a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0

General

Target

a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
Size

61KB
MD5

353d8285f3bb6d304bbba847b3503797
SHA1

524d26796c6e0d769c4fe680f124e778fa54a447
SHA256

a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0
SHA512

d2167708a06253bb0cf9a30294a65ce969f40bb852b201da41aeeba92b839e7f3460cca227bd5954daed99b7fb376294a6432cdf7e60280ef040ce47b8effce3

Score

10^/10

adware evasion stealer

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Drops file in System32 directory 2 IoCs

Processes:

a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ipv6mons.dll	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
File opened for modification	C:\Windows\SysWOW64\ipv6mons.dll	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

Modifies registry class 6 IoCs

Processes:

a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73364D99-1240-4dff-B11A-67E448373048}\InprocServer32	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73364D99-1240-4dff-B11A-67E448373048}\InprocServer32\ = "C:\\Windows\\SysWow64\\ipv6mons.dll"	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73364D99-1240-4dff-B11A-67E448373048}\InprocServer32\ThreadingModel = "apartment"	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73364D99-1240-4dff-B11A-67E448373048}\InprocServer32\Enable Browser Extensions = "yes"	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\\{73364D99-1240-4dff-B11A-67E448373048}	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73364D99-1240-4dff-B11A-67E448373048}	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

pid process

1044 a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

pid	process
1044	a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe

C:\Users\Admin\AppData\Local\Temp\a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe
"C:\Users\Admin\AppData\Local\Temp\a79f71899a4f7335e65c6d53cf652fca86bc71de76a87a436412ff7227b2cfa0.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-54-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads