0bac7211cd774d0358b65e7052bc2edca63f919016320454e9fda44126b7045f

Analysis

max time kernel
149s
max time network
140s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
falcon_ca.crt
Size 1KB
Sample260809-ltawpsyvet
SHA256 0bac7211cd774d0358b65e7052bc2edca63f919016320454e9fda44126b7045f
MD5 f8df8966e095c82bc6e8772e33c5b5d7
SHA1 7e0f7b5e14c3adb653c57b33de1c919db2e8e5cf
SHA512 e0ad7dbb9e772b1d37f522b77f326cd51b84c5792f8abcbaf7edbffda82c225805c6ef9307a5d43c25a8ba642101a4ec1fb71ee454bf04bdbf8cbe2eb1738885
TLSH
T1391182A57F42950830739125C4BB11C25DBD4AF8AA43FA3B4FE85410E6C0C88AC393AE
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion spyware trojan

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4728	rundll32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307425902674544"	rundll32.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Software\Microsoft\SystemCertificates\REQUEST	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\983A7EAA5E3E54B6136597B75BD495B9F4A7D697	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\983A7EAA5E3E54B6136597B75BD495B9F4A7D697\Blob = 0400000001000000100000005b2f50a719a0ac8bf9a7ddf32ed47ce70f0000000100000020000000a73bb1cce2803d25e1600b383088fee2f61f96ff5ec4ba7fdcc46b72c4e7047014000000010000001400000042e19ccb2d344f318e37c9ca82f09ef7ab53c6991900000001000000100000009d5d62d94d159ff83c0090a1ed8e236c030000000100000014000000983a7eaa5e3e54b6136597b75bd495b9f4a7d6975c0000000100000004000000000800002000000001000000e9020000308202e5308201cda00302010202141852913a8bc7ae907678c1b2ec7b85393193b38a300d06092a864886f70d01010b0500301a3118301606035504030c0f46616c636f6e204c6f63616c204341301e170d3236303830383038303034315a170d3336303830363038303034315a301a3118301606035504030c0f46616c636f6e204c6f63616c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100908bc9e7ae7f958a8530ec49e8a878712adf505743b3291c9d1c8aa3ba260acc2a6b6c9e34ea0da3388c6c9429dc244f17a9ff4d90fba39b4fc8a7897f315b5c9371dc5f728f119670ae17fa7a6f1bcee832104d36dbe8e479d92f7b26fe63c1a71817ba9f3409dbd5dcb1c32b0e9e09d82d75c8e9f82e549c0e11e752a32e621b0cb138ae173e529836c9acda1e499e53aaa57e711464862bdd4b7efd78e3a836054a256514cb0679baab47201c28e7149778263dbeb1869583355b14d2d2a4ae07f7351e5917870cb660b17c2dc65ae8458e307b5cfd4e05ccd66fc79526156475aee24701f53c35d428a7c41979986593d89038cd27a264abae8280a772590203010001a3233021300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186300d06092a864886f70d01010b0500038201010000413ca5e74ccf51fbbcb6f1d2bd6426f523fd6cb0ef90a70ccadea236d31854dcafe0d6b3952d7293ff7b9d4a12c6a77c15b9d8712517805e85c2e9a5ed21709970aa05c461870e3070e79089e39ad8389dc960a96e7054f5d2bce4f4eca3ff4aa44fe22d89a719f890ff435c027562f2f47ddc936bae8d565e9c342021602969283904f1610d9d2038ef82b5651979fe8cf9b329b82e53e8f3b8b70770d63f860a521b64ff31e6a2aba8c4cb737bebe0ce6f33948eb2579597474a5c89c65bf375fae2c7e47b11e460bd3656c3c7a5015c9c86abaf6b4962ae968d01284c2f7144d9900a52c476043ad1d3c09e90e2aaee31c8bf1effa34cd1612758bd8d18	rundll32.exe

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenCER C:\Users\Admin\AppData\Local\Temp\falcon_ca.crt
1⤵
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads