be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc

General

Target
be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
Size 3.4MB
Sample261007-3kft2axvax
SHA256 be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc
MD5 9258c3f3c0c55517545ea31195acc533
SHA1 96062c738149447575e894639bfae65890a41960
SHA512 bae082ce696614ed0809e16bf3ac236395c54f0abc540780a91be9d8ee286eb20fcd90108b94fc5122fb2517a59ee7b8614bd77bb3ce02b278c0ae82671c743d
SSDEEP 49152:8C9LvQEwksc7Z7eomdK4yoo4Gqeqxy8cwfR8lYqTFkP1W:P9Dwksc7ZcW17wfeOqT2NW
TLSH
T1E0F54C50A8C4D4E0C558C1F62A607F37F681BD1D06315A92F8ACFAE57B341E2AF14FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9B72DB9067F28F077AB47572E5D9115D14E50C2C\Blob = 0300000001000000140000009b72db9067f28f077ab47572e5d9115d14e50c2c2000000001000000bb020000308202b730820220a003020102020116300d06092a864886f70d010104050030818c310b300906035504061302434e310c300a060355040a130343434231143012060355040b130b4343425f4e657462616e6b310b300906035504081302424a311430120603550403130b43434220434120524f4f543111300f060355040713085869204368656e673123302106092a864886f70d010901161463612f7a682f636362406363622e636f6d2e636e301e170d3939303632393030303030305a170d3439303632393030303030305a30818c310b300906035504061302434e310c300a060355040a130343434231143012060355040b130b4343425f4e657462616e6b310b300906035504081302424a311430120603550403130b43434220434120524f4f543111300f060355040713085869204368656e673123302106092a864886f70d010901161463612f7a682f636362406363622e636f6d2e636e30819f300d06092a864886f70d010101050003818d0030818902818100a23f2503f132999d842fa2a865e6df59102f6e58f83414b79645bd301141ce1ad034dd3a17cfdfa3455be443c4636419c8eec65faa0271a186384b824e4ca640bec1212817dd5a9c5597a6104f1e11beb25227418bfbe2039168b99f725c077b5df50e008f6b51ed55c690e48858833ec98c0ea8ec3bf2a540e47a94bf8eb1870203010001a327302530120603551d130101ff040830060101ff020102300f0603551d0f0101ff04050303000600300d06092a864886f70d0101040500038181009b59c545937e1cfd655c6c211b797b191503290b45d76e3802162aeb00d131149c071ca1c151ebc7928cf737a7cc8f5bc2bc462df5fc8c9487ca42b56d3402501eaabbda40960a54b78749ab6ecdcb4870fed69bba1707518abfc585ae178651fad51569689e17b33bc450aaaa1ea163a0b7548cab7f28ce7b52e5bcca22a05f	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9B72DB9067F28F077AB47572E5D9115D14E50C2C	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1372	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
1372	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
1372	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
1372	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

C:\Users\Admin\AppData\Local\Temp\be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
"C:\Users\Admin\AppData\Local\Temp\be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OnKeyDetector.log

Path C:\OnKeyDetector.log
Size 1KB
SHA256 d5851926387b14ca9f39fbafd645345372c84c412f5b5a2bfb80e49c958c86aa
MD5 3f87e69b3c230ff8020563d8e48da129
SHA1 4b35cdefc338b8b2e044063478c0b64ff8950b8f
SHA512 c94f659be290216647326d5d03d107ff8bdd5c0549cecf0f822c337c5982668fcd008b6bbc569591eb33802ee6271c61307329ab4194e1b754a4921b2f0deac8
TLSH
T12621A254063D997B59AD362F33FC1682CF83A7E04135E59DD54AF9A42E088053A4A7D8
MD5 SHA1 SHA512 TLSH

Submit Download

OnKeyDetector.log

Path C:\OnKeyDetector.log
Size 2KB
SHA256 8afa7b9fee087f33f17a0877c0ad0a7c50f921084f28d50887074fb784644c5f
MD5 983b41a9183b52a9a7b9d88af330b3bd
SHA1 95cb18f961635e94a1e9ebb36c02ada18a3d8a87
SHA512 ef57a3ea8cc25a84f0bdc027c61e0bc92c151d7dc207b018318c43252758089fcec16f0338ac07059278be3c6ce190b41970beb1e5d9b5120faf3b2f985b3969
TLSH
T16251D354063D89BB55AE362F33FC0582DF83ABE04129E59DE54AFAE42E08805364A7DC
MD5 SHA1 SHA512 TLSH

Submit Download

OnKeyDetector.log

Path C:\OnKeyDetector.log
Size 3KB
SHA256 83fbd2b460f140894f00dff02a2046e88cb301a22538688ffcd5da5ab9b2e5a1
MD5 5f6f6b69651076603294ded71d15bedd
SHA1 ac15feb5baa71dd232c164b7441f0c486a741f14
SHA512 970f06e7537e09d741d1e295b524bed68454f5163620739e3a1ce7b99d3136673dcaadbce6ede82b8e59de15a4976bed8c1c223cada38e74d03fd308112b4330
TLSH
T1AC710794063DC5BB59AD762F33BC19C2DF83BBE04125E59CE589FAB42E08C0526477D8
MD5 SHA1 SHA512 TLSH

Submit Download

OnKeyDetector.log

Path C:\OnKeyDetector.log
Size 5KB
SHA256 f718bd2e301cf4bef389f42d1fa4ee4775582476dc41da552d3c1dc14bf2686d
MD5 6cc2e49a39a6a572ca1c52c4272fbe89
SHA1 43fc338d4c8707120ac7adffff2a30e9822eb261
SHA512 429de190a914ca714464dac19b3ebc93005c0f230cf542de486dead25d0379b244eb4a9f2bd2d07a04cb191a3ac0c3b631694352656d3b7dca14e0b63f8309ea
SSDEEP 48:oanb4pgpMVgHBgHVgHwBwVBwXBwVBwWBwVBhpBhVA9AVA8AVezeVeyeD8jkp8jkZ:oQbFlh7Gr/lmluP974rplU
TLSH
T1BFB105A4063DC5BB49BD762F33BC1983CB83BBD48125E59CE589F9B42D08C0A26437D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccb[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RNU3R319\ccb[1]
Size 109KB
SHA256 7855dc7dabb4aef8f57ff63ff16d1270e50c3a930c8b10aa753194f5661f9695
MD5 dda7b5b37408a421f0062ce21107e42f
SHA1 fcea616f11667621a791cf41029713a7b9ee1e1f
SHA512 60451c4085a5fabd9b29bda0a97667c5d172d1a00c14a50b1b74fa9327cddb0b6080bb00b8067cd24a15274cbeea0147b2cfe0b26ff6812db6973bb86db19830
SSDEEP 1536:SVBlcK5oxpw4SV5F9OEqpX1KcHBlw6IIFM3rnJggq:4BlYgq
TLSH
T1AFB304B9C9F610E0AD12719F7528ABA53A602C95423AD39494FACCB5EFCE2F3441F45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dialog[2]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RNU3R319\dialog[2]
Size 1KB
SHA256 4261af463911a5f682027d477946075a75477e5294c4e18eb06d52f89209b9ba
MD5 e20ed68829418cc47d7d504d58521e2f
SHA1 8f6acaba89fa354cd5f9b5dcc46c7a9708cd7507
SHA512 c9c0338a88472e147bdc5d9db4ac80275b3ec792e476034c03a2f43de95f21eb52da2d4ad29622cda589782b3d12bffdcd1f9ec97665ee64c81c3abab79e3b2f
TLSH
T199216524222D43602D91538E92388F93FC3B853AC75F7697626EDD6A3030C0B3EC5A60
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads