fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df

General

Target

fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
Size

143KB
MD5

48974fd1230af0ef4f380bf0c835aa86
SHA1

54424bd91e538f7c4978dda4c3a18f4587bbfc11
SHA256

fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df
SHA512

7ddc5f91d40a04cefb493763970179120015bac3765104842dfedc8b166cd9372fab9f1cbdc28f3b5f16c886384df41373b348bc127f58b5cee6d44aec060bc2
SSDEEP

3072:PXepGQJhYRPJB2U4jnFHM8fxunoqyNZHKJlh:vHQ7YRZwzZunoqMHab

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
1176	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}	regsvr32.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system.ini	regsvr32.exe
File opened for modification	C:\Windows\UoDo\sun.dll	regsvr32.exe
File created	C:\Windows\UoDo\sun.dll	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
File opened for modification	C:\Windows\system.ini	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
File opened for modification	C:\Windows\UoDo\sun.dll	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32\ = "C:\\Windows\\UoDo\\sun.dll"	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32\ThreadingModel = "Apartment"	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{296AB1B8-FB22-4D17-8834"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{296AB1B8-FB22-4D17-8834"	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32\ = "C:\\Windows\\UoDo\\sun.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\TypeLib	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1176	952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe	28
PID 952 wrote to memory of 1176	952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe	28
PID 952 wrote to memory of 1176	952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe	28
PID 952 wrote to memory of 1176	952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe	28
PID 952 wrote to memory of 1176	952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe	28
PID 952 wrote to memory of 1176	952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe	28
PID 952 wrote to memory of 1176	952	fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe	28

C:\Users\Admin\AppData\Local\Temp\fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe
"C:\Users\Admin\AppData\Local\Temp\fe2b4c387c5c5d30baf95d5bb5587b092398b2f25acc909c2fc01c512716c2df.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  "regsvr32.exe" "C:\Windows\UoDo\sun.dll" /s
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in Windows directory
  - Modifies registry class
  PID:1176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\UoDo\sun.dll

Filesize
160KB

MD5
3604cd3a88c803844700cb3353f947eb

SHA1
520ba9cd8cd0f2015bad6cbdd8274f8a0e23c62e

SHA256
c96714fd67c0ea654ab3d80e2012f1119b7c1e5883b070f0577b910c7ff8fb4f

SHA512
d0cde7095ccee853a21c07de5b2acf13c2b1b3a22eb313d065e6f9dfdb79bde99fe603699a5fb2e0b995805326995bcd2981ef4dd9cc630357416bdcb1a3ef39

Download Submit
C:\Windows\system.ini

Filesize
247B

MD5
988113508b6d5e5d924055fd0c5fa4b5

SHA1
da42a2ac6165729f99eb14bdb6d16e88586e5fdd

SHA256
69258790cd66222b620200927340a17d2619ae6bb6136c220da95cabbf66d073

SHA512
359ffc3e373394df9add957791898e870520248a8364183f9b8bb01c7e139fa23950a34530a2c91ab41033510a3c6f2bb0d100020222dead2ad396292364cac1

Download Submit
\Users\Admin\AppData\Local\Temp\nsy6C1E.tmp\System.dll

Filesize
10KB

MD5
4eff5fafd746f5decb93a44e3a3d570c

SHA1
a11aa7681b7e2df1c7f7492a127d332d1495ea8a

SHA256
cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

SHA512
cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

Download Submit
\Users\Admin\AppData\Local\Temp\nsy6C1E.tmp\System.dll

Filesize
10KB

MD5
4eff5fafd746f5decb93a44e3a3d570c

SHA1
a11aa7681b7e2df1c7f7492a127d332d1495ea8a

SHA256
cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

SHA512
cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

Download Submit
\Windows\UoDo\sun.dll

Filesize
160KB

MD5
3604cd3a88c803844700cb3353f947eb

SHA1
520ba9cd8cd0f2015bad6cbdd8274f8a0e23c62e

SHA256
c96714fd67c0ea654ab3d80e2012f1119b7c1e5883b070f0577b910c7ff8fb4f

SHA512
d0cde7095ccee853a21c07de5b2acf13c2b1b3a22eb313d065e6f9dfdb79bde99fe603699a5fb2e0b995805326995bcd2981ef4dd9cc630357416bdcb1a3ef39

Download Submit
\Windows\UoDo\sun.dll

Filesize
160KB

MD5
3604cd3a88c803844700cb3353f947eb

SHA1
520ba9cd8cd0f2015bad6cbdd8274f8a0e23c62e

SHA256
c96714fd67c0ea654ab3d80e2012f1119b7c1e5883b070f0577b910c7ff8fb4f

SHA512
d0cde7095ccee853a21c07de5b2acf13c2b1b3a22eb313d065e6f9dfdb79bde99fe603699a5fb2e0b995805326995bcd2981ef4dd9cc630357416bdcb1a3ef39

Download Submit
memory/952-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/952-58-0x00000000008A0000-0x00000000008CA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing