17864e53be7b2ed563ddeb4ae2c2cc43c9e2347566d97772ad4c21a013ccf026

General

Target

3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Size

14.3MB
MD5

ee0d931049a8ac903ea7580feb12604e
SHA1

68d53c9e8aa735a9fae932358aa15e1a59238527
SHA256

17864e53be7b2ed563ddeb4ae2c2cc43c9e2347566d97772ad4c21a013ccf026
SHA512

9175d47346d00cee7320be9e97c14f85974e0fb23b863687a34c3c955fb66fb545f59762d2d1f7451073779a24dd3734d67be32f420a577c124780ad87fff956
SSDEEP

393216:RP1hc3Ml5cMShYOrzmGqsYRb6A+GWawyiMv97Hu/FDH0kwOAtF:RXwRwHUFDHGOA

Score

1^/10

Malware Config

Signatures

Modifies system certificate store 2 TTPs 10 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000cfa442e0ad795c4941c5d7f9be151bf1f4a7a8a92000000001000000e7050000308205e3308203cba00302010202101d17a2856bb0fd8c4cc1385ccda02f9d300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3233303631343230323133335a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100ceb53a2ddf322f9b633b47f0abdba4f64133942d8b2e8eaefdb87d6bef936a77ea671ca1d08547f10731cbec22c5082d3a688c1257381ab766de694a2b104af1616a1a23f08150ae7ae751f9c9fb901a8d6851ad0055dbb2a177b67fd0e4dae8404acffec42fd42b62d93d6ecf9be95f546b43d583ff9cc432c24d71e95b87a4973bdaea81918ca6482b443bed056c7129fa282483eae7f1598c308c064db268bde268d3dce78807cb07b819c6912983d1a43a5284ba43f955ad204af5fbf4a454f0d375057a020395d96cb063ee03e641d05736c544e3e96b341beb38e2a5e457f666f9cc0939fc877df98804eba4332e74cd88af7492542d54871244118c110f967b2f9f24651367bd9c611538977b979d7939f9ce21a6adaa0a2b2a8e446263ad5eea3db2f9f9bba850be79abbd0fa166829c9c8cc83f3390eaae1f946d71d4efe39b1c5a82ce795980bedf269042142d12edb46abe8ca569aefc72359185f589fb23b41823f00120cf929cc254226ede69d7447f1601073298c2ab94cbafdbef08bb3c62629ed00e64ad814290962f6fad15cd19f51cdd5c4dd4a9c668cca5ea2d9d82d0f705ab5dbd9cd5fb3bb766b89186e6be0002e52e50719538d5a484ad631af84224299fb3930fe8c3e49fbe785b9c8bfbe4c0abe1dab57e7bbdfcb7e80e68e0f37d83921f68ac85aff1a770cf30823782f4b3fe70d8cca2c230010203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100c4eafcc862d9c0b2937415b6aa64c363bce1c52d6e4ac061d3d6110e3d7a99f9a381b1b2d43074a552b9cc3f6b3fd7458e1e4d808dcdfe1dd0ac8167f05a7b78546150eb6c7db910218b0c1adf5345b19099abe81fc09b28f28c09ae331ed58c01adfde6b2eb4b892039fe3d618d594bbb1c88bb21703f2594cd2b1ec5a7c04af4dab303603ddcb5d623cf1f1d6f1bf32bde6f32421dc118bf6a19e5a7dd99e2ceb0ab11af15e6b13b77dbdf42aed3c58e62b3d7c56d460dfe953f9e0db24ec71f9b297ec433b5717f1562b89a9423a1f4299fd07c75e57a11382fa51091b492216f316d8f5ee8d9b22e2aef480909064004d9b2dae7ea056a705e9691ab61189a224818aca685704a776168c163d9bb53580154eeadd41d32e628bb1b5773b7d7fefcfcf61bc1b8f57a2d6402cffc00c43d1d68863d855e23f5c4c5bf6c93326a9f5c53e741c1e921652ff46d32e09564262a7e0a20bd0a3e501480e98969eb134b33e7bf30312b5ee845d2f1411f5f35f1341dab9fc421f1bfe5f93e0b3fd1d867ccfa1d542a86b472a0c56775b8a5e773ecd906309df04ad7a5671aef66e70e2cd5f664f0abb0fd9004151501de5bc1233fcaf1de987eb934d0ba289aa20fd4fd23e179d1f60022a2d22f47371d5c0a98bef899129324e91c20fac74db08fb549da72e72d598c6442c440b8eb2a7f6a25cb8f8a2e55adec33dbbcceb2a4b1	