c2183acf1c20a3ecf8ea6f543f0bb570a8ab5d32daa82c99d699fd4a93a6123a

Analysis

user interaction
yes
max time kernel
299s
max time network
281s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DocuSignReader6.7.exe
Size 423KB
Sample261113-tk35wsdw4j
SHA256 c2183acf1c20a3ecf8ea6f543f0bb570a8ab5d32daa82c99d699fd4a93a6123a
MD5 f8b436ead3c783de303d01e9e3ce2414
SHA1 2a3078a5d9e69c6f7e965179dd414be4606f40f4
SHA512 fc5bcdbea054e9882a851c1b6ae88e003f27516e90f423b4551946d54ed6565833f8f5ad18a33c9a1adbd2ebeebd5f1bde7339a662379d20e868c9a516ac0517
SSDEEP 6144:pKWNxA/glpCWJ9CC0ol022SLwFrwTnnYCb9x49q1JNhCZsi7ksvmacDMNiMutS:pVNx1loVy022SL+G9xxJa6i7BvmZDDM1
TLSH
T13494AE11FA40E436D26709316B5ED7694D7DBCB16F6146CBB3C01AEEA9306C0AB24F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avg\Av	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avg\Av	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop	NiniteAgent.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_9CE548EFBF60B12764E6ED043F831A4A	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\Desktop\desktop.ini	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_075790FA5C1E21C8ED5EFBA7913E8942	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_9A3287BB7CD9C0E504E9DCCE3E0377D8	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_9A3287BB7CD9C0E504E9DCCE3E0377D8	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_EA2C23EE3406CAE87155E7447F8BFEFA	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_EA2C23EE3406CAE87155E7447F8BFEFA	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\Desktop	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_9CE548EFBF60B12764E6ED043F831A4A	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_075790FA5C1E21C8ED5EFBA7913E8942	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	NiniteAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe.64ca9809-df7c-11f1-b5f1-5a77ea7a180e.tmp	DocuSignReader6.7.exe
File opened for modification	C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe.64ca9809-df7c-11f1-b5f1-5a77ea7a180e.tmp	DocuSignReader6.7.exe

Executes dropped EXE 6 IoCs

pid	Process
4508	NiniteAgent.exe
3596	NiniteAgent.exe
5312	NiniteAgent.exe
1008	NiniteAgent.exe
952	NiniteAgent.exe
4840	NiniteAgent.exe

Loads dropped DLL 7 IoCs

pid	Process
4756	DocuSignReader6.7.exe
3596	NiniteAgent.exe
3596	NiniteAgent.exe
5312	NiniteAgent.exe
1008	NiniteAgent.exe
952	NiniteAgent.exe
4840	NiniteAgent.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DocuSignReader6.7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DocuSignReader6.7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NiniteAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NiniteAgent.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DocuSignReader6.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	NiniteAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	NiniteAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	NiniteAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	NiniteAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	NiniteAgent.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	DocuSignReader6.7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	DocuSignReader6.7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	DocuSignReader6.7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	DocuSignReader6.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	NiniteAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	NiniteAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	NiniteAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	DocuSignReader6.7.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5312	NiniteAgent.exe
5312	NiniteAgent.exe
1008	NiniteAgent.exe
1008	NiniteAgent.exe
952	NiniteAgent.exe
952	NiniteAgent.exe
4840	NiniteAgent.exe
4840	NiniteAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeAssignPrimaryTokenPrivilege	5312	NiniteAgent.exe
Token: SeTcbPrivilege	5312	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeAssignPrimaryTokenPrivilege	1008	NiniteAgent.exe
Token: SeTcbPrivilege	1008	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe
Token: SeTcbPrivilege	3596	NiniteAgent.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3596	4508	NiniteAgent.exe	92
PID 3596 wrote to memory of 5312	3596	NiniteAgent.exe	97
PID 3596 wrote to memory of 1008	3596	NiniteAgent.exe	101
PID 3596 wrote to memory of 952	3596	NiniteAgent.exe	102
PID 3596 wrote to memory of 4840	3596	NiniteAgent.exe	103

C:\Users\Admin\AppData\Local\Temp\DocuSignReader6.7.exe
"C:\Users\Admin\AppData\Local\Temp\DocuSignReader6.7.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:4756

C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
"C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /stub:service /stub:subdomain remote /agent
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
  "C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /stub:child 4508 000001F8 "NiniteAgent" /stub:subdomain "remote" "/agent"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
    "C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 3596 00000A08 00000A1C /override 36cbaa2b650527acd2f06c5849c7de88a54a35d7 /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll" /audit /silent /nocache /data 6ad55a30-df7c-11f1-b5f1-5a77ea7a180e
    3⤵
    - Checks for any installed AV software in registry
    - Drops file in System32 directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
    "C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 3596 000005E0 00000A1C /override 36cbaa2b650527acd2f06c5849c7de88a54a35d7 /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll" /audit /silent /nocache /data 7d5cc41c-df7c-11f1-b5f1-5a77ea7a180e
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
- - C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
    "C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 3596 00000A24 00000A1C /override 36cbaa2b650527acd2f06c5849c7de88a54a35d7 /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll" /audit /silent /nocache /data e7155051-df7c-11f1-b5f1-5a77ea7a180e
    3⤵
    - Checks for any installed AV software in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- - C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
    "C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 3596 00000A24 00000A1C /override 36cbaa2b650527acd2f06c5849c7de88a54a35d7 /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll" /audit /silent /nocache /data fa6d44df-df7c-11f1-b5f1-5a77ea7a180e
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

8E55FEB142F566DFBD0ED964FAB94545

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E55FEB142F566DFBD0ED964FAB94545
Size 8KB
SHA256 0f2cd52a46c8d23d17680c5cf6d088c4d9d3b9650177a6acef042447109b49a9
MD5 ef742b46ba1e5b67c2c1bc9c60de08a0
SHA1 259f87376b46365c3488ed1d29b7856e650598a1
SHA512 b053c8076d75de5e7a37fab4c33167eaec9278c37cce6ee2536f818a18ca341c90fa8ea88590a05b112b1dda2f5d81874c1a7c65e52c9c563e743f2b4834988f
SSDEEP 192:EXtnCJolZe5V3IFfaTLHke1sXk3SPykBUMljvwFM:EXtblZe5V3gfaTLkSSUsjY2
TLSH
T1670253D1AFBD2CA4F689CFB200CD9A2F677375DA76031A4056F85A90E9067C11F3D424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B0B1E3C3B1330A269DBEE4BA6313E7B4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4
Size 1KB
SHA256 dd12c5733bc4b682e1da6353c8c27650f53d11a8ada8fd8a2d06f23cecae5ebd
MD5 2ffbdb98df2a2b022a48adeb94a3af50
SHA1 6c86923b5c5832bb102f041cb7d38db397074f12
SHA512 a5f29661ac78ea205dd945fcc53e015152277426af4bcce688231ca1a564dc49144b2953409651737733fec72e9042468c780917543c007d7de74ed44058dbfb
TLSH
T1073145968E7D3C55E3139DB0C6CFED6B9E30E4C617C1AC2A523896805581FC24EF4494
MD5 SHA1 SHA512 TLSH

Submit Download

64ca9808-df7c-11f1-b5f1-5a77ea7a180e

Path C:\Users\Admin\AppData\Local\Temp\64ca9808-df7c-11f1-b5f1-5a77ea7a180e
Size 414KB
SHA256 3058c3857915c496a4de04dbdd3fea38c8b449dac0932756773b4b04933450a9
MD5 b1f41512afef698fb2aa7b4e06950006
SHA1 e164af0fde698145991a80b05519d88ac1dc473d
SHA512 ddeffd1280a90db7c0501bc6da672aa7da7196ec94fb883ca8e4356b67d1555a38d07525f9ead0eadee48de7cba468c3efe09901a6e489e26b44d8bf48f6f5cb
SSDEEP 12288:ARiTll0UlKLElxOqAXuiieFkgRuvxUSHwi7BvmZnN8RJU:iW1lKwPOvfcvUnGJU
TLSH
T12A94AE117685C437D2B30A335669D26919BDF8316D618A9BB3C41BBEED307C2AA10F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ninite.dll

Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\64ca9805-df7c-11f1-b5f1-5a77ea7a180e\Ninite.dll
Size 850KB
SHA256 15646217deb09ed9e91b28584b498f1be4745906e8aeef937539ce877c9d5edd
MD5 a77a8efb26adff1593e851ae3876a35d
SHA1 78af199d7c4c89d3e94751f731d68209bedf7c44
SHA512 776383ffe57fcb9d3cfb0b4efb03c46e0ce9d8a8319c9a0f05efce4f8455193d4aca07aa91666ec92bec9b4fb5f7982271f48675ac84de85ce8ebc32b767ec03
SSDEEP 12288:a2FiA+4qKllVh804Mq4MaL1hIvVZlc7IvVulTmkISbgJ7wTai7BvmZj3Gbfld9TX:NFiA++ovLlbvTkISbgmTfvUj2Tld9TX
TLSH
T1F7057C237A89C03AF17E0270652D977918B5EC304AB195CB77C477AE2A74BC0A729F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 174B
SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
MD5 17d5d0735deaa1fb4b41a7c406763c0a
SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
TLSH
T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

NiniteAgent.log

Path C:\Windows\TEMP\NiniteAgent.log
Size 87B
SHA256 70a27bfbe3fd7b5d1e72d1db80570279d19d26816179acf13af81d6dc3ac68ec
MD5 1ae22d605b8b40879c7473b303a9dcad
SHA1 1c26908f395df43f1a0cbbe677cf10732756caae
SHA512 91135e235da2f9a1d9e409902d8893f49dc1975a79a93052a1e688328574ecfa29539e330b57f381bc7b8e21c1ea6d3dcafcd46ecc119a9d83559abc02555655
TLSH
T107B01210014310201ED144C04C2604078021253B310C358C31E0F33DD06C35189E3481
MD5 SHA1 SHA512 TLSH

Submit Download

Ninite.dll

Path C:\Windows\Temp\Ninite.tmp\2C1D849DDB5A73C1EBA8ADF77845D022EED7EB42\5776C5F469792F20ADC4EA620C2E8E5C81D08AEB\Ninite.dll
Size 414KB
SHA256 16f1b6883b73a758a1959a4e3b0cba5bee03f2fa45e451f941afa168f54ad938
MD5 c44b6c52d403ff8331dc796426617c94
SHA1 5776c5f469792f20adc4ea620c2e8e5c81d08aeb
SHA512 7f38773f235b2063a509b1f39cb385721504d872d035eb92add21b19b41144076f26118f070058187696ab7c1739c45ee404a8963aee9ca5a7a26261c0193a82
SSDEEP 6144:JB7Eeseb9MhRERxf4xFj8kCnl8aeNPCR+JOhlMi7ksvmacD54Buf:JBaeZzf4xFj8EPnBi7BvmZD5cW
TLSH
T15994AD21F9458436D66F06303528DA651D7DBC717FE0D9CBA3C01DAEA9726C0EB24B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ninite.dll

Path C:\Windows\Temp\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll
Size 2.0MB
SHA256 ce00d2ba81db44e80e67ee18dc61fed7ad879818e3e85cf695e37ff1eb198b70
MD5 edeae1c3f8b8e13b77a5f5b56fd3f6be
SHA1 975fe4b1c5d859d557967e3fc788f6039104096b
SHA512 00380797c32a8d2d13d40bee3d26f93d7326c04f56c9b65e0ffcaf01b8f4749476889db8f89977f04d7c9a1c423b31f37ae8d54ece5400ea2be4a5c87c0d3a8e
SSDEEP 49152:44aM+TR95F4sO7f1aZ+hucZEXMcuOVz42wtIU/n2/HFFbVum:44anF4sOTlucZStugzbgfY
TLSH
T1D5A58C23B7948039E07E02B0712D93581DB5FDB10AB1C59F63D43B9EB9B9AC0961AF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

^1B949094E9119BD8865FFF0224295CA523B363C0

Path C:\Windows\Temp\Ninite.tmp\^1B949094E9119BD8865FFF0224295CA523B363C0
Size 81B
SHA256 d626e706fb0ae9b1836eae9c7d2aaa41af6503a3ba4c739385a4130f8df441ff
MD5 174ed32f1419d2633835ab626501923c
SHA1 f1a750b74a608a844776117fe0a8ec5c0bf25699
SHA512 f7147ed762fff07d404f2fd00edf3636778fba7397d4e23c29b363b04065222681b30922b45d9b8b1cf86e45a2eca182cac55894711c4cc7ec417009e707bbed
TLSH
T1E2A012C0B62C49420161CF0444D150C100C81280098601296C0014E1D42041C108DB70
MD5 SHA1 SHA512 TLSH

Submit Download