Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe
Resource
win10v2004-20240226-en
General
-
Target
38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe
-
Size
3.7MB
-
MD5
6425c5ca7352f1559d09cfde2ee95669
-
SHA1
1dcf10d3e0465ac3b94732f68067769ace961a36
-
SHA256
38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272
-
SHA512
78ffa3228d3a79c74fb2d6ab5f5f313450870bf53f565709b5c9bbb8c5490d638ccbc9bbd7befe77557721efb088b89352ddb0fdd093288ab66160aa6767f4a9
-
SSDEEP
49152:rqtcd9PJG293W1iu+3pgEkH5iEGhXVQvu4VkvpdNQUP7tP57NrCVbL8NJ5VpJ:I69Po24cXVQvu4VkvLTTP7NrCVbMV
Malware Config
Signatures
-
Loads dropped DLL 11 IoCs
pid Process 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\84C05F33983B4F73E870D6E0582A00696A2FC472 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\84C05F33983B4F73E870D6E0582A00696A2FC472\Blob = 03000000010000001400000084c05f33983b4f73e870d6e0582a00696a2fc4722000000001000000a7030000308203a33082028ba00302010202100083770212b5a5b1c1609728d61b629d300d06092a864886f70d01010b0500306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3234303630363030303030305a170d3334303631333033333831385a306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a028201010087a2b5991c7ef99946ce236786981c22d471bfba1cbd56a608e5d61982df2753d4fbe4a5fe9eef5fd5dc6050574fb5b33448215a6bee821c96123fbd9d6ff14973175c624e9219f78801ad96739c00b024199497d99d89013c0205ba9212c9a7430346e128faf9d131329bab7fcdc4b73d7fc737702baedd069864a661ac6e9128c2eaffea9eef87f819f08cf09f460ea4d265569821c9b6d5e3b3d8a1d9ce8d357af41268ff475163c5658e4b7681e1967b0aefbb3770557110a572810de6baeae1817b387af5e4fc513fb09f958036f52a820ef704250ebdb75eafb70523ab253e7c3d3fb36c49fc0bd2c9088e2ea8d19b7dd2b80e7b29857a5255a9d1229f0203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e041604148cff63d87e0e3a4dd178f93f267b583a918d49c2300d06092a864886f70d01010b0500038201010004391b23aa25988676f73d539b9e192fbec89cb6d6fa19ffccdf6016267d2dba6d2c792e67f92393bf0ebb2ff1b64d535ce22dd85cd02b3194ba7f0ce6a3d8ecd8ad566f3cb627322d448122d957decc5a65c0e3968cf9c7c25b40e2039699239ce04d3327022ea73cb33285d1593bd848c5f695d8318f118d83cf01ee7da1256b9599ca12862236220958d9d062187d58f05bf1de7ce96e37e690fe3e55df26c5ea757efbe934545d94cbbc12738494ed1c3f2dd6163f16f430aa454ee522956c1b12a19f074b5e796a2891cc54fd760e8a06de0f583960c6ca309c5d413cfc9f3e688c013e15e6a09f094fbe38fb0ad92b76d62274697dd9b9d08b49143010 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe 2184 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe"C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
474KB
MD55d895d1c6cee56d206b6cd973479638d
SHA108fa15d13454b1113d3818133f7a10f3cb3dd451
SHA256bcfc362b42422cede445c8a119d454484b3842eb808b7ddf1b5aeb7242e06abb
SHA5128f2b3b76b84fc62b4f8660e4b6e32510c70db5b00ddccfcf4a41a1c5416b974b282cb375b60222884f3c04e9e97cf6f86223f93cadf3d45ebc641c6d703f077c
-
Filesize
44KB
MD5eccc93a46c56da30635aab9946d3773a
SHA1ebd3dc61655b938fbfc9371f8e3ba87e5c718caf
SHA256476a9a6ccf39353ca004118829dda91ff771906ea18f5db7db9a73044dda3bd8
SHA5124ad695ebeaa66cc19066431e86cd1064d0ac359733452effac36dcb98aafd4a5c7ce31925baaf33964520daf4e78718bf6a2294fd323ee33f1e8eddd311cca5c
-
Filesize
505KB
MD579fe5228b7ccdc88cf7ddba2893ea71f
SHA14313028e5354d66be81fd2103a16b16e1ad1a6f3
SHA2565850d403352d76e7f7ebda93a7bff5ab1ea57c91a54a2f6c2cfaf1c9d356d55f
SHA512f46380ccd2fcb8246206f176f17c1931d57c3bc1312c95e059cf9feab4bc392ad31fa6ffc6a1dac3b0bd70c5393ab1c2cf21729e357cb7c523d487dd92aacac3
-
Filesize
37KB
MD55df37d5f681e6510d70a7980ec1bd1ed
SHA14a6832c6ee35d6b834847a9c648edc028ea0d30f
SHA256932cb9dd22637532df47ed17f529649d959a7115077820d7e856299321d53a4b
SHA5122d13020417f9069a060561fefc2c3ee4519548b12ce0db4ece4447f6ad89e18c8677d8e89bc63cfe88a0145ed194c08dced82c5736e0b85d804dd7a0cb708d5c