Overview

overview

8

Static

static

929ad412f2...e3.exe

windows7_x64

8

929ad412f2...e3.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    137s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    27-04-2022 15:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3.exe

  • Size

    24KB

  • MD5

    58de1ef68aefc14928f13ada8ffdc7d6

  • SHA1

    746c48cbc7c6494a97eb51fc5653ea4d92067886

  • SHA256

    929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3

  • SHA512

    0dff73007502969838c2c3dd7c9f89775cad5a6d07f8acebe8660f376cfaf8c0e76cd3e68b65f04421139cad7225abebcdfc824ebcb9c4bdb81fcb1cac1841f7

Score
8/10
adwarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 18 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3.exe
    "C:\Users\Admin\AppData\Local\Temp\929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\iehf.bat "C:\Users\Admin\AppData\Local\Temp\929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3.exe"
      2⤵
        PID:1484

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Browser Extensions

    1
    T1176

    Privilege Escalation

    Defense Evasion

    Modify Registry

    3
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\iehf.bat
      Filesize

      70B

      MD5

      677931564938373367422e56cdf23934

      SHA1

      fb077020992d9fa49a901d3b64c3d9ce5bb88b35

      SHA256

      2d8efe1526fa203539bc77da8570b4cb38d5a63836a76d2379b7b506d0a67ee0

      SHA512

      808e177716911a5b975449b55df4fe1fc97cdb929be621fe541a7dfe7dce3362039214fe1ab4760c4d67aafe8a12308d04e5a40dc028b848c154f3e3f2d120ba

      Download Submit
    • C:\Windows\SysWOW64\hkjig.dll
      Filesize

      30KB

      MD5

      6ab6da7e09169e8c7e2b19a9c6f92525

      SHA1

      f7380838c22b386719cd684eaf11a0987166a4a9

      SHA256

      a0e35b3490d586c57550c12f89fa9087da687f775951190224ee96a00385ec5b

      SHA512

      0c5074c723b9c9666cd996301765069cc5676c8756a9d573a2976c6f609cae6992d8d5198b52e9c0aba7e076a2b916554f040fce16574fc44cd98ef124a31b11

      Download Submit
    • memory/1484-132-0x0000000000000000-mapping.dmp
      Download