Analysis
-
max time kernel
124s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 01:03
Static task
static1
Behavioral task
behavioral1
Sample
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe
Resource
win7-20220414-en
General
-
Target
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe
-
Size
632KB
-
MD5
2b62663842db9f701ad4f41905f85527
-
SHA1
81d5d67c4df0a0bf9f50032e713b4291d3463b4a
-
SHA256
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a
-
SHA512
0fec57f65127df7d6fc4d968dcffbd4f51dd28c01eeef44d8b83abba8471071e1069fb9edc4efb82246ca48ba8864d9c86473e74015a778f088b29420cd21daf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe -
Loads dropped DLL 2 IoCs
Processes:
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exeregsvr32.exepid process 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe 5072 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 4 IoCs
Processes:
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe -
Drops file in Program Files directory 22 IoCs
Processes:
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exedescription ioc process File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\icons 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\icons\default\MediaViewV1alpha611_32.png 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\icons\default\MediaViewV1alpha611_32.png 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\uninstall.exe 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\install.rdf 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\install.rdf 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ch\MediaViewV1alpha611.crx 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome.manifest 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\ffMediaViewV1alpha611.js 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\ffMediaViewV1alpha611ffaction.js 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\ffMediaViewV1alpha611ffaction.js 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ie\MediaViewV1alpha611.dll 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ch\MediaViewV1alpha611.crx 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\icons\Thumbs.db 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\overlay.xul 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\icons\Thumbs.db 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\icons\default 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\overlay.xul 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome.manifest 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ff\chrome\content\ffMediaViewV1alpha611.js 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Approved Extensions 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b} = 51667a6c4c1d3b1bbc39a8e4d4d6950884b9a68a734be006 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe -
Modifies registry class 36 IoCs
Processes:
regsvr32.exe0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1\ = "MediaViewV1alpha611Lib" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha611\\ie" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\TypeLib\ = "{34bab37c-3a8e-4d39-8361-4a8a529a5c39}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\ = "IMediaViewV1alpha611BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\ = "Media View" 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\ = "IMediaViewV1alpha611BHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\TypeLib\ = "{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\ = "MediaViewV1alpha611" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1\0\win32\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha611\\ie\\MediaViewV1alpha611.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64640A0D-7A7E-4327-873D-AC6828661AA8}\TypeLib\ = "{34BAB37C-3A8E-4D39-8361-4A8A529A5C39}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\InprocServer32\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha611\\ie\\MediaViewV1alpha611.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb226ac-82ea-45ff-9ab5-e4ca7009a11b} 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exepid process 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exedescription pid process target process PID 4464 wrote to memory of 5072 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe regsvr32.exe PID 4464 wrote to memory of 5072 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe regsvr32.exe PID 4464 wrote to memory of 5072 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe regsvr32.exe PID 4464 wrote to memory of 5064 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe gpupdate.exe PID 4464 wrote to memory of 5064 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe gpupdate.exe PID 4464 wrote to memory of 5064 4464 0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe gpupdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe"C:\Users\Admin\AppData\Local\Temp\0119d358d5a716dd829aab8368ad09f4aa4d5ef4cd7a54040f02ba104913508a.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ie\MediaViewV1alpha611.dll" /s2⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ie\MediaViewV1alpha611.dllFilesize
85KB
MD55c2f4ca5a951ceb6b91157f49f3a0781
SHA12e32751f33ea6fb61f436bbff378138f9fd59a51
SHA256c79cfd07b7b88ce631372a4841ee591f4a3070ec09a97657cb2149d9d9c21efa
SHA51262f8eb167801862d50468920d1deea82c27178fe266eaf0647ef83aa8dbfce596c496f7dfd71c8a1b85ab0b22196b0a72ea478d68a6e34ee1dfeb96987dcd0ce
-
C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha611\ie\MediaViewV1alpha611.dllFilesize
85KB
MD55c2f4ca5a951ceb6b91157f49f3a0781
SHA12e32751f33ea6fb61f436bbff378138f9fd59a51
SHA256c79cfd07b7b88ce631372a4841ee591f4a3070ec09a97657cb2149d9d9c21efa
SHA51262f8eb167801862d50468920d1deea82c27178fe266eaf0647ef83aa8dbfce596c496f7dfd71c8a1b85ab0b22196b0a72ea478d68a6e34ee1dfeb96987dcd0ce
-
C:\Users\Admin\AppData\Local\Temp\nskBC31.tmp\aminsis.dllFilesize
559KB
MD575fccc3ffe4fdeaa26b9098975ba3772
SHA19f04339adecad084b9696f757a8c12d3fd036be0
SHA25671fd0603ba5bb405a0d134595c0d7f7d2ffd83bf1d083d4ccb6e7382f5bef81e
SHA512bd3c65aa43b88dd3e1449180944d7dd6df3734fb1097117be4285b8b4bd72e7decf5e3e18e8a49b51b71b47b9ae9e444128dfeb1167a4b04a08dc220d314e3bd
-
memory/5064-134-0x0000000000000000-mapping.dmp
-
memory/5072-131-0x0000000000000000-mapping.dmp