13fafb1ae2d5de024e68f2e2fc820bc79ef0690c40dbfd70246bcc394c52ea20

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
250801-gpxsfsdj3y.exe
Size 232KB
Sample260424-jd7jmacw6p
SHA256 13fafb1ae2d5de024e68f2e2fc820bc79ef0690c40dbfd70246bcc394c52ea20
MD5 1bc5621a4818f2124ac085da21f607ca
SHA1 60f2c0932b114e99eb81e1ace478b5f5d0fa4d27
SHA512 0ce6ff2aea3c2381b17a26840d2ccb8e7621773b167aebe530a06b936243f786ee3640c3cb9a56a297388b691ccbe0611d85c5167ff9ad2e74a4a19a15869361
SSDEEP 3072:7UAhJPJwCZQw5eA8H/Y+rjTMRGX/C32kjWb/nE3LcgZQz35S0pzoY46CQ1gqLMGx:IA5RRqUjWrnEPQzbohq1LM8
TLSH
T1D5344A0973D50CF9E837813988525A46EA72B8150771DFAF13A0426ADF776E0ED3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
2084	certutil.exe
2072	certutil.exe

Modifies visibility of existing users in the login screen 1 TTPs 1 IoCs

A user account was hidden or made visible on the Windows login screen through a registry modification.

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\UpdatusUser = "0"	250801-gpxsfsdj3y.exe

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\UpdatusUser = "0"	250801-gpxsfsdj3y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	250801-gpxsfsdj3y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	250801-gpxsfsdj3y.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\defaults\pref\wincerts.js	250801-gpxsfsdj3y.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2084	1804	250801-gpxsfsdj3y.exe	80
PID 1804 wrote to memory of 2072	1804	250801-gpxsfsdj3y.exe	82

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	250801-gpxsfsdj3y.exe

C:\Users\Admin\AppData\Local\Temp\250801-gpxsfsdj3y.exe
"C:\Users\Admin\AppData\Local\Temp\250801-gpxsfsdj3y.exe"
1⤵
- Modifies visibility of existing users in the login screen
- Modifies WinLogon
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1804
- C:\Windows\SYSTEM32\certutil.exe
  certutil.exe -f -Enterprise -addstore root "C:\Users\Admin\AppData\Local\Temp\crt5B0C.tmp"
  2⤵
  - Installs a root certificate to the trusted certificate store
  PID:2084
- C:\Windows\SYSTEM32\certutil.exe
  certutil.exe -f -Enterprise -addstore ca "C:\Users\Admin\AppData\Local\Temp\crt5B6A.tmp"
  2⤵
  - Installs a root certificate to the trusted certificate store
  PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crt5B0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\crt5B0C.tmp
Size 1KB
SHA256 105107a419254793b9c288c5bbbab160edd56c5702e08129bc3e1bc33e47d05d
MD5 80997dd721cc4f9a3086a27f9e6cf842
SHA1 cfdf0668354f5d4c695106d12fb0bd2c00a431a4
SHA512 9834324abef23855cdc2ec5f18162988559b030b12f80a92a2c990dc67b0787ddcbbd2fe1a7150f7f890663233c5740e395558f7a8e1a1c51a2a434a694d8ac4
TLSH
T11721A5920D323C3B489384E8D3C7932998DA9C7B8191F96E5D4861A38549B1814BE508
MD5 SHA1 SHA512 TLSH

Submit Download

crt5B6A.tmp

Path C:\Users\Admin\AppData\Local\Temp\crt5B6A.tmp
Size 1KB
SHA256 188c23480af5a9dc3b5a11e007b57747cfd06572ff6e399e853d7f6510a53ea5
MD5 0acad10348ad222154592f889965c3f6
SHA1 812387a5f97d323a944dbe3fea5dcce79e764bb7
SHA512 65d208069fe258f1865c27e8d39ee30dac445aa362079920a6ff249e105a1f26203d7e64b052e5563b238375f6bcd8fa03fa810d56468a1e71d8c4ad05f34235
TLSH
T18A21B6581F818DCE0CE7EAACC05F11318E2811575A6AF1AC2AD26769C3A1D4A5519846
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1804-11-0x000002051E210000-0x000002051E32E000-memory.dmp

Download

memory/2072-9-0x0000016703E90000-0x0000016703EA2000-memory.dmp

Download

memory/2072-7-0x0000016704030000-0x000001670414E000-memory.dmp

Download

memory/2072-8-0x0000016703E80000-0x0000016703E8C000-memory.dmp

Download

memory/2084-2-0x000001E3AA470000-0x000001E3AA58E000-memory.dmp

Download

memory/2084-3-0x000001E3A8760000-0x000001E3A876C000-memory.dmp

Download

memory/2084-4-0x000001E3A8770000-0x000001E3A8782000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads