412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5

Analysis

max time kernel
117s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5.exe
Size

5.1MB
MD5

3e041ef23a05456e67b03ba4b3ac16cb
SHA1

da15f0d4088acf53c040c6e30cd070a33a860b3b
SHA256

412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5
SHA512

4d9395573344adb928f0c5b70bf076004ed9061a0d7f2225b6c82a9d3240d27b744b502f0afb533639cadaf80e887d296dd6c28edaeb4074ed273cb9327fed00
SSDEEP

98304:8HenYKGxUcl3nT86Ytacv5Se1KdzOJDb4v+u:8Hr/YtacvuwN0v+u

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2380	412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5.exe
2380	412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5.exe

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2380	412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5.exe

C:\Users\Admin\AppData\Local\Temp\412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5.exe
"C:\Users\Admin\AppData\Local\Temp\412bb5b571b20c1ba10dfec1ed92c84e2793ee19520cdaff48f02100b93999c5.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7afeb4476c5cdf5f34695217c32c9d7

SHA1
b90b6d2864309edd4b1dc09b20398bf2ab0d5cb2

SHA256
fa321e6ecc6080c6768bf74a3b5bce29cdfddd18056188f0dd563d38b313dee4

SHA512
d66c9a85293e6cfecfd993fe375fae8657b6991b0fbea548235d7b15c04f0dfb993fa4406a0a52fbf81d594c6f2d8fb460b389ac41ce8120671282e95686d492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5001336c7f4432327881d6034b9830d

SHA1
72bc678c073d3f935cfacce1c9fcdf837203a63f

SHA256
4cae6ae845e247de12944a26abeee32fe7af962e838c2e7490069f3bcf4bae52

SHA512
e6c1f03244d391c601ae54cca73f26d9f5aa4dd5e2b718f152cdbe461171b44d38337ecc15c4fa8baef650a78f1d9e49fcedc06dc00870b97b92f883c5142dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2fa93a0e7cf56a3a251765a213284ae5

SHA1
57562ae6558b4c741f28e96a5ef4a9d2fd2ba719

SHA256
d5a5e6b5d327bb87906c4fd0ffc86004ae62047179cfc3b2d97f418191b5b4cf

SHA512
b2d3ece22f35040b6613f10134c34dd99cd62e173f1723e45d3af93c6e8a258fd07eded447afffbfc4b98bd11bf5ebc1e917d5496817cbeeea7b3af2e175d7e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1230.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
503c17eeccf5d8a590b26d7c054802e7

SHA1
e61d3ada29f7f1c8c57123dae9ea071d5f31f0a8

SHA256
926a5eabe9cc37846d29d80193bcbb4e79f5e55e07d0b01bd6698b1187aef971

SHA512
c9e1efb685c2c594eeba1e1d9b8cd7c7e37622487b90ff178e612e29925055fd8c20b270fe3a56089e6b23278c59a547be9e8310928f10f6ac191e3cf1f315cf

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
65b52bd7801ec1e0df3e96b1c4f15c05

SHA1
94fce65f43c9451f04c45cef4e6328cab221d166

SHA256
b22ae0a1215ba362fa42a186e5600ef9c40e29f2192aae1db51deaaf42e6e654

SHA512
c0acf8882fa6e748288e3662eb71d7b7c2d79ef7d68735c1cd7d6f245cc69020449d717d13c79b24556f340d064f736e445f2773ced53b202a5131878188515f

Download Submit
\Users\Admin\AppData\Local\Temp\yb510.tmp

Filesize
128KB

MD5
c88e43fc294005a6d36d389e06876107

SHA1
2a5cae2b9ee996cd7719d617e08d15aba08c9a94

SHA256
96e8a1d8f3c7936cccddd222115b267de0a6889d24fde511db1d525791f02232

SHA512
7f5b7b2c653521f56b4b6e6124ae7ca11a184637a69d86e442fb9cf34f22b3aa3747dde6ae3abb51e23342a9a2e3dade78febd6315484a1fcd9c7e171c2dd82b

Download Submit
\Users\Admin\AppData\Local\Temp\yb510.tmp

Filesize
91KB

MD5
3a2110fed5b7b0d24f70d5d8e67c5d2b

SHA1
ed0ea1326a6b3c45c90af7a7d7988597f45dc769

SHA256
a6908695604300d2277e91e81319916c6a8b95d410033be0293cc1d6425dbf3c

SHA512
0e4ab1b09136f845d01da1ff7317c02983403a64069c8143abdb23b417edba2a780874606373da29f38f2102dbbc9c4ecf4707576b40c2f9227ac6467b4bd39d

Download Submit