0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796

General

Target

0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
Size

944KB
MD5

8f13700aaaab492434d453c885cd17a3
SHA1

8ae74e13758595061e78e6be818866017104e9d8
SHA256

0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796
SHA512

9c7f54cb1f965aff6e28e14ff59f6f99681d2987183703c57e691eb5f44f15b35036eae8a81ec4a702934cf4b09ccfc4fe33e9b18d92a216a8d56e85c47dd0d7

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exeregsvr32.exe

pid process

4796 0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
2860 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Drops file in Program Files directory 22 IoCs

Processes:

0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe

description	ioc	process
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\icons\Thumbs.db	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\icons\Thumbs.db	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ie\MediaViewerV1alpha4643.dll	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ch\MediaViewerV1alpha4643.crx	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ch\MediaViewerV1alpha4643.crx	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome.manifest	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\icons\default\MediaViewerV1alpha4643_32.png	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\uninstall.exe	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\install.rdf	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\ffMediaViewerV1alpha4643ffaction.js	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\install.rdf	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\ffMediaViewerV1alpha4643.js	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\ffMediaViewerV1alpha4643.js	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\icons\default	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\icons	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\icons\default\MediaViewerV1alpha4643_32.png	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome.manifest	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\ffMediaViewerV1alpha4643ffaction.js	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File created	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\overlay.xul	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
File opened for modification	C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ff\chrome\content\overlay.xul	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Approved Extensions	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{f1605087-b919-4c79-9279-45418ac255fc} = 51667a6c4c1d3b1b974d75ed2feb14028f7b0101898212e3	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe

Modifies registry class 36 IoCs

Processes:

regsvr32.exe0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\TypeLib\ = "{87405625-447E-40C5-A7E3-1E96663EBD25}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\ = "IMediaViewerV1alpha4643BHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\ = "Media Viewer"	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1\ = "MediaViewerV1alpha4643Lib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\MediaViewerV1\\MediaViewerV1alpha4643\\ie"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\ = "IMediaViewerV1alpha4643BHO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\ = "MediaViewerV1alpha4643"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\InprocServer32\ = "C:\\Program Files (x86)\\MediaViewerV1\\MediaViewerV1alpha4643\\ie\\MediaViewerV1alpha4643.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\TypeLib\ = "{87405625-447E-40C5-A7E3-1E96663EBD25}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48160832-7E1E-4B7C-BDEE-08B47A3F8F29}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\Version\ = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1\0\win32\ = "C:\\Program Files (x86)\\MediaViewerV1\\MediaViewerV1alpha4643\\ie\\MediaViewerV1alpha4643.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f1605087-b919-4c79-9279-45418ac255fc}\TypeLib\ = "{87405625-447e-40c5-a7e3-1e96663ebd25}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87405625-447E-40C5-A7E3-1E96663EBD25}\1.1\0\win32	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe

pid	process
4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe

description	pid	process	target process
PID 4796 wrote to memory of 2860	4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe	regsvr32.exe
PID 4796 wrote to memory of 2860	4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe	regsvr32.exe
PID 4796 wrote to memory of 2860	4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
"C:\Users\Admin\AppData\Local\Temp\0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 "C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ie\MediaViewerV1alpha4643.dll" /s
2⤵
- Loads dropped DLL
- Modifies registry class
PID:2860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ie\MediaViewerV1alpha4643.dll
Filesize
85KB

MD5
3a4e3015a9417cd38284bd14426e715f

SHA1
2e44f32159021ddf5efb38b5129ebbf3a227e064

SHA256
b36f745db08a05baf7dc5b66c96ab35565013ee41f74c4e3bccad8dea346ec4c

SHA512
8d96138582ad75bb78918850234b398f965da01946054dccb5307e439a4f5c4a5feb3ded4ad8e5e566203f1d0b25dbf5e1284003304aff7f3ac5ca251fc26387

Download Submit
C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha4643\ie\MediaViewerV1alpha4643.dll
Filesize
85KB

MD5
3a4e3015a9417cd38284bd14426e715f

SHA1
2e44f32159021ddf5efb38b5129ebbf3a227e064

SHA256
b36f745db08a05baf7dc5b66c96ab35565013ee41f74c4e3bccad8dea346ec4c

SHA512
8d96138582ad75bb78918850234b398f965da01946054dccb5307e439a4f5c4a5feb3ded4ad8e5e566203f1d0b25dbf5e1284003304aff7f3ac5ca251fc26387

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso77A7.tmp\aminsis.dll
Filesize
834KB

MD5
14ad04243334645f399639b028f21d17

SHA1
7368866dc95621a1407d2105d040da2cc9852ba9

SHA256
02d13f28df1314640474ee77cd202a2c0da8e1d609c614f8fdff4451f8ee63fa

SHA512
3859b6f6e7e46ba70fa0be24fd2ceadf3db746818f11a09109c7bb678ee4fc08824a0cf15c77df09c3b2bdc2a80067a98130660152f5ee61e4bd501ef5ed1728

Download Submit
memory/2860-131-0x0000000000000000-mapping.dmp

Download

pid	process
4796	0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796.exe
2860	regsvr32.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads