Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 06:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe
- Size 8.9MB
- Sample260928-haa6kshb37
- SHA256 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef
- MD5 f58e8fc4c96ffe57104b08a860170caf
- SHA1 2ce03fcb465b97ad6fa5860551cecf82ecdf3cb1
- SHA512 117f7406889dfee845b9b6a4bec64d9f5a8f4a32d0fcb2ed8d5cfc9e6c182a386c95022d7c878292788b0189d4afa20b23d2e9419205857362e7a313456f314d
- SSDEEP 196608:/YuME0vFrMYWNgiBs0PYj80AkRiBMB9ef3M/:DMfLWNgipYw0AkRoycf+
- TLSH T1BA96D041E7B3C2B2C9866170196E732F8E316B0193368ED3F66C7E8E67723D25939149
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 4 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION" certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION" certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL" certutil.exe Set value (data) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\914E5EF82A4D97B52F26E9517A58DFB72F8ADC32\Blob = 030000000100000014000000914e5ef82a4d97b52f26e9517a58dfb72f8adc3220000000010000002c0300003082032830820214a003020102021055c9ab434152a3ba4c28d20455a24101300906052b0e03021d0500301e311c301a0603550403131341645669657720436f6465205369676e696e673020170d3236303432393136303030305a180f32303736303432393136303030305a301e311c301a0603550403131341645669657720436f6465205369676e696e6730820122300d06092a864886f70d01010105000382010f003082010a0282010100b201e5642f0cd96038785233383cb6a683005dfb95dd04a1c221728aab3f41c6408fec619b9061054989c9c301570673a3109b8714ab9764134bed04eb56cd6ac7c9fdade6e45aa069bce14d258ede8ddd2f6172eeeb0a44fec52c2d745bc308fd9edef702f8f623dbeb205d3342768ec288dc22aa659dac580543b1c0f4880697ba85ba495bf1f682d8f9feba4c912da5af96f761708ce359f4e68ee158cec2a0f537196730e506577cf4643b7866ede8f9409f56ca1d1016102a412749f4fb9359e4000952cfb51317954097e80088a6b6f411a4e9adc3f48445e8348eda5aefb6ac47271485d5c99e54ecc7438793a12ac3c1ffe0acdf94c3025d5ed439db0203010001a368306630130603551d25040c300a06082b06010505070303304f0603551d01044830468010cc4feb044fa31f83b66f54d018f80307a120301e311c301a0603550403131341645669657720436f6465205369676e696e67821055c9ab434152a3ba4c28d20455a24101300906052b0e03021d05000382010100085a4d4c4adfc071d64ad50177efdab2f0f8f459d9ea825e779cc5db9232fcdfda4b869b5e3358231ca616d4ba2140680a85ac77f9244bdd6d28d60235e8a4d1ddab25bf94db66796229f8d2873410cc673cba1580c71d8bbcbd23976b3d584e861be60e6a9ab2a6fc0866cb2309c1c63e0130c88119db34da77920e0667070204d8e677a16ee3f388647d8d953694e20614478ce3a67958f3f9a9f2046c1ca353383e2730b3ca2c2ca6a832a22b92a927853e672f3a88a4e3805e8d0051f6c2bd0119220cdc6026739b9bd5c7dcd3664ca0d6b03fe82a7665d99a744348e426b666c733fb6249a685ba9f73720be75a4831c4cd9d8cc478a93fb1f8fa858a24 certutil.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe Token: SeDebugPrivilege 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5452 wrote to memory of 3128 5452 b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe"C:\Users\Admin\AppData\Local\Temp\b1fbce1bc0a19e4e987e9e1a8f4cf52a4759f42480589ea476c645e31cf6c0ef.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\certutil.execertutil -user -addstore TrustedPublisher AdViewCert.cer2⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
PID:3128
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SafeNet Sentinel\Sentinel LDK\237ae029-496f-e705-9fb3-f6dcaab021bf\.434e4631\.jl7bldh9
- Size 120B
- SHA256 73cef8440436bc70522b3eb4fbfad37eb99dae04045d651d1943c08be525039d
- MD5 c9b5d258a48e6afdbfd64b0d15b33430
- SHA1 baf3543cef5ba3c049939056af8ff038f3333c36
- SHA512 7d8ca69a19797a276293ca33bbf390468833b5603fb6f5c5233652dafa063270d9a3681a7db152aa33267d8b31eea0725dcd575d066b033796af5624f6a174c2
- TLSH T19AB022CCCFC080C02888AB300A0088088A8B8CC8A8BF30C2E003A288F0382003B22C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\SafeNet Sentinel\Sentinel LDK\237ae029-496f-e705-9fb3-f6dcaab021bf\.544f4b4e
- Size 4B
- SHA256 26b25d457597a7b0463f9620f666dd10aa2c4373a505967c7c8d70922a2d6ece
- MD5 f2dd0dedb2c260419ece4a9e03b2e828
- SHA1 0aaf76f425c6e0f43a36197de768e67d9e035abb
- SHA512 fecd7b408089255b3467dc1f7231cc6388c9e1c65dcaa5e50f3b460235d18bc44033b08184018b65ac013fdae68c0088381644a6302b9d89e468f57ff9a005dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AdViewCert.cer
- Size 812B
- SHA256 6eb4019c9873c3df987b72029b4d7d1defc3be6d2b55a688963c6452e0f0d4ac
- MD5 2c264077775f65871aeefcb530b745d2
- SHA1 914e5ef82a4d97b52f26e9517a58dfb72f8adc32
- SHA512 6adbd700a4e7610eec714d060028ffd74aec78914e4d9b24fc50db865dd49d67ad6e24345ec3e32ac7cc02043a7b2eae338575bef003969bdeea2e5fb7d74896
- TLSH T16401467E3288190861664C5F36758D7AE9BA75C4B3EA93520132D11C10CAF6A0F6B626
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Trend\trdlog3.dat
- Size 6.0MB
- SHA256 8762ed277d7fc15d81068330e2d86e820c4c1fc1e0cf5632c265ae59d36345b8
- MD5 8a627a5b6627c6ae1eae2e4a2342c772
- SHA1 94aae7eb6ce4be05f9d3220773d6405af171c02e
- SHA512 0399977171c6c5e8adbeef6f73a7a6600125bf8378251bfe3fd99730159a5591f56589a627439a82d938c2679d02bbdfc75a8eaac35273839209e2029ca0be5c
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP