fa40f3f9265cc429deb9315de48227888126624bef59e0ba900f8eaca744ff73878040bebe8ce5020b5b5cc84aaec
TLSH
T15041DC191139E47EAB09436BC34E68D8377972A392C0C6FDD76AAF7C441D33A511E88B
MD5 SHA1 SHA512 TLSH

Submit Download

wayglass.log

Path C:\Users\Admin\AppData\Local\Wayglass\Logs\wayglass.log
Size 3KB
SHA256 f246752edaa518ff9882dd5026777c99cd63322cd768062292cb452772e8d60f
MD5 74599f7fcf480ec13446fa7d7668b9ba
SHA1 3ae231e65fb373d28cd2775f746154c3254aa26c
SHA512 ac9508c78b5167614dbf80bc4b11cf0535688fa03dfefee1ce12608ccc816fc3526901d15683b405b178f6971fbac31b911d614cf55004d1620716e0bb4fd45c
TLSH
T1A271DE195529E47EAB08436BC34E28E83779729352C0C2FDD7AAEF7C441D33A611E84A
MD5 SHA1 SHA512 TLSH

Submit Download

wayglass.log

Path C:\Users\Admin\AppData\Local\Wayglass\Logs\wayglass.log
Size 1KB
SHA256 204a8885b5669529fed71ad53add6746b43fd6ede5c42ff80c8d4dfc4e08bd97
MD5 b4b907ae6a3ee88e83b55e0ae487e5d8
SHA1 22dfdc0ed9c4ddc3701a2951953750ed2754741f
SHA512 009e7fad08d95e418f063aa7d28e8ad9b65b38b3f25cebceb7912abc5fcd8bedd2e2a9a9f6a835a8b52ea78b0d4b0248f373434b78cc90e7940c382c2dcf46e9
TLSH
T140219D185636D47EBF08436BC74E58E477787293918082F9D76AEF2C804E33E522E85B
MD5 SHA1 SHA512 TLSH

Submit Download

wayglass.log

Path C:\Users\Admin\AppData\Local\Wayglass\Logs\wayglass.log
Size 1KB
SHA256 9524648786dd11636b053bb50ed0cc64eb08045dc30d07de35dfd185018e179f
MD5 43acdf8cbafc935059e41d5f1f23bbc4
SHA1 65d6969db43ed6a9ff04cf4e875f2f49ff4080de
SHA512 79c5b7d31aee1857374b74e93d3dfbfa1186a7ed84a4ae4087587a7b82b4febd0ec450e514fd2b668a68665573650f65d7c95d537f778e1c5611ff87a5151488
TLSH
T1D531CB18563AD47EAB09436BC30E18E83778729352C086FDD76AAF2C841D33A512E84B
MD5 SHA1 SHA512 TLSH

Submit Download

client-id

Path C:\Users\Admin\AppData\Roaming\Wayglass\client-id
Size 37B
SHA256 9ea1fb862be702aa4302fdd13268e3134875b82d188e7bf6f01ae5e111f5b530
MD5 09cc984c7027cf62f22a475ce9e4c944
SHA1 661d8907a8c5db6afee873a17bba5b09ec23067e
SHA512 113abfdd672d1548ec6d76fa9251cf978daebdb86eacb5be9645a483bbd0244ae0cba7e9b8d5d25a2a402a6ed0c12a0c3df14e92764cb950b50a65da8043fc7a
MD5 SHA1 SHA512

Submit Download

268d8b4e-6b65-4b68-bfb5-502ecfdeca15.json

Path C:\Users\Admin\AppData\Roaming\Wayglass\reports\268d8b4e-6b65-4b68-bfb5-502ecfdeca15.json
Size 1KB
SHA256 6df91c1e54f0379556d4c82841ac444e37ef518827b63905c18b25d41e47612a
MD5 9952ebcbbcfd5d5d1997de5b93247d36
SHA1 d5d1e0a756bcd64cc93b5f4a3604b63c0e0e7c48
SHA512 1019ce8de42f77073e91a43bcb01ab2d075a6594182433d69666e7b304080ac1f94a95472903388dd40b9dd9c8eddc5fca9e104622f556cd4002f1347990d963
TLSH
T14221D2144725D87D7E4C4B9FC64E28F467B8712AA354C1BDA76ECF58004E33E221E557
MD5 SHA1 SHA512 TLSH

Submit Download

3776da4b-5834-470a-b2d8-45461020b0e4.json

Path C:\Users\Admin\AppData\Roaming\Wayglass\reports\3776da4b-5834-470a-b2d8-45461020b0e4.json
Size 1KB
SHA256 ac23b2c3a8afc450a03583c3ebf1022d1a213d031068ab2bb53798a78899f753
MD5 691e9dcd5a3c357e92657c9dbae9344e
SHA1 3721d8f08cd7007f6e2e451c9223d8889f6f6d0e
SHA512 f1cc2185554dc2e56f0c47fccaa1c02553cc8339b9a125861403757f56313b6966ff5ded7c59916d3b282cefc1b678fef07fd4805e35eb26b1520ee1632ac34a
TLSH
T1B021AE14572A947EBE0C4B9BC64F28A067793256925482FD966E9F18404E23E221E867
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads