807f8494080ac2f00b79a2bb6a7b57196aa00ad7216399e2c8d5e84f1bf204aa

General

Target
NaviFunBridge.exe
Size 1.7MB
Sample261003-vhkffashmf
SHA256 807f8494080ac2f00b79a2bb6a7b57196aa00ad7216399e2c8d5e84f1bf204aa
MD5 0bbc281ea38fdfe8711c57c09cb7ff68
SHA1 f5679a36aaa96cde2eaf8387acdb6db417913cc4
SHA512 cf3f0a70eb402ee8f2d2f00cdfacc1a8c6efd0473d3bc8bd19b7026610e7e33a231d7c8f16ac44db39aeb04139c8d7eaf3933557bbf571f86eb0892c372a2d07
SSDEEP 12288:qvggNaxm36SJc6wCbNhtro5Jdhtro5JChtro5JlZ36CZ36rZ36b6xk8UwBMoU:5+xu3CVo5Lo5Yo5rRII1wKoU
TLSH
T1DE857BEC5D967CD0C7427DF013EAA273794B6DA90B1A43534B8D792E8F36C812334A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	NaviFunBridge.exe

Loads dropped DLL 2 IoCs

pid	Process
2980	NaviFunBridge.exe
2980	NaviFunBridge.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1AEAAF21869776BEC557DA6C56288B99C97C6D7\Blob = 030000000100000014000000f1aeaaf21869776bec557da6c56288b99c97c6d72000000001000000ae030000308203aa30820292a003020102020900b26c9df5afdd3f44300d06092a864886f70d01010b0500302c3110300e060355040a13074e61766946756e311830160603550403130f4e61766946756e20526f6f74204341301e170d3236313030323136353934375a170d3336313030333136353934375a302c3110300e060355040a13074e61766946756e311830160603550403130f4e61766946756e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad81cae90013596c3c6ad0999f7567d186caaa1731a5cb2aefd15aa14a2e2dfa6c16f870dbd8a6ef11e30cd7cca55f3cc8395c678e21ed453560aaeec1c4915ca4d60221e45aa5495cad6bc7de484fd89e0d503828cf5cd05dd142f196cf3281a09608f79ec1dd7a79a2a77ce045742e552aa254df4f1f840cd9ac6d3eb74e2ffda6e68ae85665172b222cfb7ac7ebbe9eaa9e34ef62da10ef5c697db029ce0b70d6591a8db6f658ab980d8d478d8691e6934f166705b415c87f8fe7b41b02e47120e3bfc0086d63ea99fc0c169da738189445d978875330c2c26d2e31a343a90975df3150548687480cc4e2b5592ff64625ca5cf285a42bacc2becea3a75b450203010001a381ce3081cb300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e0416041430303e98b2bd83deb685d6df2360f309728757333081880603551d1e0101ff047e307ca07a300f820d6e61766967726170682e636f6d300e820c73696d62726965662e636f6d301382116e61766967726170682d63646e2e636f6d301582136c696d69746c6573732d736b6965732e6e6574301d821b737461726e756d62657231323034362e776f726b6572732e646576300c820a6172636769732e636f6d300d06092a864886f70d01010b050003820101002d1e1e321cbc293c09a36894fb66f9e37a0234af78869832d9bca5ad5fdb39078788f7457702466464632d717dd3775c8f8b5d8bad8f578df0650d6b22b7bd0712375a844947743c8ce230ce77bf967e0bcb20363ddfb6c107d8dc87cfa2fe30ec214dd74601ef9b1b3a0a73a3339733aeff7683e0e6c96dd042b8d954224a466c546aab65e5884e1a0e03979ed517ae62184ecf54706a978783938f12385c7a420b6c5c2d3cbaa53d6c1395b4eff05bfd8e7fd9b7750a8b297d999f6228fe0b38d7e0025b561aa88fec888f8e42877bc6190182539437527c5047b5ec6168c7ccb1f5ab7e7a93ad16b7b8616d4adf977c382f394576311afbaa6238f277d568	NaviFunBridge.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NaviFunBridge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NaviFunBridge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2460	ipconfig.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1AEAAF21869776BEC557DA6C56288B99C97C6D7	NaviFunBridge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2980	NaviFunBridge.exe
2980	NaviFunBridge.exe
2980	NaviFunBridge.exe
2980	NaviFunBridge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2980	NaviFunBridge.exe
2980	NaviFunBridge.exe
2980	NaviFunBridge.exe
2980	NaviFunBridge.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2460	2980	NaviFunBridge.exe	89

C:\Users\Admin\AppData\Local\Temp\NaviFunBridge.exe
"C:\Users\Admin\AppData\Local\Temp\NaviFunBridge.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig" /flushdns
  2⤵
  - Gathers network information
  PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NaviFunBridge.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\NaviFunBridge\5etJPl9SiJSuj3X2+L5WwNHbJPBbORo=\NaviFunBridge.dll
Size 1.1MB
SHA256 d049d6bb9ff0339ca755bd228381e71243ab0bad5da9e443e547c1306a8854af
MD5 bacc3258bac754b5d692de84073d1b7a
SHA1 0ce2ec7f161a7a4fa66662978924844cb3fab426
SHA512 34142b94e9a18142c7f8ac3bde8ca3129f4284578774ea9107b157bfc0b4d33636a3d080687951d4f76666e8599df1c40809b7b3d5ebebe4611542c2e9aba60b
SSDEEP 12288:pJc6wCbNhtro5Jdhtro5JChtro5JlZ36CZ36rZ36b6:pu3CVo5Lo5Yo5rRII
TLSH
T17D355AEC5D967CD0C7427DF013EAA273694F5DA90A1A43534B8D792F8F36C812338A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4869.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4869.tmp
Size 2KB
SHA256 bb2b64f711728c0a6f93d103e1e89c2c3433a51a705706af6c40cf59a56ea0a1
MD5 f1d8b559a6ef684574ffcb4aaecfe064
SHA1 1e4737803681b0892f90f98ca83ba3c67f93681b
SHA512 d7c76eaa95effaad76662e82c1de7389c34141a829a20d1805c9cc2668a03d64472d5916e77dc003c61ba63c278365d1a44350a97cfd3c475869978a9c6e8825
TLSH
T190512B63BA75A4C57E0FA6D485DD8AA35181BE845F30606BB1B0B1FC4E245159A8D4C0
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp4BA6.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4BA6.tmp
Size 2KB
SHA256 d38b91bf26a2e472df3e23ad1c083ddf7da7249af6e07d52d33f4fbe9df95b48
MD5 00b6f9cde310273bf84b28d6645d7d2c
SHA1 2601beef802d1fda07372c7cf26d4e9596189ca8
SHA512 3593bd5cafc9aadb4d3324a6935a32281919aff1dcc29514c4f1fbb4d3301f15efb170d4a8adcbfe6ccdbf7ec24e5490ee3bf6a01c5b9309f8f11ead18cd9d6c
TLSH
T19C514C4B3E322240E97DBA1F7CBD2FC6C4A6E5103D57F14F61279AECA1686348149116
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads