Overview
overview
7Static
static
3CryptoKit....ay.exe
windows10-2004-x64
7CryptoKit....ay.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$SYSDIR/Cr...64.dll
windows10-2004-x64
7$SYSDIR/Cr...64.dll
windows11-ltsc_2024-x64
7$SYSDIR/Cr...86.dll
windows10-2004-x64
3$SYSDIR/Cr...86.dll
windows11-ltsc_2024-x64
3$SYSDIR/Cr...64.dll
windows10-2004-x64
7$SYSDIR/Cr...64.dll
windows11-ltsc_2024-x64
7$SYSDIR/Cr...86.dll
windows10-2004-x64
3$SYSDIR/Cr...86.dll
windows11-ltsc_2024-x64
3$SYSDIR/np...86.dll
windows10-2004-x64
3$SYSDIR/np...86.dll
windows11-ltsc_2024-x64
3$SYSDIR/np...86.dll
windows10-2004-x64
3$SYSDIR/np...86.dll
windows11-ltsc_2024-x64
3CertEnroll...86.exe
windows10-2004-x64
3CertEnroll...86.exe
windows11-ltsc_2024-x64
3CryptoKitH...86.exe
windows10-2004-x64
3CryptoKitH...86.exe
windows11-ltsc_2024-x64
3cpkekonafl...age.js
windows10-2004-x64
3cpkekonafl...age.js
windows11-ltsc_2024-x64
3flaibjgdie...age.js
windows10-2004-x64
3flaibjgdie...age.js
windows11-ltsc_2024-x64
3igiadmhndp...age.js
windows10-2004-x64
3igiadmhndp...age.js
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 18:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
CryptoKit.UnionPay.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
CryptoKit.UnionPay.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/CrxInstaller.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/CrxInstaller.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$SYSDIR/CryptoKit.CertEnrollment.UnionPay.x64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$SYSDIR/CryptoKit.CertEnrollment.UnionPay.x64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$SYSDIR/CryptoKit.CertEnrollment.UnionPay.x86.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$SYSDIR/CryptoKit.CertEnrollment.UnionPay.x86.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$SYSDIR/CryptoKit.UnionPay.x64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$SYSDIR/CryptoKit.UnionPay.x64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
$SYSDIR/CryptoKit.UnionPay.x86.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$SYSDIR/CryptoKit.UnionPay.x86.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
$SYSDIR/npCryptoKit.CertEnrollment.UnionPay.x86.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
$SYSDIR/npCryptoKit.CertEnrollment.UnionPay.x86.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
$SYSDIR/npCryptoKit.UnionPay.x86.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
$SYSDIR/npCryptoKit.UnionPay.x86.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
CertEnrollmentHost.UnionPay.x86.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
CertEnrollmentHost.UnionPay.x86.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
CryptoKitHost.UnionPay.x86.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
CryptoKitHost.UnionPay.x86.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
cpkekonaflngeeomdaofgeiolmljjefe/3.2.0.8_0/eventPage.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
cpkekonaflngeeomdaofgeiolmljjefe/3.2.0.8_0/eventPage.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
flaibjgdieeiakhdmgpkcogifikjnjhk/3.2.0.6_0/eventPage.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
flaibjgdieeiakhdmgpkcogifikjnjhk/3.2.0.6_0/eventPage.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
igiadmhndphenajafopeimbkfnnaofia/3.2.0.8_0/eventPage.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
igiadmhndphenajafopeimbkfnnaofia/3.2.0.8_0/eventPage.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target CryptoKit.UnionPay.exe
- Size 4.2MB
- Sample261029-wx7pysca64
- SHA256 1fcee9cd4a4c1080d6acee16d6b7b1a9593971283da2a02f56406218d557ecb4
- MD5 9f11ad646047260e2fbdc8f756f0cf59
- SHA1 70884d4f4da741a6a0030d00247182de7a177946
- SHA512 364bd07c64f66d0f7f0a11d6d4a34449738385ed3a93ce8c3aada01bf93db8f84051b269647a9b18bfa3f55f7fed38dbd2d1e304451ef5f25eecf00d38421c16
- SSDEEP 98304:eAix9A3Dv05fTksg0AaitYpDbdyC0EVfvhZiuDHw:eAR0lFdz0Cdn0E5Z8uDHw
- TLSH T14E1633D373C582AACCC90BB38A57FF6393B3AF906AC81201B697321D1C73985559774A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
pid Process 244 CertEnrollmentHost.UnionPay.x86.exe - Loads dropped DLL 13 IoCs
pid Process 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe 2996 regsvr32.exe 3376 regsvr32.exe 3304 regsvr32.exe 4576 regsvr32.exe 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpkekonaflngeeomdaofgeiolmljjefe\3.2.0.8_0\manifest.json CryptoKit.UnionPay.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgckjplmeoddljccnmmmighdiiannibk\3.2.0.6_0\manifest.json CryptoKit.UnionPay.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\system32\CryptoKit.UnionPay.x64.dll CryptoKit.UnionPay.exe File created C:\Windows\system32\CryptoKit.CertEnrollment.UnionPay.x64.dll CryptoKit.UnionPay.exe File created C:\Windows\SysWOW64\CryptoKit.UnionPay.x86.dll CryptoKit.UnionPay.exe File created C:\Windows\SysWOW64\npCryptoKit.UnionPay.x86.dll CryptoKit.UnionPay.exe File created C:\Windows\SysWOW64\CryptoKit.CertEnrollment.UnionPay.x86.dll CryptoKit.UnionPay.exe File created C:\Windows\SysWOW64\npCryptoKit.CertEnrollment.UnionPay.x86.dll CryptoKit.UnionPay.exe - Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\flaibjgdieeiakhdmgpkcogifikjnjhk.zip CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\CryptoKitHost.UnionPay.x86.exe CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\com.cfca.CryptoKitHost.UnionPay-win.json CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\com.cfca.CertEnrollmentHost.UnionPay-firefox.json CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\cpkekonaflngeeomdaofgeiolmljjefe.json CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\pgckjplmeoddljccnmmmighdiiannibk.json CryptoKit.UnionPay.exe File opened for modification C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\igiadmhndphenajafopeimbkfnnaofia.json CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\com.cfca.CertEnrollmentHost.UnionPay-win.json CryptoKit.UnionPay.exe File opened for modification C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\cpkekonaflngeeomdaofgeiolmljjefe.json CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\igiadmhndphenajafopeimbkfnnaofia.zip CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\igiadmhndphenajafopeimbkfnnaofia.json CryptoKit.UnionPay.exe File opened for modification C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\flaibjgdieeiakhdmgpkcogifikjnjhk.zip CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\uninst.exe CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\cpkekonaflngeeomdaofgeiolmljjefe.zip CryptoKit.UnionPay.exe File opened for modification C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\cpkekonaflngeeomdaofgeiolmljjefe.zip CryptoKit.UnionPay.exe File opened for modification C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\igiadmhndphenajafopeimbkfnnaofia.zip CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\flaibjgdieeiakhdmgpkcogifikjnjhk.json CryptoKit.UnionPay.exe File opened for modification C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\flaibjgdieeiakhdmgpkcogifikjnjhk.json CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\CertEnrollmentHost.UnionPay.x86.exe CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\com.cfca.CryptoKitHost.UnionPay-firefox.json CryptoKit.UnionPay.exe File created C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\pgckjplmeoddljccnmmmighdiiannibk.zip CryptoKit.UnionPay.exe File opened for modification C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\pgckjplmeoddljccnmmmighdiiannibk.zip CryptoKit.UnionPay.exe File opened for modification C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\pgckjplmeoddljccnmmmighdiiannibk.json CryptoKit.UnionPay.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 5 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D3FBFAA8A67FC9A2EADBF86AEB5D07A9D6AF322E\Blob = 5c000000010000000400000000080000030000000100000014000000d3fbfaa8a67fc9a2eadbf86aeb5d07a9d6af322e1900000001000000100000004c20cf3a717a7e6c89eb97b723e41cde1400000001000000140000005869c9d5dd14b313a0713c7c038d03e63d0f8e010f00000001000000140000003d4c691dba6527dd8037bd928839d97ff5dbd21a0400000001000000100000006c4139b0dbe1c3befdc83f5794a2ea0b2000000001000000230300003082031f30820207a003020102020418255284300d06092a864886f70d01010505003022310b300906035504061302434e31133011060355040a130a43464341204353204341301e170d3131303532303135323730355a170d3431303531323135323730355a3022310b300906035504061302434e31133011060355040a130a4346434120435320434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b21552708386d721c24e5d85494d571ce341597712b6526befd65e399f06907f98146d14eb489abdea1805be01ee001c73fa69af11c486056bf2e4418e53807e9f6f2eb457d5d247d348fddd3ec35d545c8465630ffe31df3ca328bb8d7a47a205c03eeebcb49b71421c64a3df52a8730e247eb51cf81b03cf88085c9b6cbbad7bfc03b86ef03e6be9c17f18709c844d22db022e43baa897c623378630ef88609d6ce17ccb5c2b2b5cce287d48fa8db961e42aa8ed9c0545ad1d57996680ecfcc41633be7fedfbc1e8225c11abbcc06f0d48f08a4255871a138f9a3c12b8ee163da3dabdf8902a29b6104308cb5b8312bf818d08a0951d009e1c3d102e8c6d430203010001a35d305b301f0603551d230418301680145869c9d5dd14b313a0713c7c038d03e63d0f8e01300c0603551d13040530030101ff300b0603551d0f040403020106301d0603551d0e041604145869c9d5dd14b313a0713c7c038d03e63d0f8e01300d06092a864886f70d0101050500038201010065d30a15c6b1c2ed61c5ad605f2ff4e2ddbf31165dc95201bc8f235e523d856b4e578631f516adab33cfd094af2a6ea188964e786bf2574e6791e647521821cb3f5c5433b53aee03209b027310b368a5dd6a84675379379006f4f78083f118a0bc49f7e947a4d6bd7cb8cc2bdc7d2330eeebfaad91d0cde8db8982a4d7ea093c4694a5f0f49ac71866cae9bab7569d9b94bb7e3d8895b59d8c77115101019f997bfcc35a95e1a1d6aefee5f737b0b202fae75f038d922d8ac308040627c50ae5e737ee1292290c53d565c99d280fe6171877e2666f701e5f3ecfa11eedf13b0362732e9bb3872e52e5c66fb0999d5ec3e4824e5cf59f084f683a963886664977 CertEnrollmentHost.UnionPay.x86.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D2790F6BB0A3EF62C674A1AA76A619DF02B21B82\Blob = 5c000000010000000400000000100000030000000100000014000000d2790f6bb0a3ef62c674a1aa76a619df02b21b821900000001000000100000000656cee8abdce9d36bb7e46bd39ca1b714000000010000001400000011e178d33820faedebd6239630a87db999db5ff70f000000010000002000000089b83fb48d9489cac0b00a17ddc5396e181a9c35af2260dfdb24b8c59fa6d81e0400000001000000100000003ddd8d055f350d6e6e3dcb76fd9796b020000000010000009b050000308205973082037fa003020102021041aef3cfbe4464544f64f89a97f23917300d06092a864886f70d01010b05003055310b300906035504061302434e3130302e060355040a0c274368696e612046696e616e6369616c2043657274696669636174696f6e20417574686f726974793114301206035504030c0b4346434120414353204341301e170d3135303932333033323430385a170d3335303932383033323430385a3055310b300906035504061302434e3130302e060355040a0c274368696e612046696e616e6369616c2043657274696669636174696f6e20417574686f726974793114301206035504030c0b434643412041435320434130820222300d06092a864886f70d01010105000382020f003082020a0282020100d85bc274e5bb4c5d4c8dd68a666ca4f87f7cc927a494aaee9a2934f65d63e97de7d798a2f8ad8523b47d61ab90c37e38b0e1fdc2413ea30f0efa08f72fb430aab645b4e453b2e7d7459b6c5a5dcff4fa571522aed912d2ec750b30d93ddd1d650ee554b9dc19b75d8051965ad56c60e3b6d7ab8d7967a5acfc2b84b8a42876cad7a731a2aa93ea70b908471eec13acbdf407f2552e40d1effc2e90b98d319ea76665b24819c54e6703fac4338dac50187f9d3e251455e4abbcbe990d492d21034555cecf15d0200108c6c981e6100b31ee13b5eacc1ef3cca0950f62c49b17966bda7a46648dcc128998a836db66a4fe91b39eada510fe5d4860c5c4c2f88f2f9441636c5b3726732a57a9b02e5f1ee90081fd4f254849fce123515cfedb2b0eca378b4f9a7e2e4faedd60e66afad03662da14b1b31b4b65f3a1553fa459fa4ce352264032edc2c74160026a9fef69a3324e15ed8b1f861664e36cc1c1388dd73a67ad205e53b65f4f1b30b3d19322d6b9e40334b2a1eb08ddf6bd53a8133cbe8561dfcc9e7c684f7fda42bc7a212914884850462e53aab82d9386a8d35671c32dac2fd9c266e5c94f3e66b15a5c6286cc1c47d4afa8ea22fdbd361fb02e12b027ca6e2307a2e8e3e6bbb57dca51ae9a505163edf4dbb1ae5a373b05e91f574019cf3f5040ed04f0ff38d339ed256909e1d424b651ed6a423d41b677e47602730203010001a3633061301f0603551d2304183016801411e178d33820faedebd6239630a87db999db5ff7300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041411e178d33820faedebd6239630a87db999db5ff7300d06092a864886f70d01010b05000382020100c4099bb4625cdb7005ebf4959311b10fd02eb95ec90e6123411687408e3a86ba7532c61cb241cfc15007a7d029447f539eb968fd622bd05cc8364c683aaabf753e9f9b2c7e7533fad534080f21ebe7a821850db17c1aa96b3499debd91cd8a52585e608303a78963b9e4cdffc409c31db4c2d3c686be051821ff1f5df5810b535b088d4560fd5f6de8a5c00afd44e3032b855df4b1abc480a5aa8edb76789c33d6d90dd2a5c88da877132f336edaeac88d2d57fb914164464482b587856e9d610e0ce19bdc7ad06b60f89eb68a5ee9825d626db8eda0d14d24b71cb8facf79ceaff2e7732c4c6f9c62d5320e80b0300d10040573b559de7b8ab34db49fce889702ee7b95059c3cd905565f0320f0f2226a5ad2fe1c52824b578c1e75814a0cd42fb7bc9aaaa6ee175e43d8c26aee5b047b7cb26d41a9d863dbc2a12e36b4b9e83f26a98844e75419bac7683ff6d3627cfd9142381ca03388bab099d37283c837750c14dc0031eadb33e99a2772a534261c1cc7f4c643edee0d33f9d037b8e057c6b130995c604b9f0ba883d713eb84c6901e54a69ec31f2784af31e0861e08f986f56f34977c6811b001941c3762eb365903823f0a69a9cf8c81346c0b725caf3ab0fdc51d017e88930059360f119e79b535ee92bfc458b595d876b83bd328c431877096bac446e7006436303d8e66a31c70d8f4e10816100b35b3e602ef03d1 CertEnrollmentHost.UnionPay.x86.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18E6302EDD67280A10262FC2672568582EA08A2E\Blob = 5c00000001000000040000000008000003000000010000001400000018e6302edd67280a10262fc2672568582ea08a2e1900000001000000100000004ee09f18b6d30fc0d26624f21d35b3ca14000000010000001400000074dec58d0a7d101aaa69835b4d21ce869bcc71380f00000001000000140000003e1c23bf5420751f780f34b81020fc1975bacf3504000000010000001000000068bb2805b51d60e816c33272be27d864200000000100000097030000308203933082027ba003020102020a52137ecc1d7d85b73ae6300d06092a864886f70d01010505003059310b300906035504061302434e3130302e060355040a13274368696e612046696e616e6369616c2043657274696669636174696f6e20417574686f72697479311830160603550403130f434643412054455354204353204341301e170d3132303832393035303132395a170d3332303832393035303132395a3059310b300906035504061302434e3130302e060355040a13274368696e612046696e616e6369616c2043657274696669636174696f6e20417574686f72697479311830160603550403130f43464341205445535420435320434130820122300d06092a864886f70d01010105000382010f003082010a0282010100daacc246aee1faace04f171508ed3d726f2752451b4e335c6f9158d0357d2a9988abf1f784e936f472d82d291edadb40c86028fd919e4034142a8d1723dd2a2af571f7722aea8581c9ef6dce2b24e94b444f43437abed56ddcfe4943eced8d61dda886db4ce43a3b4db84c64e2aa2eae1e032ecfdfce56eafcd57ddae585642bb8c5799f68f1c4dcbd0c43f39dffd6c81941c991f5a512c344571f85c52d3ae7ee7e1049f58a88da2d943f00839812d691fd38d51bea71a4327de0875c5f26a8e638d3129273d74c688da57b6abd88bca08bc1c9509b5033b9f48c0f3f5af5498c84dcff0dafb0dd411bb429049d5cba068ae8124777e7fada0e6d50109a99430203010001a35d305b301f0603551d2304183016801474dec58d0a7d101aaa69835b4d21ce869bcc7138300c0603551d13040530030101ff300b0603551d0f040403020106301d0603551d0e0416041474dec58d0a7d101aaa69835b4d21ce869bcc7138300d06092a864886f70d0101050500038201010033479390cdf90f8863465182eb7c18d21fbec153d4bceace6ea01505bcc4110ed270189e9e6798f10ea558c5135ccf402e26d9925a493dc26fde7b61b7b2cbeb3b5de30757ec4f51cd90909d1bdb2fd03f054dcdc5675e4a90a0fcec8fa1de6808a3fee9473b900a6217d3ad60d5a7b77976669fcd89e7731100fc1f8a845902c0abed1d168e4191f5616ff8cf724b677697cf3ae1f520c84fb5572fa3a8e9147c3853f9cfd89bf9f68b0813deca273fd23edd890189d93a5203a96c29f7f01fbedd3f303afccb43ca43d73a7aa233071edaf4ba544d4979bb58d2fb148367f285da55e78f0685a7b8c808b58432506cb42a28822ecac07f402e924feff763f6 CertEnrollmentHost.UnionPay.x86.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\75042FD496C13F05FDA9CD7B7567F9B239F9FED6\Blob = 5c00000001000000040000000008000003000000010000001400000075042fd496c13f05fda9cd7b7567f9b239f9fed619000000010000001000000015c1ff386c077c331edf4ccda21a6237140000000100000014000000b9137821604d987253d56644da11fe644386b35e0f0000000100000014000000962cb6cc1948ec1b0677bd3aad744a83ff33b7c8040000000100000010000000184827877b0c3711fef674d1a143ab0920000000010000009f0300003082039b30820283a003020102020a2c53957adcf0a252c075300d06092a864886f70d0101050500305a310b300906035504061302434e3130302e060355040a13274368696e612046696e616e6369616c2043657274696669636174696f6e20417574686f72697479311930170603550403131043464341205445535420475420524341301e170d3132303630343036303633305a170d3432303532383036303633305a305a310b300906035504061302434e3130302e060355040a13274368696e612046696e616e6369616c2043657274696669636174696f6e20417574686f7269747931193017060355040313104346434120544553542047542052434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bea036a2f6a044dace5a36fcbebb59e43d344aa4bab9cff5a40c32528e472e11a3dbbcc8bf18403185647dad68939251de2bf2481153c69876b18e300f4a21173b818e3a4323037ab46c7b3a4534c8e1cb203e26a106283e8e211a3b3415c7508390126778bea7c8f0018257d24e7f98dbfdd32c51a7916d8286e97d103e551dae83133347798434e0356f6ddc16a784836af2ae2b869d3abafe83f360146ab7b7477f2696c1415fa3b3e8193c4a5ddc25fce3e76b58940dd70c992ce9d1c5692525a583e586b1ed0153f6e5457dcf1dd62411b47c18eb06c63063218061d95adbf5c2de6b4ab2d8e4c8198b050a5ede71bb89c1096723a597c59f20892f229b0203010001a3633061301f0603551d23041830168014b9137821604d987253d56644da11fe644386b35e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b9137821604d987253d56644da11fe644386b35e300d06092a864886f70d010105050003820101009da0990bf1b1517d5886c986920df8b41f5cc293098fc3d2cf0d0dcc046415b5fd6f2845594ae711bd1bf8b381f1df4b03f724061854310adf774ac80f71abf90245e8dc779e0d838ef4319c82bb9f2b43dfcae9a70f3bbfa33bda1e374194b4aa3453b41cfe2a973438a62d545fc665378613d59dbc28ed806ec45d8e790b7a5bc8f181d265896eb3fb2b246efe8f52a65f29aa201a2362f940b9e533d6c537fd5c9653708bbc78263ee9750293d0bbd88e5a73ca66e69f91feca051fcea6d7b9ac20e8c271e09b4fd3576b949ae7d8efe9d0f4c133db712d7ce3e5518d8a67cf42036373e581f625a479ae4765892cd2c6e562ace7282bf2693f72b622a1b3 CertEnrollmentHost.UnionPay.x86.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CD3845EBC2E6C4938A30DD422C4F8BF4057D73D0\Blob = 5c000000010000000400000000100000030000000100000014000000cd3845ebc2e6c4938a30dd422c4f8bf4057d73d019000000010000001000000049146679b7c53c8b6d1504f667a6dc6b140000000100000014000000935ce6fe33314f613156118ccc57c79ce80b46f90f0000000100000020000000d2b78acc98f50b4c6179e6e7b5ea2cf78ca818d01d57f39bff381c6ebbe6b70f040000000100000010000000f55e407a24375ff2682182f327d9a9092000000001000000a5050000308205a130820389a0030201020210733c0155e7f0a58c0364ededc8772532300d06092a864886f70d01010b0500305a310b300906035504061302434e3130302e060355040a0c274368696e612046696e616e6369616c2043657274696669636174696f6e20417574686f726974793119301706035504030c1043464341204143532054455354204341301e170d3135313032323033333833325a170d3433303330383033333833325a305a310b300906035504061302434e3130302e060355040a0c274368696e612046696e616e6369616c2043657274696669636174696f6e20417574686f726974793119301706035504030c104346434120414353205445535420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100e03000d27187a5108e74ab8c6a90da044cc1a48fae3d2a5eb280bdfb1f05a796087a35049179148234bde29abb85bbeadaf6cf56bd50c782bab6a921b597ff7005d5fdc90e1234b7e1358b917625ab955123bc746a0bffbb61ca2cf52e71bc0c19bc74cd364458d08d294c038388ac707fdf70b90d8351b222199e907a028c5ceeb02f3e6c169e2accc1d10511dd352b337264927e1cdb93fcd4e990246304e4dea1fb7c4c4df990c37907626255156286ac7621448e5d44e4898315c5952f24dc16683a247749c09c99858587ab853b7bc5e9c4cb2f9791cf6640e23758409db1f4c3ff8cbcd3e363bf1d858123173b186c5dd2264c19eb49769b6ae3d84ba0073a03e32ccb9455352f9d20c6412516b17efcb3eff4c2c783a0acb22f031c3fad39b1fac2b407424cf98d206815e2b9c70be975240f73fa5a5ea4ea8cd24a5ac665e984b8e0cb2f8d829921e5a0a3fa973f4b31656422bd52e1a01dbf0ce31e5f106f783ad014fffc0689cc02346a67d9ad93b1f60482e30f3b2755d810e46ae71c8261cefb55e9d6a681dd3701c660cb9b44fefc09e5935cc0c96a7293933f85beaca66da178874717cec58b72413a293a52845f308b16dc32a334f773ec16c621cce89a3dfcbd2aede08a2269697140f078f941e79bdc3e96c2d2a421a5a32d49d9dbc2c44c5b38300533d29c77d55b62fab9b8ba8bffb7da8afafca52b9f0203010001a3633061301f0603551d23041830168014935ce6fe33314f613156118ccc57c79ce80b46f9300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414935ce6fe33314f613156118ccc57c79ce80b46f9300d06092a864886f70d01010b050003820201007a91a42fe491c3fc0564477549e68f3c8b0bab484d7a9785bf8668ddfd4ce1e46d14a2715cf0a94fc4f6503878e01be66ab9f4d41ed49f34df30d5845044697b14bf0121e53e69a842a37384ce2ce313724cb2f8245e1f9db13e394ad1d55172ac7ba308da244890e7c551ce356151cf5c0dbdd0283bee76513470bdc540f65d0c70341c1129dfee178953da9ba4e1b053ca29cf4d2f7231a1a0ff6299be9358ea3e8b43a7b2dc9ea06053ccc8a2e7e56a5359f71253ee6f1b4ba94b9871f66299fde48ae53b4cf93be9cd2e752baae6fc31ece943207416fe97751de04de0d33d7f0f69b5671bf07f2f6079148429b44b5aade261d5ed25fb3d76fd9a795a41cb0d292e79f1f94b82cfb77a4f4cf2dff29f2140a133768a156e004ccb89d0be302989b027cc773364565495b9edbf199331d6fc25f198929bbd829601d20076fea58ff74aa2ee5ef08fd6323e6ac95eb36901361c4c583b4258e7e6d779358c286f84a1bb2487785c787ab72526812f0a9e7b239f6133ee7f0bddafb60e3bc03b5a2a75078a646fe49c7a7294a1a4e6db74036259f1b30d5977040e554496ef9f080a8ab80728988a64219e0b94deef6c883175df910795b2c29c234e0f0319b466282406a215c3b71cc9fbe9d0f4717799c8f286859ff31ca45460c3c6b1baca9806034bb246e18e61d97cc566767f85cbac15a57fad44c73e36ed0f08aa32 CertEnrollmentHost.UnionPay.x86.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CryptoKit.UnionPay.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CertEnrollmentHost.UnionPay.x86.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD62765A-DB22-4E67-ADAF-590DCC4ABDB2}\TypeLib\ = "{6EEA27B1-2B28-4794-9508-E58E91BC90BE}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A941375D-88D1-4600-A394-776F855CB1EC}\ = "CryptoKit" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6CE9007-78BF-4840-B679-C066FB0B6AD9}\ProgID\ = "CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X64.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{864A51B3-E812-4570-B7B0-6923810D1FC8}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3C29B1-AED3-47A2-8306-313A36760414}\ProgID\ = "CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X86.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEA83279-165C-44D7-9162-378DDF7076A3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X64\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A941375D-88D1-4600-A394-776F855CB1EC}\ = "CryptoKit" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEA83279-165C-44D7-9162-378DDF7076A3}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\CryptoKit.CertEnrollment.UnionPay.x86.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8B433AF-B108-46BE-9494-745C4A2D7F9E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8B433AF-B108-46BE-9494-745C4A2D7F9E}\TypeLib\ = "{864A51B3-E812-4570-B7B0-6923810D1FC8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3C29B1-AED3-47A2-8306-313A36760414}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD62765A-DB22-4E67-ADAF-590DCC4ABDB2}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD62765A-DB22-4E67-ADAF-590DCC4ABDB2}\TypeLib\ = "{6EEA27B1-2B28-4794-9508-E58E91BC90BE}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD62765A-DB22-4E67-ADAF-590DCC4ABDB2}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X86\CLSID\ = "{8C3C29B1-AED3-47A2-8306-313A36760414}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63C399AE-E15A-45AD-B308-4AD529583288}\InprocServer32\ = "C:\\Windows\\system32\\CryptoKit.UnionPay.x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63C399AE-E15A-45AD-B308-4AD529583288}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5173AEF-2279-4A0E-95EB-89971FB4E16C}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5173AEF-2279-4A0E-95EB-89971FB4E16C}\InprocServer32\ = "C:\\Windows\\SysWow64\\CryptoKit.UnionPay.x86.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{864A51B3-E812-4570-B7B0-6923810D1FC8}\1.0\HELPDIR\ = "C:\\Windows\\system32" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3C29B1-AED3-47A2-8306-313A36760414}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63C399AE-E15A-45AD-B308-4AD529583288}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6EEA27B1-2B28-4794-9508-E58E91BC90BE}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6EEA27B1-2B28-4794-9508-E58E91BC90BE}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X64.1\ = "CryptoAgent Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X64\CurVer\ = "CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X64.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6CE9007-78BF-4840-B679-C066FB0B6AD9}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1\ = "CryptoAgent Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{864A51B3-E812-4570-B7B0-6923810D1FC8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X64.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X86\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X86\CurVer\ = "CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X86.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64DBF6A2-30E3-42BC-9A60-2EDBB86E9741}\ = "ICryptoAgent" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64DBF6A2-30E3-42BC-9A60-2EDBB86E9741}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CryptoKit.DLL\AppID = "{A941375D-88D1-4600-A394-776F855CB1EC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8B433AF-B108-46BE-9494-745C4A2D7F9E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X86.1\CLSID\ = "{8C3C29B1-AED3-47A2-8306-313A36760414}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEA83279-165C-44D7-9162-378DDF7076A3}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63C399AE-E15A-45AD-B308-4AD529583288}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6CE9007-78BF-4840-B679-C066FB0B6AD9}\VersionIndependentProgID\ = "CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X64" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96A76B4F-7EB9-4A3B-AF5C-D37412BA24FC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96A76B4F-7EB9-4A3B-AF5C-D37412BA24FC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8B433AF-B108-46BE-9494-745C4A2D7F9E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3C29B1-AED3-47A2-8306-313A36760414} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64DBF6A2-30E3-42BC-9A60-2EDBB86E9741} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD62765A-DB22-4E67-ADAF-590DCC4ABDB2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96A76B4F-7EB9-4A3B-AF5C-D37412BA24FC}\ = "ICryptoAgent" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5173AEF-2279-4A0E-95EB-89971FB4E16C}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3C29B1-AED3-47A2-8306-313A36760414}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEA83279-165C-44D7-9162-378DDF7076A3}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63C399AE-E15A-45AD-B308-4AD529583288}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6EEA27B1-2B28-4794-9508-E58E91BC90BE}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD62765A-DB22-4E67-ADAF-590DCC4ABDB2}\ = "ICryptoAgent" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96A76B4F-7EB9-4A3B-AF5C-D37412BA24FC}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{864A51B3-E812-4570-B7B0-6923810D1FC8}\1.0\ = "CryptoKit.UnionPay.x86 3.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{864A51B3-E812-4570-B7B0-6923810D1FC8}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.CertEnrollment.UnionPay.X86.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3C29B1-AED3-47A2-8306-313A36760414}\ = "CryptoAgent Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6EEA27B1-2B28-4794-9508-E58E91BC90BE}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6CE9007-78BF-4840-B679-C066FB0B6AD9}\ = "CryptoAgent Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3C29B1-AED3-47A2-8306-313A36760414}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEA83279-165C-44D7-9162-378DDF7076A3}\1.0\ = "CryptoKit.CertEnrollment.UnionPay.x86 3.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEA83279-165C-44D7-9162-378DDF7076A3}\1.0\FLAGS regsvr32.exe - Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D3FBFAA8A67FC9A2EADBF86AEB5D07A9D6AF322E CertEnrollmentHost.UnionPay.x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D2790F6BB0A3EF62C674A1AA76A619DF02B21B82 CertEnrollmentHost.UnionPay.x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18E6302EDD67280A10262FC2672568582EA08A2E CertEnrollmentHost.UnionPay.x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\75042FD496C13F05FDA9CD7B7567F9B239F9FED6 CertEnrollmentHost.UnionPay.x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CD3845EBC2E6C4938A30DD422C4F8BF4057D73D0 CertEnrollmentHost.UnionPay.x86.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe 4952 CryptoKit.UnionPay.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4952 wrote to memory of 2176 4952 CryptoKit.UnionPay.exe 90 PID 4952 wrote to memory of 4216 4952 CryptoKit.UnionPay.exe 91 PID 4952 wrote to memory of 2996 4952 CryptoKit.UnionPay.exe 92 PID 4952 wrote to memory of 3376 4952 CryptoKit.UnionPay.exe 93 PID 4952 wrote to memory of 3304 4952 CryptoKit.UnionPay.exe 94 PID 4952 wrote to memory of 4576 4952 CryptoKit.UnionPay.exe 95 PID 4952 wrote to memory of 244 4952 CryptoKit.UnionPay.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\CryptoKit.UnionPay.exe"C:\Users\Admin\AppData\Local\Temp\CryptoKit.UnionPay.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u "C:\Windows\system32\CryptoKit.UnionPay.x86.dll" /s2⤵
- System Location Discovery: System Language Discovery
PID:2176
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u "C:\Windows\system32\CryptoKit.CertEnrollment.UnionPay.x86.dll" /s2⤵
- System Location Discovery: System Language Discovery
PID:4216
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" "C:\Windows\system32\CryptoKit.UnionPay.x64.dll" /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2996
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" "C:\Windows\system32\CryptoKit.CertEnrollment.UnionPay.x64.dll" /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:3376
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" "C:\Windows\system32\CryptoKit.UnionPay.x86.dll" /s2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3304
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" "C:\Windows\system32\CryptoKit.CertEnrollment.UnionPay.x86.dll" /s2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4576
-
-
C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\CertEnrollmentHost.UnionPay.x86.exe"C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\CertEnrollmentHost.UnionPay.x86.exe" -i2⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:244
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\CFCA\CryptoKit.UnionPay\CertEnrollmentHost.UnionPay.x86.exe
- Size 471KB
- SHA256 efef0c8b21b12401cecdd82e079098970ffe669b4a7796ce13e60cd617795c97
- MD5 b07fe4b6bd5a31a9c53d2bed4646cd9a
- SHA1 1b8c80ef5aeab9e3731a1feab17b52f8e6c43617
- SHA512 47602a0d8e93cd6d397a76251d712eea9688cdc36c3ac1c5aa5b32250fe4cca3ece3d54d9230dad48eb0c6927a60b0d29f03e2da8772feab72e38af23dc733c0
- SSDEEP 6144:MjbiMQzjSzB79zjHLj/ihLX9oRxD50E8eAOPZK04H0+UlKSNLeaV5hN+:w9BB7lj3ihL9oRZ50E8ex7pDXN+
- TLSH T124A47D22E6F8C435D9A31570D7B98AF12C3EB1761722D4CB37E418998970AF4A931B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\flaibjgdieeiakhdmgpkcogifikjnjhk\3.2.0.6_0\eventPage.js
- Size 3KB
- SHA256 b24e2351df4b5f64f7ccd634e40672f28c551536c9966251bc61f324f1108769
- MD5 7991798907737bdb6699d5f5f4b90f51
- SHA1 5a65793e4d057186fa9827b0bbc8049e1608b1dc
- SHA512 19ce553bae794bf2afd08ebb4695c7c2e2863acddb27757f33fe91ccf2d9a1121ce85a2a51e7ddc3a203255277522f52e902c51b3247a7577f86d136befbc1e9
- TLSH T1FE7191961ED321564773A3769F3B1601FA3A61570A0D976CBE8C47E11F348604289FED
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\flaibjgdieeiakhdmgpkcogifikjnjhk\3.2.0.6_0\icon-128.png
- Size 5KB
- SHA256 bea6391b6ddfc0ca53a11d6b762d67e055413a0cc7a2369b86c7b5906800dc7c
- MD5 1752662865a3c3e3e4671cbb521b4553
- SHA1 238fa87e00afc8b90ef8a2d8ab786ed0b26d8d14
- SHA512 858d9d76d4db6233a5996dc735229cea2a413bd7ee8cc0687a920683eca305d4e29e1a3539f7aa34aa5579f74e03ca2a595f7f8b54425644fd30a271b3081f37
- SSDEEP 96:rUihYVIreox/uWKlNAS55uzfbFp4tL1TxbsaEFqDlb17lr5B9y/K+TKsit8:Yav7uWKlWw5uzDot51bszUVll6/K+J
- TLSH T1F3C1AE713CA7B1E68475B53D8E5D56821BC38F411A22A384AA1CCC3A3E3FC58D053CAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\flaibjgdieeiakhdmgpkcogifikjnjhk\3.2.0.6_0\icon-16.png
- Size 619B
- SHA256 c905d2d994ae4a3ccffc4292af05c45ea4c8095576901f20b54a46d84a029448
- MD5 9a220f4366fb56d18d24933e43ef4f3a
- SHA1 a60c18e62acc2f416348e75917c2cc1935d8dfc5
- SHA512 7bf4444e7b8a431d681f4cef68b59550c21f3c9ec4df304417590888c5c072b74461331d2fe4dd93df4e0df0ca679246e8bc8005e0e08816f1912bb8ceb61ca0
- TLSH T191F0B76C7A1929FCCF2DB2014B78508DDE50101B31F03085E233B47C528CF1521F02D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\flaibjgdieeiakhdmgpkcogifikjnjhk\3.2.0.6_0\icon-48.png
- Size 2KB
- SHA256 b03c28aea1df52490e1cec0734e66a418bd92d2c9c49709a052847131a5cd09c
- MD5 3a7c0bd9b520802821feaefe4aff1193
- SHA1 a6c1ff7288de3d76b5bcdfdc3d0ae89cd0a4a683
- SHA512 3e19533d428d5ece9af021f4e25f7ba0c88ae1445430d04049db5bcb93eca6ee9c393af40b385e7b021867c6e61df49e51b4962477f594b457cbf8dda4c3aca4
- TLSH T1E6413AD1D72BA7386EAEE3E86CF61F22D14860954C8B571831CE3D552DBD9288207EC1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\CrxInstaller.dll
- Size 758KB
- SHA256 8e92441227f30d715dd9e39569e057f0bde5344e14f978e12f93cb6c6bea8eea
- MD5 12b3f1078692738533a3042abbc76144
- SHA1 8b504f9336e4ea434d6d3f3ef9f3a57323fe73c9
- SHA512 25c102e9ead20b929e5ab585a7021b840cf57835258cda7871a685af93e6a8b5a8296ee14203811a94b0282dfc5fc7b40f57f1d9b18f340a4c30a4d6d4ca377d
- SSDEEP 12288:VjGgsyxGOF1ShY5//kGqFL2UXiH8IEFQsavTsWqIsr59:VqgsyxGs//kGqFLzychFQtTOn59
- TLSH T146F4AE17F6C5C8B2F49E0179617366BF8A36EB2143EAC5C387A079558D313E0663D38A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\FindProcDLL.dll
- Size 4KB
- SHA256 337781f4d7524150600ad958aaf3d78b5bcbd30e921759bc7d12e7488687348c
- MD5 c764de9b88eeec6a17da10d523eebe5b
- SHA1 7d15fcbc34f5d0a970e303dd1c39ad981377fdcb
- SHA512 647339f01443614dd60e048942abc0ec2dbc13200162d072dce4dd07d55661c2f1a9051a6096c614f934a3c4d33342266d70fa6a7ed9f4bb042f804fe5fb170c
- TLSH T1C48185BA56E54FF9E1581D3030CE7013EBDD74B116AB625AC93F151A7BD0190D43C632
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- TLSH T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\CryptoKit.CertEnrollment.UnionPay.x86.dll
- Size 413KB
- SHA256 0940e9492cb5d7e98e71bb0825afcc6d6ea8d1117a6eccc7304b606558a52911
- MD5 50d58ca4e3b4763840927bed33d59d32
- SHA1 86388f02e92b3e55fcb480fbdbf97c8786bf6487
- SHA512 deb9322a900c2041534c9cc6086c7599332b62cc85d4fe49b0fc543cd3428bbbd8957364feefb5031299428e695dc2d5ef8e8c40b27e56e40bb6cef961489b04
- SSDEEP 6144:mwRXz5ntPoKqvu9D0w2waw99+Mz1hEGH0+UlKSNLeap:mwRXz5nOzu9gw2waw99+MzkbL
- TLSH T127944A71A6D5C031E4E6207056BC46B72C7ABA325BA1C8CB7385185D8AF67D2DB3432F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\CryptoKit.UnionPay.x86.dll
- Size 379KB
- SHA256 f77b1fe75e2403a369cd926e3ddf77bf20f7bb0ec4f72889cea0d10897f18f85
- MD5 739560fd60762bc22e3d52765f784a78
- SHA1 02c7c1ab1db36098bf1b698e263b12640f6d2c02
- SHA512 dadb3ccdfa7d80ddb29a26c632af6d2f9a9be66882a7af2debbf9c37ae7aebefa51e55e16542159d3b56d158e8ccc44e82cedbc4a8a313acb4a472b96662ef57
- SSDEEP 6144:zuJDmAtdvP0SIJmoOoBYNlobYwrLnMzPFH0+Ul5NLeaI8iv+t4:qRrdvcSIaoBylyYwrbMWyWt4
- TLSH T101847C20ABE5C031E6D61AB0567942B6187EF6312FA1C8CB73841D1D5EB27D36A3631F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\CryptoKit.CertEnrollment.UnionPay.x64.dll
- Size 474KB
- SHA256 87b7124d061fbf699316fd23f7992a1043c7f3a4a403f755c1201b10bc5fd423
- MD5 8a45f5ca118b7b095bfd24b08820947c
- SHA1 ed09e13d4e334fdf0f69059d9ad2d7f358c4fb60
- SHA512 24d5b5cf2cd0ed6a31dbae6af21ca9d27f14dbcb60c16dbf44b543bd6e6ed76ccc5cc0b7dc3bffd786e4416d76101c27c832dba2b5a453aad408a611ea9450ee
- SSDEEP 12288:PXxQAe8HsCXtbnCEcU+JXtTzBetU7DxlGaSwADpol+1uRz2zLFcaL9iscNWty7FF:GAe8HsCXtbnCEcU+JXtTzBetU7DxlGaT
- TLSH T1A0A46C19E79000A5E0B2E579CBF69276FF31745D8B7586DF2B680A1E2F32BD08835319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\CryptoKit.UnionPay.x64.dll
- Size 436KB
- SHA256 5878fad5492408132a674921bd3eb587014465641ab553c38859e59f2210ce08
- MD5 7a2320cc011345097b5c090a2f3447d2
- SHA1 f3f7df6f59190aabc49f0e8630d01c0e880940c1
- SHA512 72b92aa0f68445d5e6843888d4d900bf09da32fed95e830b31d73c0cd525d751909fc573219d70d9faece43a519d6e4879cf9440c25672f653d05e88a39ce6e0
- SSDEEP 12288:7quDf5qPUL6u0bHi/rt7PgXvvlwQfQWr8KpG/w1OYRpEMkY3NtEwCsxgtsSjggXE:7q85cUL6u0bHi/rt7IXvvlwQfQWr8Kpj
- TLSH T165946B1AE79408A9E063C179CBE79226FBB274599B7086DF27644B1E3F33BD08835315
- MD5 SHA1 SHA512 SSDEEP TLSH