Analysis
- max time kernel
149s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 12:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe
- Size 976KB
- Sample260808-p17e2a1wct
- SHA256 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d
- MD5 2a4379dcd55579aedde17b71f701d5b1
- SHA1 8ec6c30593aa051aca2a665b03e0b2a3669592c7
- SHA512 ec27c7e206f8490fb6a232216555e29c8d3e2ee1ce900483001701f73c9fec8ff15a6a399aedcaaac41d006de34a38f2ac693455537a61048e81dd5be590c6eb
- SSDEEP 24576:7SmffR+8cR+MRocXnjpRdKxGGaWZpaPFjj:lffR+5ZRdK1ZpaN
- TLSH T1C0257C5AA7E001EAC567C179CD665603EB76B4191330BBDB0BE286561F23BE09F3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\YouthNetGuard\ca.crt.pem 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe File created C:\Program Files\YouthNetGuard\ca.key.pem 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe File created C:\Program Files\YouthNetGuard\mitm\ca.crt.pem 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe File created C:\Program Files\YouthNetGuard\mitm\ca.key.pem 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe - Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7\Blob = 030000000100000014000000ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c720000000010000001703000030820313308201fba003020102021075a7503271a65b9b47f0db53376b61fd300d06092a864886f70d01010b050030223120301e06035504030c17596f7574684e6574477561726420506172656e74204341301e170d3236303732303139303334315a170d3336303732303139313334315a30223120301e06035504030c17596f7574684e6574477561726420506172656e7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cc51552dad42375cafdf010a8ad7f3bcbd087b88ed236ec71ae0f0bd81db3054f629e467c420ad60eede951f80308245f88db8252439743edf2f240d5ab2f32088fc7b0f66f775f5adf25b11c9c98dd47307a5f5bf25e3e3aa6bb250336dfc341954e4fa11cb44f0104260a65173405bc5028b39f39db38eea148e0d2ef985c3055873cd9edbfff619ab12d5811f37da8566533708482eecf3da7be37789de0a9e1601a9d3e84c713ab93f62fe87d7f34e4158bbef3495e000b9b9f6350b33b0970ecc8d129b31856c73b68fda0cfac6b30674f31b00a9d3019e291679432d728bc47939a97d4b38c75988852bcb4dcd5dea3f2d9b0bc53008697ad05856a53d0203010001a3453043300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d0e041604145d256cd1d115497ea8d1ef33ac1d3e31834f5077300d06092a864886f70d01010b05000382010100a9c2354588cca8cfba7946a90821b41044e7ab82e2cfbb566fdcb96b680b977120e6f0d76a1d3325aaf93f72db068285636f4820987ae09eace583360c6c15af489b44d75f68ac3ef6d61ab858b7c57219e9a81fb4fd156826c847e75365d0ef8c78c9e164452914f8e312da4d6dc31ae44aee50a5526f3db8c29ed463e5994023e7fd84a0e563150b78ba14093c3a77830dcb0bf31b6835e21d062d416c28adcfefa1548d5899bbd4a70cbc1f1afabb62a7d861cd37780e990e992251b49d5f471955714daa494b427d5944f619842121c32ec8c485711d836bd1ac424c4b30a5d3c916d67700be03cbf98d76a1f1cf5ac8e3809c54001a77900bff3afe80ff 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 712 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 556 wrote to memory of 1440 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 89 PID 556 wrote to memory of 712 556 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe"C:\Users\Admin\AppData\Local\Temp\09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d.exe"1⤵
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query /TN YngPlatformGuard2⤵PID:1440
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /TN YngPlatformGuard /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR "C:\ProgramData\YngRuntime\run\WpnPlatformHost.exe --worker"2⤵
- Scheduled Task/Job: Scheduled Task
PID:712
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\YngRuntime\backup\ca.crt.pem
- Size 1KB
- SHA256 c0f21d6d5fd9786d764332ad3cba17e475973ff010caf5116ea43495fc3bd9ec
- MD5 1e7be881af4154118294a568cfd920e2
- SHA1 d25b2f8f79879810c838f5da02b3a73f000e962f
- SHA512 89431f9a0e1211e277162550b269a470489b9d340557b11c3b24d29bcabfddca08b39391df0196902e4af30abce4f69bbd6f3915c97fb7c4b79d149b215503e7
- TLSH T13421CAC595203C2C0EFDD39AB495D35E52F3D1A40FCA60A94B9A1454D72405D02AC904
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\YngRuntime\backup\ca.key.pem
- Size 1KB
- SHA256 3c49a662505321bf0e0445c3efa61da2cd173fcc8f5c260324183c3626b22303
- MD5 295dd0cf71637a14cb78ddfa416a437c
- SHA1 590d1bcf83303896f59a03d3a00a2e205d9aaead
- SHA512 54c44452f5149f9a134e5705a89ce1990de34240fa066b1dd5399ebba88287202a5b425919bf8846609161fb1ca0acd3d0f24a5c3325e509ef661c0e5f46162e
- TLSH T1A231D8501568FA364A0BC4D9EA4B27AEC4E0EF9BAFD428A98B0F21722120095057E25A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\YngRuntime\blocklist.txt
- Size 909B
- SHA256 a7279c5bd0143005ca2e6d4ae86322b73ebd67843ecad6ca558444fcc99cadd4
- MD5 e23973c424682b2e0e01a648a05180f9
- SHA1 3f3c25fcd42e241fe0315ca3860b4249281d6533
- SHA512 216df90cd5a0ec9270133111c7ee40acb55874adc0399990e06d3dc7ba9ec0f9a5464c5f94bdce02cbbc7a1ffebcce8a23d5e2b82407eda172859d1d4c0a35fd
- TLSH T148110203895A68C6317C2F3C2DD6150960BCB3E490BFF9C6C2A87D4DEA2449C21444BE
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\YngRuntime\device_id.txt
- Size 33B
- SHA256 807d5199b9960d20abe1cf159524eae700e64ad84de7aa476d4c679dc3c2620b
- MD5 50fdc2f4b6af3769c1daf87e0b41bfa9
- SHA1 d0b50248ff12700fda3013fd2ce4b2c2fc0e33b7
- SHA512 12f8c326c36a13474cda265b7ee836d7319df18c6d109cfdde093f2015cc1f53b2293d1b3b6b802d0ec32471e592ed18c2c064c7a8e06ef204d21fd8ea4c0df8
- MD5 SHA1 SHA512
- Path C:\ProgramData\YngRuntime\host7.log
- Size 4KB
- SHA256 8f181b04c8e1d8a71e69e59bb3f68fa7f421739cb2a399f439865b3275182e78
- MD5 a5f4a84f4bc8b04d5a6019bf43f019dd
- SHA1 c9335716fc40dbe73b72e78fdace45d1a0fe0f45
- SHA512 01e714d43a24fe11fca0cc3a1916983963e135896b007d71dd6cf68b6058a12ad0a5056c63ef41296b9d14a029977a6c46f3e7848468e6878b84988cf6bd5a22
- SSDEEP 96:Kzhfp9is/1w1o9ylejMlw99wLyMqC9cMlzhF9X9c9I9I9t9e9M9G9D9v909Y9u99:QhfpgMOogloMlw9WaMlzvRiiiHsaYpRU
- TLSH T1E191F4D5BEF8804FAC5A56595F431B3A7843F508AA0F2022B37561CB4CCA85CEDFB568
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\YngRuntime\host7.log
- Size 767B
- SHA256 2793ed0684e04da3635f0b5cca1bf041bd1fb223365f5f2ce085e0dd88edd241
- MD5 0dc624ce65383972b34d00d125580d7a
- SHA1 f821f12188a8d130bece012f709df74c14fe1ae6
- SHA512 f8c6c6731ab05d49edb90947d5182405e014a4d9a046a47e3fda45200d0c25ad6adcc0d544471d3e93cf548ac078f519a633726c3fae3dff8a1097cfd47eaa2a
- TLSH T12801B1E67CF9D06FDC5A1248CF830D35A19B710C6A5F3561B2BA415A18C54586CFF648
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\YngRuntime\ip-blocklist.txt
- Size 1KB
- SHA256 08a6e8e9beac9e507121c5b88fc9cd9602639cb147bb326d40c5a359524302ac
- MD5 5e8de36b777694a2b683445220fe0d6e
- SHA1 1a5d2de2d838138585800a97a73070c1f5ec2568
- SHA512 a4a8a328a80a4a6d0c3b319b866ce74eebf5a9cd185d6bcefa84d54052d26752ee116208ff96e99811bf569dc8488999891eca2bc07f24468e3648fb13ef57b1
- TLSH T18B21E80423DE5DF2DFD2C94AD3D28111214A83BB6647F698AFCBA681782C118B7F02C3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\YngRuntime\pac_mode.on
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512
- Path C:\ProgramData\YngRuntime\parent_unlock.sha256
- Size 65B
- SHA256 aab795a8c8cf23b82a97d87fd4e145a35c37d734802e5bf0d98fd3ad8893c010
- MD5 d2293d580969d3feb6bd82fc44c0deae
- SHA1 c389a400c76553118bc0c9b77ab659d0a9fb39e8
- SHA512 45fb51c111e3f8bccb7f646928bc1e40f6608d2129dff6acbf05e8db05bce16fb861ad05dfd1ff94d203b7a08515922b4b3f9323ab8f48f06d8fe2172c678ffe
- TLSH T1CFA002E846D68435E8668316C0A0646BB25687B566A660E5257168178270596CC1D434
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\YngRuntime\yng.pac
- Size 673B
- SHA256 d62421937783caf0c2561e3b6de0ece7f8f29cb275854859e4716276c80e52e2
- MD5 0b83dcf2c6a330f4d7ed348bf4ec3d2f
- SHA1 b11827635a70b43202f54c59457f535b41f197a4
- SHA512 8c90170b3bcd4eaf1db2108d2bf5b780d6499866231c4f24213c8472d583656200d71628a27ab87a9616da4c0e18953e5bf94737838bf21ebc8fab9a07facca8
- TLSH T18A019EED1ACAF23E631100348C1D5249E879DC30401DEE31E1AE58423FAAB64C2FBCA4
- MD5 SHA1 SHA512 TLSH