24092026_0045_23092026_20260923.img.zip
- SHA256 716e86d2b15f65aeea75d028129d5c1d407d64828a1ab717a048f46aa234ef38
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
20260923.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
ttdrecord.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
ttdrecord.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target 24092026_0045_23092026_20260923.img.zip
- Size 469KB
- Sample260924-a4c82aaa34
- SHA256 716e86d2b15f65aeea75d028129d5c1d407d64828a1ab717a048f46aa234ef38
- MD5 b0b3387f6823f6b0ab6eac098060061f
- SHA1 b54f0042a3d35e7a05ea9b6f8adc2adeccdf8093
- SHA512 092648bb48f791319a311f2cd39d3b7e19bd0a94b10b999186771c14d6025b4a0fb98cf17c94a7c149dd35850a51c603ee1e02d9cef67c086ef46035c3da4f5a
- SSDEEP 12288:02RkpLB5S2M38hAZUXhFxBLvSeGeMO/NrHzB2K5cfV2lu:02RkJBRMM6C3v7GevH1P5A
- TLSH T1BBA423B8D250ABE1D44FFAFB441515196600C0613CA6A8B35ED404DF0D6FF9BB0EAE8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack002/ttdrecord.dll - DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/ttdrecord.dll
File Explorer
-
24092026_0045_23092026_20260923.img.zip.zip 469KB
-
20260923.img.iso 1.2MB
-
20260923.exe.exe 70KB
-
ttdrecord.dll.dll 544KB
-
z2KB
20260923.img
- SHA256 ef405d258d46e4b2a2b6b4537d80dcb06240b6fcefa99b646ce7786e6f623950
- MD5 fba8dd22410edf282fdf0df1ed5822ae
- SHA1 bfcf3492252e6eaf9ed8d7f00b05929c1b85d19c
- SHA512 987a7d3ce572ae219f895cb4692f251d88d84a9ee4a978c8bc26e5cf8682be6885bb01e2e1fc089f5bc1589bfd8b266364f1ea7a829a698203f0077df49f1f7c
- SSDEEP 12288:HOzxS381RWDY1ZN6XuqUXDFxBLBSgSeMOrNtHzBPdAVb8c+S:HOVS381rZN6XuhBvSepH1PA4xS
- TLSH T1EE45E0D17680C073D5AA35350939D6B6867EB9320B60C9DB77CC49BE0F313C19A35AAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
20260923.exe
- IMPHASH f60b40636a512bd0bfe6ecf41cf49cbb
- SHA256 5a84da32e9eb7e227a1ed095f3dd1a66569ad803fdbe60abac45c929cdd20ca4
- MD5 f0c8fecf1150a61cc6fc5b658380489a
- SHA1 0e5f2ba77ce78e1336474da1f18022a66b39ff8f
- SHA512 d2f0b1e8fd8e450d0c4e1b73baf3a46095f4b6945d2f010de5e9e73dd478cf1b6dc36eaa207d229cfbaa27617641ee856d4ec8e9272fe575081c439f417f5ce6
- SSDEEP 1536:MvSDABjM2yEU8FMHgRHKizRsk9noGmESQ5qczJe8s4TIe8MEP0TzO:zsFM2yBZHqxzR1VSQ5qkTjEcT6
- TLSH T192637E53B7804532C65236701D3EE6EAA63F96B24F5055C3576883BD2F313E18A392AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
98:b2:80:20:56:a7:f9:06:ae:18:8e:7d:d1:78:22:59:33:5d:a3:72:14:12:63:f5:3c:4e:6d:3a:74:84:8c:10
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f3:c5:0a:43:ae:03:cc:1d:31:00:01:00:00:01:f3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
22240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
TTTracer.pdb
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__acrt_iob_func
fflush
__stdio_common_vfwprintf
getc
fputs
__stdio_common_vswprintf
__p__commode
api-ms-win-crt-runtime-l1-1-0
terminate
_crt_atexit
_invalid_parameter_noinfo
_seh_filter_exe
_set_app_type
_configure_wide_argv
abort
_get_initial_wide_environment
_controlfp_s
_initterm_e
exit
_exit
__p___argc
__p___wargv
_cexit
_register_onexit_function
_register_thread_local_exe_atexit_callback
_errno
_initterm
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_c_exit
api-ms-win-crt-string-l1-1-0
_wcsnicmp
strcpy_s
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleExW
LoadResource
SizeofResource
GetModuleHandleW
GetProcAddress
LockResource
GetModuleFileNameA
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
CreateEventW
LeaveCriticalSection
ReleaseMutex
EnterCriticalSection
WaitForSingleObject
SetEvent
CreateMutexExW
ResetEvent
ReleaseSemaphore
InitializeCriticalSectionEx
CreateSemaphoreExW
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
api-ms-win-core-file-l1-1-0
GetFileAttributesW
CreateFileW
WriteFile
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwind
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsSetValue
FlsAlloc
FlsGetValue
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-core-kernel32-legacy-l1-1-0
FindResourceW
GetSystemWow64DirectoryW
ttdrecord
ExecuteTTTracerCommandLine
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_calloc_base
_callnewh
_set_new_mode
_free_base
malloc
free
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=10, id=259, version=27412,
count=15, id=260, version=27412,
count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=122, id=1, productName=Unmarked objects,
count=4, id=265, version=27412,
count=44, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
ttdrecord.dll
- IMPHASH 51d97130954dccd5a3a9218ef780e7f1
- SHA256 a153f7f115871392379e939090763baa3dac45d9c16347439856d363c65e4b14
- MD5 d7d051b334be11eccc1531dfe04b1600
- SHA1 6941a59d173a8d0c46c68895b3789373dadbd48a
- SHA512 cc2421f99671b76ca08a7e4c0cad2988319acaf810bf0950fbe5e5deda71cb128b433795ee51144ce49484d53c7abb7be3ab12356420aacbaa59a5cbc065e124
- SSDEEP 12288:sRWDY1ZN6XuqUXDFxBLBSgSeMOrNtHzBPdAVb8c+2:srZN6XuhBvSepH1PA4x2
- TLSH T1EAC4E1D07490C0B3D9BE35354529DA7646BEB9330B64C9EBA7C44CBF4F302C1A9359AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Password
infected
PE Signature issue
Digest
c8:64:11:6f:bf:4a:77:88:a8:1f:1d:30:36:74:3a:65:e7:53:dd:aa:39:86:76:4f:33:cd:9e:20:23:02:c6:49
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f3:c5:0a:43:ae:03:cc:1d:31:00:01:00:00:01:f3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
36839
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleFileNameA
GetFileSizeEx
VirtualProtect
VirtualFree
GetCurrentProcess
ExpandEnvironmentStringsW
VirtualAlloc
GetModuleFileNameW
CreateFileW
GetFileAttributesW
SetFileAttributesW
Sleep
GetTickCount64
ReadFile
CloseHandle
FreeConsole
CreateThread
GetCurrentDirectoryW
GetModuleHandleW
CopyFileW
IsDebuggerPresent
WriteConsoleW
HeapSize
SetStdHandle
FreeEnvironmentStringsW
CreateDirectoryW
GetProcessHeap
GetProcAddress
HeapAlloc
GetModuleHandleA
GetLastError
HeapFree
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
user32
MessageBoxA
advapi32
CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptImportKey
CryptReleaseContext
CryptDestroyKey
shell32
ord680
ole32
CoInitializeEx
CoGetObject
CoUninitialize
DebugCreate
ExecuteTTTracerCommandLine
Name
.text
Size
158KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
309KB
Virtual Size
311KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=35222,
count=163, id=261, version=35222,
count=20, id=260, version=35222,
count=16, id=260, version=30034,
count=20, id=259, version=30034,
count=67, id=261, version=30034,
count=11, id=257, version=35222,
count=124, id=1, productName=Unmarked objects,
count=3, id=265, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=258, version=30159,
z
- SHA256 520048576f64feb36200cd774bbcc35d4fcf7fd4cd84ffb202e7873fa48c9eb2
- MD5 423d68f1a73409e8de959786e83d1e53
- SHA1 d37a0e7366038b255cd164628db580eb349015ad
- SHA512 4aba5019c2a99cd23430038581bfef9adb13c4d17675c46dd9f0140e3a9c0c2fd18c4b1bc6eb11fb72be2325ac02aa2ea78345431ab88f584737101b1947cb96
- TLSH T179514E8D6079536D07D288451D55B70785978497C0D1FEBAE187D1985B8CB8A831233B
- MD5 SHA1 SHA512 TLSH