bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c

Analysis

max time kernel
151s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
Size

3.9MB
MD5

7364c386aa10d962d29d42c5b3fff486
SHA1

30e5fbefaf34ae5a0737730a53a054dbd83c2795
SHA256

bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c
SHA512

d5d9f1c9bf57174d64d32dcb0247ac8a56253aba06e9a520ae72a7c89cf6feae1ce0bd6184a1c57b34b8ce186276b707d1bc91cd12f583f66711f6f6696f21bb
SSDEEP

98304:uyYWEUAAnYxJHBvt5ZvtNVbrgUAkJwZUzpxF55VK5eY:uhRxJHBvfZvtNNJNJwZUzceY

Score

1^/10

Malware Config

Signatures

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
2244	bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe

C:\Users\Admin\AppData\Local\Temp\bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe
"C:\Users\Admin\AppData\Local\Temp\bc4b18edbf2b6312980b9d11c28beb597dd92312d41c87962f0c7ee90959e66c.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2244-0-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2244-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2244-2-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2244-4-0x0000000010000000-0x0000000010116000-memory.dmp

Filesize
1.1MB

Download
memory/2244-8-0x0000000000FD0000-0x0000000001029000-memory.dmp

Filesize
356KB

Download
memory/2244-9-0x0000000076ED0000-0x0000000076FD0000-memory.dmp

Filesize
1024KB

Download
memory/2244-10-0x0000000076ED0000-0x0000000076FD0000-memory.dmp

Filesize
1024KB

Download
memory/2244-11-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2244-12-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2244-13-0x0000000076ED0000-0x0000000076FD0000-memory.dmp

Filesize
1024KB

Download
memory/2244-35-0x000000000B560000-0x000000000B5A0000-memory.dmp

Filesize
256KB

Download
memory/2244-36-0x000000000B560000-0x000000000B5A0000-memory.dmp

Filesize
256KB

Download
memory/2244-34-0x000000000B560000-0x000000000B561000-memory.dmp

Filesize
4KB

Download
memory/2244-33-0x000000000B560000-0x000000000B561000-memory.dmp

Filesize
4KB

Download
memory/2244-37-0x000000000B560000-0x000000000B561000-memory.dmp

Filesize
4KB

Download
memory/2244-39-0x000000000B560000-0x000000000B561000-memory.dmp

Filesize
4KB

Download
memory/2244-38-0x000000000B560000-0x000000000B561000-memory.dmp

Filesize
4KB

Download