Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ChrisAim_patched.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ChrisAim_patched.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target ChrisAim_patched.exe
- Size 4.1MB
- Sample260710-vmfm2sfw7v
- SHA256 3dd62c96d97eae0f1fffed29a0f3e84de6ccca8d5b5d0fb13f4cf2aa1133a31c
- MD5 e179b0277eeb02f6116e5e81db677074
- SHA1 a5582cc1e3a6eba35f9b79035e774fa5477f37f7
- SHA512 07e4472bbdd750c079843795df9b775c727bc06b2aa83e4d13f33e9437b95526144e70e55407bf899eeac6ecc3dc8b16ce26b8ba8f7d20802590956ec6da87e0
- SSDEEP 49152:kFDp67Xuzb8nKjlVqA5WUd6ZXDcNaQ5dJWp/xctmyZXTDY74+DvojZzPHP2vleWI:kFufnKT7d6ZXu6IM174+NvodemP
- TLSH T1D716F287A2BD81E8C6B7D038D547A50BE7767C4407204BEB57E08A696F63BF10E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 ChrisAim_patched.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 ChrisAim_patched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe 2012 ChrisAim_patched.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2012 ChrisAim_patched.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2012 ChrisAim_patched.exe