f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5.exe
Size

4.3MB
MD5

cbc6259e0983460e2916ff786217139d
SHA1

7484040e31c28ab183e815e23812717f3517217b
SHA256

f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5
SHA512

64ffeb52cc1867632bb4b452fb09dcd9afd378ef908888928654624ef191d5c7442810a51ceda16d1a2e471438f607a57e36c92632f13821e92082f9b2e6331a
SSDEEP

49152:31S1zFNBxoFmiPilPyGo97uTfzX80thsHvrZlX0UuvZPGkK8N1PapB1wFiSQRU+D:3CZkPilPgcX807sPrZheuSZG/rRM98

Score

8^/10

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 3 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4468	912	WerFault.exe	81

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2324	912	f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5.exe	87
PID 912 wrote to memory of 2324	912	f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5.exe	87
PID 912 wrote to memory of 2324	912	f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5.exe	87
PID 2324 wrote to memory of 3164	2324	cmd.exe	88
PID 2324 wrote to memory of 3164	2324	cmd.exe	88
PID 2324 wrote to memory of 3164	2324	cmd.exe	88
PID 2324 wrote to memory of 1456	2324	cmd.exe	89
PID 2324 wrote to memory of 1456	2324	cmd.exe	89
PID 2324 wrote to memory of 1456	2324	cmd.exe	89
PID 2324 wrote to memory of 544	2324	cmd.exe	90
PID 2324 wrote to memory of 544	2324	cmd.exe	90
PID 2324 wrote to memory of 544	2324	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5.exe
"C:\Users\Admin\AppData\Local\Temp\f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\f9584ea336f4aa0fbb29d7c5a90d33b2b93f492f4ee30be554f79866abafd5d5.exe" MD5
    3⤵
    - Manipulates Digital Signatures
    PID:3164
- - C:\Windows\SysWOW64\find.exe
    find /i /v "md5"
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\find.exe
    find /i /v "certutil"
    3⤵
    PID:544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 872
  2⤵
  - Program crash
  PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 912 -ip 912
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...