f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069

General

Target
f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069.exe
Size 498KB
Sample261102-e69r8ssw5m
SHA256 f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069
MD5 4696d840088c552f166e162efe44e3fe
SHA1 40f9b03f2202c7e8e19d6d92619efc99881709ad
SHA512 006a2fe576c8eb4acba983b14119554f14dfd00d1eed956fb81ed6504491e0545a4186ca954be81ac4d7ec38b2061b3a1d51127bd65f3ad033f4d255f7358e64
SSDEEP 12288:1JYkorXXvkt08GlIjjTPTkXHXz/g8xmkAHTKK+uJjbRJJIjjTPTkXHXz/gs/cV:LSWPoIjjTPTkXHXz/g8xmSK5bIjjTPTt
TLSH
T11BB4E54662A4C4E8F5669239C8D1CFF5E2F27C7107209ADB02E07E677F23691BE39611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4644	NativeTimer.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\NativeTimerOneFile-E5A5108AF2B4\session.tmp	f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069.exe
File created	C:\Program Files\NativeTimerOneFile-E5A5108AF2B4\NativeTimer.exe	f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E5A5108AF2B491076EA674F2AC03D4E08FC2EED8\Blob = 030000000100000014000000e5a5108af2b491076ea674f2ac03d4e08fc2eed82000000001000000340400003082043030820298a003020102020900f5a2778a7f1fc42d300d06092a864886f70d01010b0500302b31293027060355040313204e617469766554696d6572204f6e6546696c6520436f6465205369676e696e67301e170d3236313130313138333735375a170d3238313130313138343235375a302b31293027060355040313204e617469766554696d6572204f6e6546696c6520436f6465205369676e696e67308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bd41f5b087a6fab2a1c98ceaf38c1f6fefedf6e38a4031f023486fcd7e77d7244349e3bc6c2a935545d1f912d17b3b84362357f955c4355a00cb6c92d13c0962ac219626499d2d3ef85761f81ee3720595bdb67137e46ae8414dadea63747d30990af3918aca89c3b462514429c59a218fa2d41a8ddef3c8f76a2729039e587bb5fb75801d9dae19cad87c809a0ae202326c2aa373327a96f3f953dcfd966acfef3ae916df0f04a9ff632e08ba7fc49eb85df7ce24802ee7776ca6507c393af174f11fd4e7b23fe30400340ed507d0497ec0386d9c3a0fdf05eab950ab5de3a78249585d7087b901a4ad361039e9d064933fcffca6f1b7fd2d1432fbe7ed83a9b3369d93442f19129b74fda35cb9d7092bb64c26b2a2c1bf15ad2bfe0103e25ba24239a0fa84318fbe26d8b40cf1d542dfdd1b55eb4572b351441f099384fcd18fe3faf2e74045b8ebcbec0105252f871ac6ba41948edd0bf7f3705f68431289d2481606fdf659c2ac783ff729185256143ca4138e3a9d6e324ab66e2c3d9e590203010001a3573055300c0603551d130101ff04023000300e0603551d0f0101ff04040302078030160603551d250101ff040c300a06082b06010505070303301d0603551d0e04160414fb441e4b6902a5dba3d07f56ddad59644603fe84300d06092a864886f70d01010b05000382018100ba52ed94ecd76eedb55c698ae624e2b97cb06a7b2e9cadab7df3c52816db292b9fd7bbc2d8a5e0e83b3e7ade9815217b32e56787897dbbaffc84ced9e530c7549b495024b9803c6adadde397edbe5fc20a17f334e3ef9756a8de793c6e7f750a1699bf05de0b07fea35ddf348b94e5ff769b892ffc5000262bb1babc75e5ce3978ed0de3d24abe8ac3baf15b8090ed4385e4459850c9cf6aab996a7337ecafe12e9ebfcd0e351839540c75d1ec3062972934162a7023561b8c4c4082148481e2937ee79eb17041ff407ff6137aba7c0c4bcfba3878865341804af399ce43bcef686c04d1eb70f2ceebd00401a51df5bbc4e3e0736c5c860018eff29b075318c999b792868ea94c6ba5bda199affe64dee190485decef514baf9fb827865cd16ff31c758ee2a29427a7377ea99cd51b8c61c52afe1605f99ebbf21d655e700fdb6e4204f0823e4b515c734ee48fcfabe0f6aa2e5e4bfd67a4748679e04a81c0d355ebb1c2f34c35f7ae0ca50036266bf16d143a166b5ed3494daeb436e63249d0	f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E5A5108AF2B491076EA674F2AC03D4E08FC2EED8\Blob = 0f00000001000000200000007b69267269250b82de7dfa8cff5d1527d1dd22f9afe8f8afb388c1982224dc4c030000000100000014000000e5a5108af2b491076ea674f2ac03d4e08fc2eed82000000001000000340400003082043030820298a003020102020900f5a2778a7f1fc42d300d06092a864886f70d01010b0500302b31293027060355040313204e617469766554696d6572204f6e6546696c6520436f6465205369676e696e67301e170d3236313130313138333735375a170d3238313130313138343235375a302b31293027060355040313204e617469766554696d6572204f6e6546696c6520436f6465205369676e696e67308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bd41f5b087a6fab2a1c98ceaf38c1f6fefedf6e38a4031f023486fcd7e77d7244349e3bc6c2a935545d1f912d17b3b84362357f955c4355a00cb6c92d13c0962ac219626499d2d3ef85761f81ee3720595bdb67137e46ae8414dadea63747d30990af3918aca89c3b462514429c59a218fa2d41a8ddef3c8f76a2729039e587bb5fb75801d9dae19cad87c809a0ae202326c2aa373327a96f3f953dcfd966acfef3ae916df0f04a9ff632e08ba7fc49eb85df7ce24802ee7776ca6507c393af174f11fd4e7b23fe30400340ed507d0497ec0386d9c3a0fdf05eab950ab5de3a78249585d7087b901a4ad361039e9d064933fcffca6f1b7fd2d1432fbe7ed83a9b3369d93442f19129b74fda35cb9d7092bb64c26b2a2c1bf15ad2bfe0103e25ba24239a0fa84318fbe26d8b40cf1d542dfdd1b55eb4572b351441f099384fcd18fe3faf2e74045b8ebcbec0105252f871ac6ba41948edd0bf7f3705f68431289d2481606fdf659c2ac783ff729185256143ca4138e3a9d6e324ab66e2c3d9e590203010001a3573055300c0603551d130101ff04023000300e0603551d0f0101ff04040302078030160603551d250101ff040c300a06082b06010505070303301d0603551d0e04160414fb441e4b6902a5dba3d07f56ddad59644603fe84300d06092a864886f70d01010b05000382018100ba52ed94ecd76eedb55c698ae624e2b97cb06a7b2e9cadab7df3c52816db292b9fd7bbc2d8a5e0e83b3e7ade9815217b32e56787897dbbaffc84ced9e530c7549b495024b9803c6adadde397edbe5fc20a17f334e3ef9756a8de793c6e7f750a1699bf05de0b07fea35ddf348b94e5ff769b892ffc5000262bb1babc75e5ce3978ed0de3d24abe8ac3baf15b8090ed4385e4459850c9cf6aab996a7337ecafe12e9ebfcd0e351839540c75d1ec3062972934162a7023561b8c4c4082148481e2937ee79eb17041ff407ff6137aba7c0c4bcfba3878865341804af399ce43bcef686c04d1eb70f2ceebd00401a51df5bbc4e3e0736c5c860018eff29b075318c999b792868ea94c6ba5bda199affe64dee190485decef514baf9fb827865cd16ff31c758ee2a29427a7377ea99cd51b8c61c52afe1605f99ebbf21d655e700fdb6e4204f0823e4b515c734ee48fcfabe0f6aa2e5e4bfd67a4748679e04a81c0d355ebb1c2f34c35f7ae0ca50036266bf16d143a166b5ed3494daeb436e63249d0	f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E5A5108AF2B491076EA674F2AC03D4E08FC2EED8	f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4644	NativeTimer.exe
4644	NativeTimer.exe
4644	NativeTimer.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4644	NativeTimer.exe
4644	NativeTimer.exe
4644	NativeTimer.exe

C:\Users\Admin\AppData\Local\Temp\f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069.exe
"C:\Users\Admin\AppData\Local\Temp\f4eecbaaef8f0e2aed1b53ca479825377be5332d74be6f3b9365f806f9dd4069.exe"
1⤵
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies system certificate store
PID:4324

C:\Program Files\NativeTimerOneFile-E5A5108AF2B4\NativeTimer.exe
"C:\Program Files\NativeTimerOneFile-E5A5108AF2B4\NativeTimer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NativeTimer.exe

Path C:\Program Files\NativeTimerOneFile-E5A5108AF2B4\NativeTimer.exe
Size 206KB
SHA256 895ebaad5e5cdfa0ecc85e8b0552a0b9f6016fbb0b8aaa1be7bd32023cb4368e
MD5 d2c4d27f29488c0c18fc82f4719f7673
SHA1 6bad77d7a2b5c47e859598061ec09e1ab7489fbe
SHA512 aac56e147c36adad9a2f57ced3304af244386a28c52866e33afafb5612b655f65fa36b81fe10fbf5ef4c1a36f3024ae1ca8d8addc3d1f6e79f68b1fcfb730b0f
SSDEEP 6144:0LwxO8MkAHTKK0jujx+NIf7bRJstaIjjTPTkXHXz/gsh:1xmkAHTKK+uJjbRJJIjjTPTkXHXz/gsh
TLSH
T15524F68662A4D0E9F1665238C9D1CFF6A3F67C710B105ADB07E07E677F22281BE39611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads