7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef

General

Target

7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Size

39KB
MD5

e1a1bf89f1c39aa0b6a341dee6252274
SHA1

dcd0a6e89288a85d9ad93e0505812c966fed31ef
SHA256

7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef
SHA512

3e4715f4ccd585dbf0fe48f2ca2b1f9fc0b48871b1782594c336a7046b6b19a64d274a5cd065ea21a44802a7fa1359432c77897868eef9918526316ba2e9b2dd
SSDEEP

768:+u3U+ZNHc4qMwDFFoqZ8GM+KynXNTPzpGmYlvYLz8VSiRtWh:DDxwDFFoqZ8G3KGXNjz5Ylgnvirc

Score

9^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c0000000054a8-58.dat	acprotect
behavioral1/files/0x000c0000000054a8-59.dat	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000054a8-58.dat	upx
behavioral1/files/0x000c0000000054a8-59.dat	upx

Deletes itself 1 IoCs

pid	Process
1400	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1168	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jhxm32.dll	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
File created	C:\Windows\SysWOW64\sft.res	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}\InprocServer32	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}\InprocServer32\ThreadingModel = "Apartment"	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}\ProgID\ = "MS"	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}\ProgID	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}\TypeLib	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}\TypeLib\ = "{8DAFE20B-F1B8-4dcc-8995-2882DAD0A622}"	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}\ = "Microsoft copyright"	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}\InprocServer32\ = "jhxm32.dll"	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1168	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	27
PID 996 wrote to memory of 1168	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	27
PID 996 wrote to memory of 1168	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	27
PID 996 wrote to memory of 1168	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	27
PID 996 wrote to memory of 1168	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	27
PID 996 wrote to memory of 1168	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	27
PID 996 wrote to memory of 1168	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	27
PID 996 wrote to memory of 1400	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	28
PID 996 wrote to memory of 1400	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	28
PID 996 wrote to memory of 1400	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	28
PID 996 wrote to memory of 1400	996	7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe	28

C:\Users\Admin\AppData\Local\Temp\7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe
"C:\Users\Admin\AppData\Local\Temp\7b9e19e7598841d3b07ee950e26833a51b0f18789260ecc27fa5ceb28ed637ef.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s jhxm32.dll
  2⤵
  - Loads dropped DLL
  PID:1168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7B9E19~1.EXE >> NUL
  2⤵
  - Deletes itself
  PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\jhxm32.dll

Filesize
28KB

MD5
46bd6c40a886049b723777d3aac5cd2a

SHA1
2edb22988c2cdeb27baa268d65de61f2969423f3

SHA256
b1153842b5d1d03afcf1a2e7f7fe3969651c4105928c82ca9d967f6657e530ac

SHA512
f3fa1a18740703e9a9f4755d8046e42d019def151890ddaf023855056c61b8ce8a4187bfcd8362be942aaad4ffc56a4ffb059eac4addd24c1c1f3028e63c8320

Download Submit
\Windows\SysWOW64\jhxm32.dll

Filesize
28KB

MD5
46bd6c40a886049b723777d3aac5cd2a

SHA1
2edb22988c2cdeb27baa268d65de61f2969423f3

SHA256
b1153842b5d1d03afcf1a2e7f7fe3969651c4105928c82ca9d967f6657e530ac

SHA512
f3fa1a18740703e9a9f4755d8046e42d019def151890ddaf023855056c61b8ce8a4187bfcd8362be942aaad4ffc56a4ffb059eac4addd24c1c1f3028e63c8320

Download Submit
memory/996-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1168-55-0x0000000000000000-mapping.dmp

Download
memory/1400-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads