e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493.exe
Size

5.1MB
MD5

eda7274bf7a5a4684d1e2036cf2749c3
SHA1

07a21e6927ea8356113df859b0ecbd6671d5c404
SHA256

e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493
SHA512

423b4a86d72409a87cd7018cba32fb6037041a33c9130ad46ad1d8af328ab906dba19290f2c5a1abdd52b6cc647b0ddffeedef64c88b91b6076c379e030c9198
SSDEEP

98304:8HenYKGxUcl3nT86Ytacv5Se1KdzOJDb4v+u:8Hr/YtacvuwN0v+u

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2124	e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493.exe
2124	e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493.exe

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2124	e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493.exe

C:\Users\Admin\AppData\Local\Temp\e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493.exe
"C:\Users\Admin\AppData\Local\Temp\e5d54e6e30d14ea2841ae67baaec613f403d3a551f6da7a396e0c7d5643e8493.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71c0d6bfff18dd040802a9a39428049f

SHA1
fb5804d94ea015338b1b885b309a80153c12ccb2

SHA256
dd8cfdd467ac7396cfe3a632af92de39585e636a08267eef35103b7b955db6a9

SHA512
6af908f21e9bb74797c896e41815d7b3336609b0314334b4115a8d7cb3f4105e45341c8b32c861b9e53c652b92abe7ea681b31d83e5318ec402e7cfb96509778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
500b02dd190a2e79084eaa2b1e8954ea

SHA1
989828fe04d83aff06c76ac323095afba8aeebe8

SHA256
56381ceadcb9224731206edf11c17b2ef4695922cbfeec5b9b9ff92810325e26

SHA512
21ed1d7bb0f95951d9f41e302dec1e835e130c7ff9cff79f89dfa9cecb457401547dcc07f33abd0351a0063cfef1bfb5996c4e6843cdb5e3ca855ff5ac45f762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9e6a8886f3068216cfad955cc40a38f3

SHA1
b31672a04373c03ce8b47e332bad99abd0d16dff

SHA256
9fe8ff879bbdef35e7a9c4cd3943c099efc64461d025f26bf54bdf4a1f091ee4

SHA512
7f9ba647cb705f1b6c64e7999f5491ca733737194aed6ce56d954ad69164bdf91c99098e553106bbadca01d63a4cf3eff71779d47630fa6d7032cd4dec493098

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A3B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
5fc8e5db1e806a9afd6e59683f379d2c

SHA1
52cb6d0ee31963d4296112ff7aab5f93891221d9

SHA256
0b1eebf34807b2eb55195165760e25136dd430c1784e4800db8b2ac53c11ad63

SHA512
e310eaac7a01e44421c787a32b061e33a335b23c12bed38f2bc4796aab34123a7cf2f64cda628204fefbda8785354e38cb51f557dba5456f68ee5e22461ac1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
87a0fe46841b2cd0d1937ea5cb24e71f

SHA1
fb196ee29e87896c171c6f480ee6b7f42b2ad632

SHA256
8b20be937a262ddfe5bf70bc7e83feae36231d6ead7b3a35ffda01dee632609b

SHA512
3204418e1a87ef7e5729adf69d041ffc8fef5678e251079c713aaf1a9b0d81f22055a3eeb85b2f620aa68ed95a3b1ca5900bc88eb41461621dd07233b531f226

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
4bf827b842847e106480d2d29aba94b6

SHA1
82a1868aa1399097e2fb5255450bfde7a9519533

SHA256
14cdf806a4a6b67816e3c94f40159c3c650c3511d0e0a43b94e0fff78104036f

SHA512
51d92ee80887f9695bf9427ad4c97cf7dd0eb44f45b08ba95e0039af72ee9289f5dca0028895898161d8d779ce5ff6e4367368faebd6119922aea50162cffa4b

Download Submit
\Users\Admin\AppData\Local\Temp\yb9D0.tmp

Filesize
341KB

MD5
800fd0790cb592bbfcf92fd5e4f72718

SHA1
64c7f5e77904a23d2e27ebc69847c415d9b5b90f

SHA256
6238e00c9a11e043bd67b6254fec8e7d78884cb2e7e07a94f54d28850bb4be36

SHA512
317d18d9a9811fa849739786e15661cc2666db66ee2bbf11d9259d3b3b7db8cbd3635c34f13a60923f6c87e1c54ea82d9410e4e7873e81d7f5a975330e50f234

Download Submit
\Users\Admin\AppData\Local\Temp\yb9D0.tmp

Filesize
2.4MB

MD5
fe744497077be500c52c32de5ab43b9c

SHA1
e644a7624ee71cf7f47fdc756284547563c8c82b

SHA256
e4ac77066edf8c19fffa4fac93efe57a2c5dba610e4c399034ed061cf8c19779

SHA512
a1256fa2b0766e57695ccc357541168863434aac68aa6ec1bc0e8821854cab6ae110692852f2376153fafa04c9eb44c1b3ac80ebc62fdb0187c743cdfd3660e2

Download Submit