Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 12:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
chrome-firefox.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
chrome-firefox.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target chrome-firefox.exe
- Size 248KB
- Sample260909-pmlamscb23
- SHA256 526f39c33a9a951d79c56633b7bd18819e3270b5d13646e054c74cb441c98791
- MD5 ff415a2a8e25005813469f5dd1a1d705
- SHA1 bcc9245fa8c789676ea53ccde16dc9e7f7b59426
- SHA512 426ea6ac4b8372e81e0b405e3ae297f3be68821c221d49c3df0d9cebb0815bfe838a55190bcb23ba2d01eebcead2087b58b684082ed84f347f979b19ae6a811e
- SSDEEP 6144:G3ywjbkScEoeL4xAKLNPWfWTBqVgE1lJb:ubkluL4xAKZPWfWTsVxlJb
- TLSH T1F6449E223390C473D5A3167694EA87F96BB6B8314934810BB7C43F6E9E363E2D621747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4204 Ninite.exe - Loads dropped DLL 2 IoCs
pid Process 4204 Ninite.exe 4204 Ninite.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Ninite.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chrome-firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ninite.exe - Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F chrome-firefox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba chrome-firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Ninite.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Ninite.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Ninite.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4204 Ninite.exe 4204 Ninite.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeTcbPrivilege 4204 Ninite.exe Token: SeCreateTokenPrivilege 4204 Ninite.exe Token: SeAssignPrimaryTokenPrivilege 4204 Ninite.exe Token: SeLoadDriverPrivilege 4204 Ninite.exe Token: SeBackupPrivilege 4204 Ninite.exe Token: SeRestorePrivilege 4204 Ninite.exe Token: SeDebugPrivilege 4204 Ninite.exe Token: SeTakeOwnershipPrivilege 4204 Ninite.exe Token: SeLockMemoryPrivilege 4204 Ninite.exe Token: SeIncreaseQuotaPrivilege 4204 Ninite.exe Token: SeMachineAccountPrivilege 4204 Ninite.exe Token: SeTcbPrivilege 4204 Ninite.exe Token: SeSecurityPrivilege 4204 Ninite.exe Token: SeSystemProfilePrivilege 4204 Ninite.exe Token: SeSystemtimePrivilege 4204 Ninite.exe Token: SeProfSingleProcessPrivilege 4204 Ninite.exe Token: SeIncBasePriorityPrivilege 4204 Ninite.exe Token: SeCreatePagefilePrivilege 4204 Ninite.exe Token: SeCreatePermanentPrivilege 4204 Ninite.exe Token: SeShutdownPrivilege 4204 Ninite.exe Token: SeAuditPrivilege 4204 Ninite.exe Token: SeSystemEnvironmentPrivilege 4204 Ninite.exe Token: SeChangeNotifyPrivilege 4204 Ninite.exe Token: SeRemoteShutdownPrivilege 4204 Ninite.exe Token: SeUndockPrivilege 4204 Ninite.exe Token: SeSyncAgentPrivilege 4204 Ninite.exe Token: SeEnableDelegationPrivilege 4204 Ninite.exe Token: SeManageVolumePrivilege 4204 Ninite.exe Token: SeImpersonatePrivilege 4204 Ninite.exe Token: SeCreateGlobalPrivilege 4204 Ninite.exe Token: 31 4204 Ninite.exe Token: 32 4204 Ninite.exe Token: 33 4204 Ninite.exe Token: 34 4204 Ninite.exe Token: 35 4204 Ninite.exe Token: SeDebugPrivilege 4204 Ninite.exe Token: SeAssignPrimaryTokenPrivilege 4204 Ninite.exe Token: SeTcbPrivilege 4204 Ninite.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2252 wrote to memory of 4204 2252 chrome-firefox.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\chrome-firefox.exe"C:\Users\Admin\AppData\Local\Temp\chrome-firefox.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\ddc1f3b0-ac49-11f1-831f-d6aaaa94a526\Ninite.exeNinite.exe "392787023274694ac5d40ea531c2fe4fb2a69ce9" /fullpath "C:\Users\Admin\AppData\Local\Temp\chrome-firefox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
- Size 1KB
- SHA256 4d598b6758491aef4ad3f115fe794093e8f7eac812317228e2f4a3467306a8b9
- MD5 45c5977dfb3fcf292d27e69e29c1624d
- SHA1 f2e173ab552591eb869e60fde9d8b726092a6708
- SHA512 8593d08b98607cecf2c636b84d472a527151dc3ef73165b7ba4512bb654b6a3debf6bb93c2f052cb8ab8baf51bcc3baa8ef94a81f5ebe4768ec3cf375d9ea6ff
- TLSH T17721C4F21FB968A0ED921E8A04ECC33A7D7071DEAAD18C22903141732A483B3170D08E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F
- Size 713B
- SHA256 95a6edbe0d5c25a9e918e0f74cc2ceb477bf64cff908f62020b6945896af972d
- MD5 6cca32627bc157de4fd3900164c6469d
- SHA1 e1481925d1f4160f27054fed68ccc56d7ecbfef1
- SHA512 7455203857745fc818cee4414a100f75750f262daaed39ed5f852840dfc7422b167022b01cbdc436297aa1f3bcf15a8ffe57c9a7b3c2eddc16e61349b75eabbb
- TLSH T18B0144A40F1461267BC2F816AA82CFEFCD7043E2B925A41E97588FA45D61BE41DE114A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
- Size 438B
- SHA256 2052ffbd375daa2f6e38031402967c87648f51a5b86fcbc2b9636081310b22d4
- MD5 9000d8cf3fdb9ed1812f5bd62d66004e
- SHA1 82edca93118b9dd163af33d7b00124406362974d
- SHA512 9186898cd98b0388f762c052c8cd8a27d6fa32c99cdec5f3a4c3eb16b768fe71112896bc7a968ea20f642ce474657d95fc17200f10edb45a19a796bb82d0f954
- TLSH T1BEF0222CAAFF421DF637EAB507CE2720C962F0368805A3B593F112182700D40AC33A02
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BCB67D7ECB470284AF35679F339E879F
- Size 276B
- SHA256 0996ea3b8d03e8b9a0e8fe973270e4ac5f50b325f7cfa058ba3391baf0960a81
- MD5 2f02c9cb338fc88ffab5b56eaffcc5d6
- SHA1 e813cbf6770bdb3f6781d5fd90c19734e068b6dd
- SHA512 fb51e7ec5d7dc200325db1229810f64f88f143704f5ffc45c97b8e695c21feb0c0a5d66188782101687cf0e5eb02aac5c0d85eb6d5a9aa0aed593329ecb44675
- TLSH T1C4D05E2947B94323F926CB39AAB10911AE33A901B542CB584BB4064C59A4F006C71B0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\07882030-ac4a-11f1-831f-d6aaaa94a526\Ninite.dll
- Size 414KB
- SHA256 16f1b6883b73a758a1959a4e3b0cba5bee03f2fa45e451f941afa168f54ad938
- MD5 c44b6c52d403ff8331dc796426617c94
- SHA1 5776c5f469792f20adc4ea620c2e8e5c81d08aeb
- SHA512 7f38773f235b2063a509b1f39cb385721504d872d035eb92add21b19b41144076f26118f070058187696ab7c1739c45ee404a8963aee9ca5a7a26261c0193a82
- SSDEEP 6144:JB7Eeseb9MhRERxf4xFj8kCnl8aeNPCR+JOhlMi7ksvmacD54Buf:JBaeZzf4xFj8EPnBi7BvmZD5cW
- TLSH T15994AD21F9458436D66F06303528DA651D7DBC717FE0D9CBA3C01DAEA9726C0EB24B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\2e2237f7-ac4a-11f1-831f-d6aaaa94a526\Ninite.dll
- Size 1.7MB
- SHA256 c63fd2680fa7bbb6b7736257dd8d995e4ca2d0db1bf1d9909da9a1eff85068cd
- MD5 780a9399146febdaf770c03b4b68a1bf
- SHA1 caff092f1ca05755d3eab3e7edf88096ebcba12e
- SHA512 e112151a9495f3943e5338037eef5da9fdc86064ee0668c03d87139d841fb7869633716da28036d4472aa49633a5f14f4144f9d4fb92847df672c3871702efb2
- SSDEEP 49152:/FyJS7/8jVM1OAHmOp0fYrpH5wwhEFqfeI/t9UEDWqkL1o0hRS8K:/Fh7EjVqOhOp0foytFqoEDn
- TLSH T18F858E23B699C439E07E0270752C97552AB6FC304A72C49B77D03B8E79B8BC1A625F17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ddc1f3b0-ac49-11f1-831f-d6aaaa94a526\Ninite.exe
- Size 253KB
- SHA256 fdafd7c0d3f5346ab9da9f64d55f34e22d5a202bd8344d3dbb77041bccc7e4b6
- MD5 54fb4531a5f78d9ebdf8101269f0cf46
- SHA1 6d83b95727c75a8baab90ec6a978636004ac3cad
- SHA512 f664c1df9940343e0037a903be5e586c1ef327d550445d6366038fe8bc710eb197bcb7dbbeaf86c429b68e27648d7804a37757d6ec487c9298c753ea5b3724b4
- SSDEEP 6144:sTJdzh0mAEz6/cmx9iMg2fOXxWWQpnckniTBqerRVE0oP:obh0mA3iMlWBApckniTsCEJP
- TLSH T14A449E2133D0C033D1631635A6EB87FA5BB6B4726531888BB7D92F3D6E622E1E614347
- MD5 SHA1 SHA512 SSDEEP TLSH