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9\Blob = 030000000100000014000000cfa442e0ad795c4941c5d7f9be151bf1f4a7a8a902000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000e7050000308205e3308203cba00302010202101d17a2856bb0fd8c4cc1385ccda02f9d300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3233303631343230323133335a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100ceb53a2ddf322f9b633b47f0abdba4f64133942d8b2e8eaefdb87d6bef936a77ea671ca1d08547f10731cbec22c5082d3a688c1257381ab766de694a2b104af1616a1a23f08150ae7ae751f9c9fb901a8d6851ad0055dbb2a177b67fd0e4dae8404acffec42fd42b62d93d6ecf9be95f546b43d583ff9cc432c24d71e95b87a4973bdaea81918ca6482b443bed056c7129fa282483eae7f1598c308c064db268bde268d3dce78807cb07b819c6912983d1a43a5284ba43f955ad204af5fbf4a454f0d375057a020395d96cb063ee03e641d05736c544e3e96b341beb38e2a5e457f666f9cc0939fc877df98804eba4332e74cd88af7492542d54871244118c110f967b2f9f24651367bd9c611538977b979d7939f9ce21a6adaa0a2b2a8e446263ad5eea3db2f9f9bba850be79abbd0fa166829c9c8cc83f3390eaae1f946d71d4efe39b1c5a82ce795980bedf269042142d12edb46abe8ca569aefc72359185f589fb23b41823f00120cf929cc254226ede69d7447f1601073298c2ab94cbafdbef08bb3c62629ed00e64ad814290962f6fad15cd19f51cdd5c4dd4a9c668cca5ea2d9d82d0f705ab5dbd9cd5fb3bb766b89186e6be0002e52e50719538d5a484ad631af84224299fb3930fe8c3e49fbe785b9c8bfbe4c0abe1dab57e7bbdfcb7e80e68e0f37d83921f68ac85aff1a770cf30823782f4b3fe70d8cca2c230010203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100c4eafcc862d9c0b2937415b6aa64c363bce1c52d6e4ac061d3d6110e3d7a99f9a381b1b2d43074a552b9cc3f6b3fd7458e1e4d808dcdfe1dd0ac8167f05a7b78546150eb6c7db910218b0c1adf5345b19099abe81fc09b28f28c09ae331ed58c01adfde6b2eb4b892039fe3d618d594bbb1c88bb21703f2594cd2b1ec5a7c04af4dab303603ddcb5d623cf1f1d6f1bf32bde6f32421dc118bf6a19e5a7dd99e2ceb0ab11af15e6b13b77dbdf42aed3c58e62b3d7c56d460dfe953f9e0db24ec71f9b297ec433b5717f1562b89a9423a1f4299fd07c75e57a11382fa51091b492216f316d8f5ee8d9b22e2aef480909064004d9b2dae7ea056a705e9691ab61189a224818aca685704a776168c163d9bb53580154eeadd41d32e628bb1b5773b7d7fefcfcf61bc1b8f57a2d6402cffc00c43d1d68863d855e23f5c4c5bf6c93326a9f5c53e741c1e921652ff46d32e09564262a7e0a20bd0a3e501480e98969eb134b33e7bf30312b5ee845d2f1411f5f35f1341dab9fc421f1bfe5f93e0b3fd1d867ccfa1d542a86b472a0c56775b8a5e773ecd906309df04ad7a5671aef66e70e2cd5f664f0abb0fd9004151501de5bc1233fcaf1de987eb934d0ba289aa20fd4fd23e179d1f60022a2d22f47371d5c0a98bef899129324e91c20fac74db08fb549da72e72d598c6442c440b8eb2a7f6a25cb8f8a2e55adec33dbbcceb2a4b1	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9\Blob = 030000000100000014000000cfa442e0ad795c4941c5d7f9be151bf1f4a7a8a92000000001000000e7050000308205e3308203cba00302010202101d17a2856bb0fd8c4cc1385ccda02f9d300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3233303631343230323133335a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100ceb53a2ddf322f9b633b47f0abdba4f64133942d8b2e8eaefdb87d6bef936a77ea671ca1d08547f10731cbec22c5082d3a688c1257381ab766de694a2b104af1616a1a23f08150ae7ae751f9c9fb901a8d6851ad0055dbb2a177b67fd0e4dae8404acffec42fd42b62d93d6ecf9be95f546b43d583ff9cc432c24d71e95b87a4973bdaea81918ca6482b443bed056c7129fa282483eae7f1598c308c064db268bde268d3dce78807cb07b819c6912983d1a43a5284ba43f955ad204af5fbf4a454f0d375057a020395d96cb063ee03e641d05736c544e3e96b341beb38e2a5e457f666f9cc0939fc877df98804eba4332e74cd88af7492542d54871244118c110f967b2f9f24651367bd9c611538977b979d7939f9ce21a6adaa0a2b2a8e446263ad5eea3db2f9f9bba850be79abbd0fa166829c9c8cc83f3390eaae1f946d71d4efe39b1c5a82ce795980bedf269042142d12edb46abe8ca569aefc72359185f589fb23b41823f00120cf929cc254226ede69d7447f1601073298c2ab94cbafdbef08bb3c62629ed00e64ad814290962f6fad15cd19f51cdd5c4dd4a9c668cca5ea2d9d82d0f705ab5dbd9cd5fb3bb766b89186e6be0002e52e50719538d5a484ad631af84224299fb3930fe8c3e49fbe785b9c8bfbe4c0abe1dab57e7bbdfcb7e80e68e0f37d83921f68ac85aff1a770cf30823782f4b3fe70d8cca2c230010203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100c4eafcc862d9c0b2937415b6aa64c363bce1c52d6e4ac061d3d6110e3d7a99f9a381b1b2d43074a552b9cc3f6b3fd7458e1e4d808dcdfe1dd0ac8167f05a7b78546150eb6c7db910218b0c1adf5345b19099abe81fc09b28f28c09ae331ed58c01adfde6b2eb4b892039fe3d618d594bbb1c88bb21703f2594cd2b1ec5a7c04af4dab303603ddcb5d623cf1f1d6f1bf32bde6f32421dc118bf6a19e5a7dd99e2ceb0ab11af15e6b13b77dbdf42aed3c58e62b3d7c56d460dfe953f9e0db24ec71f9b297ec433b5717f1562b89a9423a1f4299fd07c75e57a11382fa51091b492216f316d8f5ee8d9b22e2aef480909064004d9b2dae7ea056a705e9691ab61189a224818aca685704a776168c163d9bb53580154eeadd41d32e628bb1b5773b7d7fefcfcf61bc1b8f57a2d6402cffc00c43d1d68863d855e23f5c4c5bf6c93326a9f5c53e741c1e921652ff46d32e09564262a7e0a20bd0a3e501480e98969eb134b33e7bf30312b5ee845d2f1411f5f35f1341dab9fc421f1bfe5f93e0b3fd1d867ccfa1d542a86b472a0c56775b8a5e773ecd906309df04ad7a5671aef66e70e2cd5f664f0abb0fd9004151501de5bc1233fcaf1de987eb934d0ba289aa20fd4fd23e179d1f60022a2d22f47371d5c0a98bef899129324e91c20fac74db08fb549da72e72d598c6442c440b8eb2a7f6a25cb8f8a2e55adec33dbbcceb2a4b1	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000cfa442e0ad795c4941c5d7f9be151bf1f4a7a8a92000000001000000e7050000308205e3308203cba00302010202101d17a2856bb0fd8c4cc1385ccda02f9d300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3233303631343230323133335a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100ceb53a2ddf322f9b633b47f0abdba4f64133942d8b2e8eaefdb87d6bef936a77ea671ca1d08547f10731cbec22c5082d3a688c1257381ab766de694a2b104af1616a1a23f08150ae7ae751f9c9fb901a8d6851ad0055dbb2a177b67fd0e4dae8404acffec42fd42b62d93d6ecf9be95f546b43d583ff9cc432c24d71e95b87a4973bdaea81918ca6482b443bed056c7129fa282483eae7f1598c308c064db268bde268d3dce78807cb07b819c6912983d1a43a5284ba43f955ad204af5fbf4a454f0d375057a020395d96cb063ee03e641d05736c544e3e96b341beb38e2a5e457f666f9cc0939fc877df98804eba4332e74cd88af7492542d54871244118c110f967b2f9f24651367bd9c611538977b979d7939f9ce21a6adaa0a2b2a8e446263ad5eea3db2f9f9bba850be79abbd0fa166829c9c8cc83f3390eaae1f946d71d4efe39b1c5a82ce795980bedf269042142d12edb46abe8ca569aefc72359185f589fb23b41823f00120cf929cc254226ede69d7447f1601073298c2ab94cbafdbef08bb3c62629ed00e64ad814290962f6fad15cd19f51cdd5c4dd4a9c668cca5ea2d9d82d0f705ab5dbd9cd5fb3bb766b89186e6be0002e52e50719538d5a484ad631af84224299fb3930fe8c3e49fbe785b9c8bfbe4c0abe1dab57e7bbdfcb7e80e68e0f37d83921f68ac85aff1a770cf30823782f4b3fe70d8cca2c230010203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100c4eafcc862d9c0b2937415b6aa64c363bce1c52d6e4ac061d3d6110e3d7a99f9a381b1b2d43074a552b9cc3f6b3fd7458e1e4d808dcdfe1dd0ac8167f05a7b78546150eb6c7db910218b0c1adf5345b19099abe81fc09b28f28c09ae331ed58c01adfde6b2eb4b892039fe3d618d594bbb1c88bb21703f2594cd2b1ec5a7c04af4dab303603ddcb5d623cf1f1d6f1bf32bde6f32421dc118bf6a19e5a7dd99e2ceb0ab11af15e6b13b77dbdf42aed3c58e62b3d7c56d460dfe953f9e0db24ec71f9b297ec433b5717f1562b89a9423a1f4299fd07c75e57a11382fa51091b492216f316d8f5ee8d9b22e2aef480909064004d9b2dae7ea056a705e9691ab61189a224818aca685704a776168c163d9bb53580154eeadd41d32e628bb1b5773b7d7fefcfcf61bc1b8f57a2d6402cffc00c43d1d68863d855e23f5c4c5bf6c93326a9f5c53e741c1e921652ff46d32e09564262a7e0a20bd0a3e501480e98969eb134b33e7bf30312b5ee845d2f1411f5f35f1341dab9fc421f1bfe5f93e0b3fd1d867ccfa1d542a86b472a0c56775b8a5e773ecd906309df04ad7a5671aef66e70e2cd5f664f0abb0fd9004151501de5bc1233fcaf1de987eb934d0ba289aa20fd4fd23e179d1f60022a2d22f47371d5c0a98bef899129324e91c20fac74db08fb549da72e72d598c6442c440b8eb2a7f6a25cb8f8a2e55adec33dbbcceb2a4b1	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9\Blob = 030000000100000014000000cfa442e0ad795c4941c5d7f9be151bf1f4a7a8a92000000001000000e7050000308205e3308203cba00302010202101d17a2856bb0fd8c4cc1385ccda02f9d300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3233303631343230323133335a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100ceb53a2ddf322f9b633b47f0abdba4f64133942d8b2e8eaefdb87d6bef936a77ea671ca1d08547f10731cbec22c5082d3a688c1257381ab766de694a2b104af1616a1a23f08150ae7ae751f9c9fb901a8d6851ad0055dbb2a177b67fd0e4dae8404acffec42fd42b62d93d6ecf9be95f546b43d583ff9cc432c24d71e95b87a4973bdaea81918ca6482b443bed056c7129fa282483eae7f1598c308c064db268bde268d3dce78807cb07b819c6912983d1a43a5284ba43f955ad204af5fbf4a454f0d375057a020395d96cb063ee03e641d05736c544e3e96b341beb38e2a5e457f666f9cc0939fc877df98804eba4332e74cd88af7492542d54871244118c110f967b2f9f24651367bd9c611538977b979d7939f9ce21a6adaa0a2b2a8e446263ad5eea3db2f9f9bba850be79abbd0fa166829c9c8cc83f3390eaae1f946d71d4efe39b1c5a82ce795980bedf269042142d12edb46abe8ca569aefc72359185f589fb23b41823f00120cf929cc254226ede69d7447f1601073298c2ab94cbafdbef08bb3c62629ed00e64ad814290962f6fad15cd19f51cdd5c4dd4a9c668cca5ea2d9d82d0f705ab5dbd9cd5fb3bb766b89186e6be0002e52e50719538d5a484ad631af84224299fb3930fe8c3e49fbe785b9c8bfbe4c0abe1dab57e7bbdfcb7e80e68e0f37d83921f68ac85aff1a770cf30823782f4b3fe70d8cca2c230010203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100c4eafcc862d9c0b2937415b6aa64c363bce1c52d6e4ac061d3d6110e3d7a99f9a381b1b2d43074a552b9cc3f6b3fd7458e1e4d808dcdfe1dd0ac8167f05a7b78546150eb6c7db910218b0c1adf5345b19099abe81fc09b28f28c09ae331ed58c01adfde6b2eb4b892039fe3d618d594bbb1c88bb21703f2594cd2b1ec5a7c04af4dab303603ddcb5d623cf1f1d6f1bf32bde6f32421dc118bf6a19e5a7dd99e2ceb0ab11af15e6b13b77dbdf42aed3c58e62b3d7c56d460dfe953f9e0db24ec71f9b297ec433b5717f1562b89a9423a1f4299fd07c75e57a11382fa51091b492216f316d8f5ee8d9b22e2aef480909064004d9b2dae7ea056a705e9691ab61189a224818aca685704a776168c163d9bb53580154eeadd41d32e628bb1b5773b7d7fefcfcf61bc1b8f57a2d6402cffc00c43d1d68863d855e23f5c4c5bf6c93326a9f5c53e741c1e921652ff46d32e09564262a7e0a20bd0a3e501480e98969eb134b33e7bf30312b5ee845d2f1411f5f35f1341dab9fc421f1bfe5f93e0b3fd1d867ccfa1d542a86b472a0c56775b8a5e773ecd906309df04ad7a5671aef66e70e2cd5f664f0abb0fd9004151501de5bc1233fcaf1de987eb934d0ba289aa20fd4fd23e179d1f60022a2d22f47371d5c0a98bef899129324e91c20fac74db08fb549da72e72d598c6442c440b8eb2a7f6a25cb8f8a2e55adec33dbbcceb2a4b1	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CFA442E0AD795C4941C5D7F9BE151BF1F4A7A8A9\Blob = 030000000100000014000000cfa442e0ad795c4941c5d7f9be151bf1f4a7a8a902000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000e7050000308205e3308203cba00302010202101d17a2856bb0fd8c4cc1385ccda02f9d300d06092a864886f70d01010b050030633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3233303631343230323133335a170d3239303130313030303030305a30633161305f06035504031e58005500530042005c005600490044005f00310030003100440026005000490044005f003000300030003300200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930820222300d06092a864886f70d01010105000382020f003082020a0282020100ceb53a2ddf322f9b633b47f0abdba4f64133942d8b2e8eaefdb87d6bef936a77ea671ca1d08547f10731cbec22c5082d3a688c1257381ab766de694a2b104af1616a1a23f08150ae7ae751f9c9fb901a8d6851ad0055dbb2a177b67fd0e4dae8404acffec42fd42b62d93d6ecf9be95f546b43d583ff9cc432c24d71e95b87a4973bdaea81918ca6482b443bed056c7129fa282483eae7f1598c308c064db268bde268d3dce78807cb07b819c6912983d1a43a5284ba43f955ad204af5fbf4a454f0d375057a020395d96cb063ee03e641d05736c544e3e96b341beb38e2a5e457f666f9cc0939fc877df98804eba4332e74cd88af7492542d54871244118c110f967b2f9f24651367bd9c611538977b979d7939f9ce21a6adaa0a2b2a8e446263ad5eea3db2f9f9bba850be79abbd0fa166829c9c8cc83f3390eaae1f946d71d4efe39b1c5a82ce795980bedf269042142d12edb46abe8ca569aefc72359185f589fb23b41823f00120cf929cc254226ede69d7447f1601073298c2ab94cbafdbef08bb3c62629ed00e64ad814290962f6fad15cd19f51cdd5c4dd4a9c668cca5ea2d9d82d0f705ab5dbd9cd5fb3bb766b89186e6be0002e52e50719538d5a484ad631af84224299fb3930fe8c3e49fbe785b9c8bfbe4c0abe1dab57e7bbdfcb7e80e68e0f37d83921f68ac85aff1a770cf30823782f4b3fe70d8cca2c230010203010001a3819230818f30160603551d250101ff040c300a06082b0601050507030330340603551d07042d302b812943726561746564206279206c69627764692028687474703a2f2f6c69627764692e616b656f2e696529303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d01010b05000382020100c4eafcc862d9c0b2937415b6aa64c363bce1c52d6e4ac061d3d6110e3d7a99f9a381b1b2d43074a552b9cc3f6b3fd7458e1e4d808dcdfe1dd0ac8167f05a7b78546150eb6c7db910218b0c1adf5345b19099abe81fc09b28f28c09ae331ed58c01adfde6b2eb4b892039fe3d618d594bbb1c88bb21703f2594cd2b1ec5a7c04af4dab303603ddcb5d623cf1f1d6f1bf32bde6f32421dc118bf6a19e5a7dd99e2ceb0ab11af15e6b13b77dbdf42aed3c58e62b3d7c56d460dfe953f9e0db24ec71f9b297ec433b5717f1562b89a9423a1f4299fd07c75e57a11382fa51091b492216f316d8f5ee8d9b22e2aef480909064004d9b2dae7ea056a705e9691ab61189a224818aca685704a776168c163d9bb53580154eeadd41d32e628bb1b5773b7d7fefcfcf61bc1b8f57a2d6402cffc00c43d1d68863d855e23f5c4c5bf6c93326a9f5c53e741c1e921652ff46d32e09564262a7e0a20bd0a3e501480e98969eb134b33e7bf30312b5ee845d2f1411f5f35f1341dab9fc421f1bfe5f93e0b3fd1d867ccfa1d542a86b472a0c56775b8a5e773ecd906309df04ad7a5671aef66e70e2cd5f664f0abb0fd9004151501de5bc1233fcaf1de987eb934d0ba289aa20fd4fd23e179d1f60022a2d22f47371d5c0a98bef899129324e91c20fac74db08fb549da72e72d598c6442c440b8eb2a7f6a25cb8f8a2e55adec33dbbcceb2a4b1	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
628	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
628	3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe

C:\Users\Admin\AppData\Local\Temp\3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe
"C:\Users\Admin\AppData\Local\Temp\3.0版金税盘一键升级底层工具V1.39（AN6-220524 AT6-220525 AC5-220526）授权截止日期：2022年12月31日.exe"
1⤵
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\usb_driver\x86\winusbcoinstaller2.dll

Filesize
831KB

MD5
8e7b9f81e8823fee2d82f7de3a44300b

SHA1
1633b3715014c90d1c552cd757ef5de33c161dee

SHA256
ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c

SHA512
9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9

Download Submit

Analysis

Sharing