Analysis
-
max time kernel
123s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28-05-2022 03:55
Static task
static1
Behavioral task
behavioral1
Sample
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe
Resource
win7-20220414-en
General
-
Target
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe
-
Size
632KB
-
MD5
4d40b43d9bbe744efc3c2774c85638a8
-
SHA1
82073db861a7bf494dfe222a8f9c0b12200f91f1
-
SHA256
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256
-
SHA512
b80b60455f23d3c6c14117ec0dec3206f122cab7f33ccdd1d9f8b6476def104e701f9926db9b8150731a9818544da332a84f3e32fd705dffb948b6df75483262
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe -
Loads dropped DLL 2 IoCs
Processes:
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exeregsvr32.exepid process 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe 2188 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 4 IoCs
Processes:
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe -
Drops file in Program Files directory 22 IoCs
Processes:
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exedescription ioc process File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\ffMediaViewV1alpha8300ffaction.js 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\icons 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\icons\default\MediaViewV1alpha8300_32.png 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\icons\default\MediaViewV1alpha8300_32.png 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\uninstall.exe 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ch\MediaViewV1alpha8300.crx 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\install.rdf 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\ffMediaViewV1alpha8300.js 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\ffMediaViewV1alpha8300ffaction.js 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ie\MediaViewV1alpha8300.dll 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome.manifest 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\ffMediaViewV1alpha8300.js 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\overlay.xul 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\overlay.xul 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\icons\Thumbs.db 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\icons\Thumbs.db 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome\content\icons\default 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ch\MediaViewV1alpha8300.crx 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\chrome.manifest 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ff\install.rdf 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{e116eed5-3f42-4211-bcab-3800f8d40dd9} = 51667a6c4c1d3b1bc5f10cf87c6b7b0fa2a77a40fb964cc4 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Approved Extensions 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe -
Modifies registry class 36 IoCs
Processes:
regsvr32.exe028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha8300\\ie" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\ = "IMediaViewV1alpha8300BHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\ = "IMediaViewV1alpha8300BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\TypeLib\ = "{056206E1-E406-4944-BF97-A85C2EE25150}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9} 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\InprocServer32\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha8300\\ie\\MediaViewV1alpha8300.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\TypeLib\ = "{056206e1-e406-4944-bf97-a85c2ee25150}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\TypeLib\ = "{056206E1-E406-4944-BF97-A85C2EE25150}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1\ = "MediaViewV1alpha8300Lib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\ = "Media View" 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\ = "MediaViewV1alpha8300" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e116eed5-3f42-4211-bcab-3800f8d40dd9}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{056206E1-E406-4944-BF97-A85C2EE25150}\1.1\0\win32\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha8300\\ie\\MediaViewV1alpha8300.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A83EEF99-A803-48CB-9250-AAE404CEA8FC}\TypeLib\Version = "1.1" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exepid process 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exedescription pid process target process PID 4156 wrote to memory of 2188 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe regsvr32.exe PID 4156 wrote to memory of 2188 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe regsvr32.exe PID 4156 wrote to memory of 2188 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe regsvr32.exe PID 4156 wrote to memory of 884 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe gpupdate.exe PID 4156 wrote to memory of 884 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe gpupdate.exe PID 4156 wrote to memory of 884 4156 028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe gpupdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe"C:\Users\Admin\AppData\Local\Temp\028ebd70e6092d83150e3eaa5475ee91f1f428d89a57251640d55155d4a91256.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ie\MediaViewV1alpha8300.dll" /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2188 -
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe" /force2⤵PID:884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4420
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ie\MediaViewV1alpha8300.dllFilesize
85KB
MD58404376ee4705fc77ed242a2685d666a
SHA1e3529255a05be283c4af7c603cd79f63311ee912
SHA25647eeaf05dc3944c5a3c13936584c86c383f67d367979cc3a1d2f69d10e1faa4a
SHA51212ca702ac0ec301e0acf2afc8f6f2d5e29c2b631706f5cb61d1b1c50f6c48fcb716c67f36cda2ce52d06ecf77910f8d341074e7a6913fcd851187c7d81158fe3
-
C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8300\ie\MediaViewV1alpha8300.dllFilesize
85KB
MD58404376ee4705fc77ed242a2685d666a
SHA1e3529255a05be283c4af7c603cd79f63311ee912
SHA25647eeaf05dc3944c5a3c13936584c86c383f67d367979cc3a1d2f69d10e1faa4a
SHA51212ca702ac0ec301e0acf2afc8f6f2d5e29c2b631706f5cb61d1b1c50f6c48fcb716c67f36cda2ce52d06ecf77910f8d341074e7a6913fcd851187c7d81158fe3
-
C:\Users\Admin\AppData\Local\Temp\nss8FF1.tmp\aminsis.dllFilesize
559KB
MD575fccc3ffe4fdeaa26b9098975ba3772
SHA19f04339adecad084b9696f757a8c12d3fd036be0
SHA25671fd0603ba5bb405a0d134595c0d7f7d2ffd83bf1d083d4ccb6e7382f5bef81e
SHA512bd3c65aa43b88dd3e1449180944d7dd6df3734fb1097117be4285b8b4bd72e7decf5e3e18e8a49b51b71b47b9ae9e444128dfeb1167a4b04a08dc220d314e3bd
-
memory/884-134-0x0000000000000000-mapping.dmp
-
memory/2188-131-0x0000000000000000-mapping.dmp