Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
29-05-2022 22:58
Static task
static1
Behavioral task
behavioral1
Sample
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe
Resource
win7-20220414-en
General
-
Target
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe
-
Size
632KB
-
MD5
4dd7a26552e9885481101516d4300f70
-
SHA1
cdfde185559ef63a1b206bc652ac1b29824a29e9
-
SHA256
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3
-
SHA512
3152b97b85af9e4158a8dd9e27a02d39b90814d43dcd2bfe55706a80c202494bc26faf263800678954b72722cf45c36829eb63929dbde6031beb9dd682a932bc
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exeregsvr32.exepid process 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe 2024 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 4 IoCs
Processes:
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe -
Drops file in Program Files directory 22 IoCs
Processes:
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exedescription ioc process File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\icons 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ch\MediaViewV1alpha8138.crx 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\install.rdf 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\ffMediaViewV1alpha8138ffaction.js 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\overlay.xul 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ch\MediaViewV1alpha8138.crx 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\ffMediaViewV1alpha8138.js 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\ffMediaViewV1alpha8138ffaction.js 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\icons\default\MediaViewV1alpha8138_32.png 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome.manifest 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\ffMediaViewV1alpha8138.js 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\overlay.xul 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\uninstall.exe 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\icons\default 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\icons\default\MediaViewV1alpha8138_32.png 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ie\MediaViewV1alpha8138.dll 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome.manifest 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\install.rdf 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File created C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\icons\Thumbs.db 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe File opened for modification C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ff\chrome\content\icons\Thumbs.db 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1} = 51667a6c4c1d3b1b7e3f9abfaf99aa06b9960ec8e440d1dd 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Approved Extensions 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe -
Modifies registry class 36 IoCs
Processes:
regsvr32.exe0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1} 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\ = "MediaViewV1alpha8138" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\ = "Media View" 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\InprocServer32\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha8138\\ie\\MediaViewV1alpha8138.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1\0\win32\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha8138\\ie\\MediaViewV1alpha8138.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\TypeLib\ = "{E9FD369B-AF88-4C23-BA2B-06071BB6260B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\TypeLib\ = "{e9fd369b-af88-4c23-ba2b-06071bb6260b}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\MediaViewV1\\MediaViewV1alpha8138\\ie" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\ = "IMediaViewV1alpha8138BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\Version\ = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1\ = "MediaViewV1alpha8138Lib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\TypeLib\ = "{E9FD369B-AF88-4C23-BA2B-06071BB6260B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\ = "IMediaViewV1alpha8138BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ae88206e-ce9b-4ec2-ad95-4888e10a92c1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9FD369B-AF88-4C23-BA2B-06071BB6260B}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE6A983-0B71-473B-8DC3-B96666F6B31D} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exepid process 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exedescription pid process target process PID 1080 wrote to memory of 2024 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe regsvr32.exe PID 1080 wrote to memory of 2024 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe regsvr32.exe PID 1080 wrote to memory of 2024 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe regsvr32.exe PID 1080 wrote to memory of 2024 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe regsvr32.exe PID 1080 wrote to memory of 2024 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe regsvr32.exe PID 1080 wrote to memory of 2024 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe regsvr32.exe PID 1080 wrote to memory of 2024 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe regsvr32.exe PID 1080 wrote to memory of 956 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe gpupdate.exe PID 1080 wrote to memory of 956 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe gpupdate.exe PID 1080 wrote to memory of 956 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe gpupdate.exe PID 1080 wrote to memory of 956 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe gpupdate.exe PID 1080 wrote to memory of 956 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe gpupdate.exe PID 1080 wrote to memory of 956 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe gpupdate.exe PID 1080 wrote to memory of 956 1080 0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe gpupdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe"C:\Users\Admin\AppData\Local\Temp\0cbb70c2ee329589940ec4b1ce78e73185e6857af62081ee83787bf4ea5e77a3.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ie\MediaViewV1alpha8138.dll" /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2024 -
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe" /force2⤵PID:956
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ie\MediaViewV1alpha8138.dllFilesize
85KB
MD5bb77787c1b904d028796ed162292e043
SHA1c01879602be84884607185ec2a82327b6cc0580e
SHA2565109257da9dbd33680262d24e1bbbb40d0e43d4def5c4376302c05bea0c59b5a
SHA512949936bb63bae9a634d97b431f4fc7858c4b9aaff8d2f974b15da034462a67be3c45594ebfa0cbcc701aea3c1901049ca586274ed09a4df43f1e92ba9775d1c7
-
\Program Files (x86)\MediaViewV1\MediaViewV1alpha8138\ie\MediaViewV1alpha8138.dllFilesize
85KB
MD5bb77787c1b904d028796ed162292e043
SHA1c01879602be84884607185ec2a82327b6cc0580e
SHA2565109257da9dbd33680262d24e1bbbb40d0e43d4def5c4376302c05bea0c59b5a
SHA512949936bb63bae9a634d97b431f4fc7858c4b9aaff8d2f974b15da034462a67be3c45594ebfa0cbcc701aea3c1901049ca586274ed09a4df43f1e92ba9775d1c7
-
\Users\Admin\AppData\Local\Temp\nsdF346.tmp\aminsis.dllFilesize
559KB
MD575fccc3ffe4fdeaa26b9098975ba3772
SHA19f04339adecad084b9696f757a8c12d3fd036be0
SHA25671fd0603ba5bb405a0d134595c0d7f7d2ffd83bf1d083d4ccb6e7382f5bef81e
SHA512bd3c65aa43b88dd3e1449180944d7dd6df3734fb1097117be4285b8b4bd72e7decf5e3e18e8a49b51b71b47b9ae9e444128dfeb1167a4b04a08dc220d314e3bd
-
memory/956-60-0x0000000000000000-mapping.dmp
-
memory/1080-54-0x00000000755C1000-0x00000000755C3000-memory.dmpFilesize
8KB
-
memory/2024-56-0x0000000000000000-mapping.dmp