Overview
overview
10Static
static
8ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
8ฺฺฺ�...�ฺ1m
windows10_x64
3ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
8ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
3ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
3ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
8ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
3Resubmissions
18-11-2020 14:18
201118-dj27sn3f52 1018-11-2020 13:42
201118-1arz86e7w6 1018-11-2020 13:38
201118-n8jh228ctn 10Analysis
-
max time kernel
61s -
max time network
79s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 13:38
Static task
static1
Behavioral task
behavioral1
Sample
2019-09-02_22-41-10.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
31.bin.exe
Resource
win10v20201028
agenttesladharmaformbookagilenetcoreentitycryptoneevasionkeyloggerpackerpersistenceransomwareratrezer0spywarestealertrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
3DMark 11 Advanced Edition.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
DiskInternals_Uneraser_v5_keygen.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
ForceOp 2.8.7 - By RaiSence.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
HYDRA.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
Keygen.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
LtHv0O2KZDK4M637.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
OnlineInstaller.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
api.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral17
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral18
Sample
good.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral19
Sample
infected dot net installer.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral20
Sample
update.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral21
Sample
vir1.xls
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral22
Sample
xNet.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral23
Sample
1.bin.exe
Resource
win10v20201028
agenttesladharmaformbookagilenetcoreentitycryptoneevasionkeyloggerpackerpersistenceransomwareratrezer0spywarestealertrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
VPN/VyprVPN.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral25
Sample
VPN/xNet.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral26
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe
Score
8/10
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
pid Process 2532 WCInstaller.exe 3032 WebCompanionInstaller.exe 3696 WebCompanion.exe 3040 Lavasoft.WCAssistant.WinService.exe -
Loads dropped DLL 58 IoCs
pid Process 3032 WebCompanionInstaller.exe 3032 WebCompanionInstaller.exe 3032 WebCompanionInstaller.exe 3032 WebCompanionInstaller.exe 3032 WebCompanionInstaller.exe 3032 WebCompanionInstaller.exe 3032 WebCompanionInstaller.exe 3032 WebCompanionInstaller.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe 3696 WebCompanion.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize " WebCompanion.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Events.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\BCUEngineS.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebcompaionReimageIcon.ico WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\DotNetZip.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionExtensionIE.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon.ico WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Extension\@wcextensionff.xpi WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.Shell32.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Extension.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\NCalc.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Omni.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.pdb WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.Loader.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon_Pro.ico WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WcCommunication.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Esent.Interop.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.IEController.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll WebCompanionInstaller.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Lavasoft.WCAssistant.WinService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs Lavasoft.WCAssistant.WinService.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WebCompanionInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WebCompanionInstaller.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3696 WebCompanion.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 508 wrote to memory of 2532 508 Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe 78 PID 508 wrote to memory of 2532 508 Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe 78 PID 508 wrote to memory of 2532 508 Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe 78 PID 2532 wrote to memory of 3032 2532 WCInstaller.exe 79 PID 2532 wrote to memory of 3032 2532 WCInstaller.exe 79 PID 2532 wrote to memory of 3032 2532 WCInstaller.exe 79 PID 3032 wrote to memory of 1772 3032 WebCompanionInstaller.exe 81 PID 3032 wrote to memory of 1772 3032 WebCompanionInstaller.exe 81 PID 3032 wrote to memory of 1772 3032 WebCompanionInstaller.exe 81 PID 3032 wrote to memory of 2236 3032 WebCompanionInstaller.exe 83 PID 3032 wrote to memory of 2236 3032 WebCompanionInstaller.exe 83 PID 3032 wrote to memory of 2236 3032 WebCompanionInstaller.exe 83 PID 3032 wrote to memory of 2564 3032 WebCompanionInstaller.exe 85 PID 3032 wrote to memory of 2564 3032 WebCompanionInstaller.exe 85 PID 3032 wrote to memory of 2564 3032 WebCompanionInstaller.exe 85 PID 3032 wrote to memory of 1900 3032 WebCompanionInstaller.exe 87 PID 3032 wrote to memory of 1900 3032 WebCompanionInstaller.exe 87 PID 3032 wrote to memory of 1900 3032 WebCompanionInstaller.exe 87 PID 1900 wrote to memory of 4060 1900 cmd.exe 89 PID 1900 wrote to memory of 4060 1900 cmd.exe 89 PID 1900 wrote to memory of 4060 1900 cmd.exe 89 PID 3032 wrote to memory of 3696 3032 WebCompanionInstaller.exe 90 PID 3032 wrote to memory of 3696 3032 WebCompanionInstaller.exe 90 PID 3032 wrote to memory of 3696 3032 WebCompanionInstaller.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe"C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exeC:\Users\Admin\AppData\Local\Temp\Temp\WCInstaller.exe --silent --partner=AE190201 --homepage=1 --search=1 --campaign=2922⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\7zS4E9D11D4\WebCompanionInstaller.exe.\WebCompanionInstaller.exe --partner=AE190201 --campaign=292 --version=7.0.2354.4185 --prod --silent --partner=AE190201 --homepage=1 --search=1 --campaign=2923⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\sc.exe"sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto4⤵PID:1772
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" failure WCAssistantService reset= 30 actions= restart/600004⤵PID:2236
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"4⤵PID:2564
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone4⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\netsh.exenetsh http add urlacl url=http://+:9007/ user=Everyone5⤵PID:4060
-
-
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
-
-
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3040