Overview

overview

8

Static

static

1

D-TRUST_Ro...09.crt

windows7-x64

8

D-TRUST_Ro...09.crt

windows10-2004-x64

8

D-TRUST_Ro...09.crt

windows7-x64

8

D-TRUST_Ro...09.crt

windows10-2004-x64

8

DigiCert_A...CA.crt

windows7-x64

8

DigiCert_A...CA.crt

windows10-2004-x64

8

DigiCert_A...G2.crt

windows7-x64

8

DigiCert_A...G2.crt

windows10-2004-x64

8

DigiCert_A...G3.crt

windows7-x64

8

DigiCert_A...G3.crt

windows10-2004-x64

8

DigiCert_G...CA.crt

windows7-x64

1

DigiCert_G...CA.crt

windows10-2004-x64

8

DigiCert_G...G2.crt

windows7-x64

8

DigiCert_G...G2.crt

windows10-2004-x64

8

DigiCert_G...G3.crt

windows7-x64

8

DigiCert_G...G3.crt

windows10-2004-x64

8

DigiCert_H...CA.crt

windows7-x64

8

DigiCert_H...CA.crt

windows10-2004-x64

8

DigiCert_T...G5.crt

windows7-x64

8

DigiCert_T...G5.crt

windows10-2004-x64

8

DigiCert_T...G5.crt

windows7-x64

8

DigiCert_T...G5.crt

windows10-2004-x64

8

DigiCert_T...G4.crt

windows7-x64

8

DigiCert_T...G4.crt

windows10-2004-x64

8

Entrust.ne...CA.crt

windows7-x64

8

Entrust.ne...CA.crt

windows10-2004-x64

8

Entrust_Ro...ty.crt

windows7-x64

8

Entrust_Ro...ty.crt

windows10-2004-x64

8

Entrust_Ro...C1.crt

windows7-x64

8

Entrust_Ro...C1.crt

windows10-2004-x64

8

Entrust_Ro...G2.crt

windows7-x64

8

Entrust_Ro...G2.crt

windows10-2004-x64

8

Resubmissions

21/06/2025, 07:05

250621-hwqhdsxnv68

11/02/2025, 03:29

250211-d16myswldk8

11/02/2025, 03:24

250211-dx9v7swnbw8

11/02/2025, 03:18

250211-dt1hcswme18

11/02/2025, 03:00

250211-dhpxgswlax8

11/02/2025, 01:29

250211-bv85satpdq8

11/02/2025, 01:14

250211-bltnqstmgr8

10/02/2025, 23:56

250210-3y8f7sspdy8

10/02/2025, 23:39

250210-3nh4kasmes8

10/02/2025, 23:26

250210-3e57qssjbj8

Sharing

Copy URL Twitter E-mail

General

  • Target
    mozilla.zip
  • Size 353KB
  • Sample250211-dhpxgswlax
  • SHA256 c85a87adee4c099081c0be6a69d7468280f4d289bde882c66af86d023d32288a
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwarediscoverypersistenceprivilege_escalationstealer

Malware Config

Targets

    • Target
      D-TRUST_Root_Class_3_CA_2_2009.crt
    • Size 1KB
    • SHA256 a00b8aa918457f5e7e58457b5e2f80d640fa77cc290572aaab1ae7b4734a9528
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral1behavioral2
    • Target
      D-TRUST_Root_Class_3_CA_2_EV_2009.crt
    • Size 1KB
    • SHA256 f81ceeaf6341513ef391ab3ea3302e8b2fb2c1527752797bba9b20ca22048b3c
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral3behavioral4
    • Target
      DigiCert_Assured_ID_Root_CA.crt
    • Size 1KB
    • SHA256 b52fae9cd8dcf49285f0337cd815deca13fedd31f653bf07f61579451517e18c
    • MD5 SHA1 SHA512
    Score
    8/10
    adwarediscoverypersistenceprivilege_escalationstealer

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral5behavioral6
    • Target
      DigiCert_Assured_ID_Root_G2.crt
    • Size 1KB
    • SHA256 660b5aa96668c5162f4af6b0a01241d8527aef8fa8a5307a7033b83c3de4a72d
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral7behavioral8
    • Target
      DigiCert_Assured_ID_Root_G3.crt
    • Size 851B
    • SHA256 c4fa4cc30be6aee0a4c0dff81f28768eedd83e8d4934a42f82179cbfa61f13ad
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral10behavioral9
    • Target
      DigiCert_Global_Root_CA.crt
    • Size 1KB
    • SHA256 39fdcf28aeffe08d03251fccaf645e3c5de19fa4ebbafc89b4ede2a422148bab
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral11behavioral12
    • Target
      DigiCert_Global_Root_G2.crt
    • Size 1KB
    • SHA256 5d550643b6400d4341550a9b14aedd0b4fac33ae5deb7d8247b6b4f799c13306
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral13behavioral14
    • Target
      DigiCert_Global_Root_G3.crt
    • Size 839B
    • SHA256 1914cd2d4cde263315f9e32c7683fc0e1b921919ad12b256d49bf782011c03cc
    • MD5 SHA1 SHA512
    Score
    8/10
    adwarediscoverypersistenceprivilege_escalationstealer

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral15behavioral16
    • Target
      DigiCert_High_Assurance_EV_Root_CA.crt
    • Size 1KB
    • SHA256 d98f681c3a7dce812b90bf7c68046827f3bf5607357f1e4918c5dc813b359bf1
    • MD5 SHA1 SHA512
    Score
    8/10
    adwarediscoverypersistenceprivilege_escalationstealer

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral17behavioral18
    • Target
      DigiCert_TLS_ECC_P384_Root_G5.crt
    • Size 790B
    • SHA256 05161ad2ac04a0df956ef803e127aa877cc5131e0a727ed8e5de43f02e8868c4
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral19behavioral20
    • Target
      DigiCert_TLS_RSA4096_Root_G5.crt
    • Size 1KB
    • SHA256 fe64d4b3ae749db5ec57b04ed9203c748fff446f57b9665fad988435d89c9e43
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral21behavioral22
    • Target
      DigiCert_Trusted_Root_G4.crt
    • Size 1KB
    • SHA256 ce7d6b44f5d510391be98c8d76b18709400a30cd87659bfebe1c6f97ff5181ee
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral23behavioral24
    • Target
      Entrust.net_Premium_2048_Secure_Server_CA.crt
    • Size 1KB
    • SHA256 24e0277c0c028497c6b0abbbf7163ec3ae7b341cadfb0b90bc00c4ad642172cc
    • MD5 SHA1 SHA512
    Score
    8/10

    • Blocklisted process makes network request

    behavioral25behavioral26
    • Target
      Entrust_Root_Certification_Authority.crt
    • Size 1KB
    • SHA256 745bd29be45667514b4000e9cdb70cdecad0f02c78232ed722f64f7f80436e35
    • MD5 SHA1 SHA512
    Score
    8/10

    • Blocklisted process makes network request

    behavioral27behavioral28
    • Target
      Entrust_Root_Certification_Authority_-_EC1.crt
    • Size 1KB
    • SHA256 a0d7e56b32b767e076bd7d05ce1779dbe3656d0a02a9abe711fc79640b9f7fbe
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral29behavioral30
    • Target
      Entrust_Root_Certification_Authority_-_G2.crt
    • Size 1KB
    • SHA256 646db48fa7794bcab4581f264ff3fad4cff7bbd24f5e8bb170d4f602b6caf828
    • MD5 SHA1 SHA512
    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Browser Extensions

1
T1176

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

5
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
1/10

behavioral1

Score
8/10

behavioral2

discovery
Score
8/10

behavioral3

Score
8/10

behavioral4

discovery
Score
8/10

behavioral5

Score
8/10

behavioral6

adwarediscoverypersistenceprivilege_escalationstealer
Score
8/10

behavioral7

Score
8/10

behavioral8

discovery
Score
8/10

behavioral9

Score
8/10

behavioral10

discovery
Score
8/10

behavioral11

Score
1/10

behavioral12

discovery
Score
8/10

behavioral13

Score
8/10

behavioral14

discovery
Score
8/10

behavioral15

Score
8/10

behavioral16

adwarediscoverypersistenceprivilege_escalationstealer
Score
8/10

behavioral17

Score
8/10

behavioral18

adwarediscoverypersistenceprivilege_escalationstealer
Score
8/10

behavioral19

Score
8/10

behavioral20

discovery
Score
8/10

behavioral21

Score
8/10

behavioral22

discovery
Score
8/10

behavioral23

Score
8/10

behavioral24

discovery
Score
8/10

behavioral25

Score
8/10

behavioral26

Score
8/10

behavioral27

Score
8/10

behavioral28

Score
8/10

behavioral29

Score
8/10

behavioral30

discovery
Score
8/10

behavioral31

Score
8/10

behavioral32

discovery
Score
8/10