Analysis
- user interaction
yes - max time kernel
73s - max time network
64s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 07:21
Behavioral task
behavioral1
Sample
star.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
star.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
star_jewhunting.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral4
Sample
star_jewhunting.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target star_jewhunting.exe
- Size 493KB
- Sample260910-h65p3azdnf
- SHA256 64b5f1fe5d8593a2cee70d3b3a562b31a506e840ecd729531f7994c626c9bdcc
- MD5 5cf46a151c4c4aab5916b62f2ca72dfe
- SHA1 43641d9fdef2df3b945e1ac7b1c60b869402dc3c
- SHA512 3d0248e5c7b9126909bc428cce06c783bb920265f38a1a2d5af9fa100e88a6ab42d7c5399fa2d95a4bc36d3e9eb11be03bd910bdc068bb9369cfb8661136c100
- SSDEEP 6144:ZIXYXaam0O0d+AoVHsl5R5dm+m02BktZrdwSE5BENzCucxiltMojGmu9zR0:ZIkHoVMl5RjE0ektZr2SzNz0itMz
- TLSH T1B7B47C05F7A100F9E5B7C178C9A64502EB32BC855371ABDF23E49A9A1F23BD09E39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts star_jewhunting.exe - Executes dropped EXE 1 IoCs
pid Process 300 WinDivert64.sys - Loads dropped DLL 1 IoCs
pid Process 5960 star_jewhunting.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4756 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2A90DEB5E8F7B7B4AE4A1FF77F09CD18715DCD72\Blob = 0300000001000000140000002a90deb5e8f7b7b4ae4a1ff77f09cd18715dcd722000000001000000420300003082033e30820226a00302010202146349e96678318404e2907ba2bcda7b8cc2a54f09300d06092a864886f70d01010b0500303f310b300906035504061302555331133011060355040a0c0a4a657768756e74696e67311b301906035504030c124a657768756e74696e6720526f6f74204341301e170d3236303930353138353831345a170d3336303930323138353831345a303f310b300906035504061302555331133011060355040a0c0a4a657768756e74696e67311b301906035504030c124a657768756e74696e6720526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aede36719364dbf10827251387b52ab3de94a0767a578b3bc94274409842a4744d59f59673f534cf261d946bd558b1bd684fff822dfc661925dafc4b8be213ef09ed93ddfcf64fd0323511a4f6514ffb891055924a84ca8b0ad60fc84434c71786d8dcf113b14029bd56e611526fc4d964cccfa446f4e8c46b442e4202bfcc4a9ab8943bba400cf82a7fff51ac8a5ef2195fb29f7a0633b0479f22dc13e364dc178d54ce9a8c37cb6d2d10a138f85fade7581d5a4617049a1697d4f98fbefe8fa82d2e2f0ef18bb235ee7da2544482eb82465b38dab5991a81928f8067ddd20cc98b92489d79518c1c8a2b9f1ffc7c92012cdf476cca36c7156491331f26fd150203010001a3323030301d0603551d0e041604147e1eb886e34c5a580cb7bf76b8c32c3053f14287300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382010100392366099954ea4270fc2f116a4acf0be8a750239cbe8e4acb343af404ce90462e0ff0d8b42631c824f3c702b26041730707a861ed0da9b7c27a7b558aaff168add40035b6e9a8613922551d68cc7a23ed0e14e8883996eca37599cb58b1232dc9bb8ae401a9a8109d850aa19cdeecab09a04869e9fe59ae12e04d81f4cbb8b6897fdf7aea06edcf4b53307a4cb6e68787f11db315bbcd157be3b96669d028d345dfad2fdf7769eee6140116eeb18a516e8a2bf71318ce64557c34c98e0e8da1515f34e767921862a24d1d768fadd0833fd7994cc3f3af785f136e1328c275ff39c1723718e8fba99fd23be67ebd7232b8842b8e13703ba06dec8c4d3a62c5d8 star_jewhunting.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4912 ipconfig.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2A90DEB5E8F7B7B4AE4A1FF77F09CD18715DCD72 star_jewhunting.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe 5960 star_jewhunting.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 824 Process not Found - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5960 wrote to memory of 4756 5960 star_jewhunting.exe 90 PID 4756 wrote to memory of 4912 4756 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\star_jewhunting.exe"C:\Users\Admin\AppData\Local\Temp\star_jewhunting.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
PID:4912
-
-
-
C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\WinDivert64.sysC:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\WinDivert64.sys1⤵
- Executes dropped EXE
PID:300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DiagnosticsHub\star\WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH