ed7dc6ad15102dc742658be78b7076f5f8d0b27c64c9c6c80eda8d79dc14c2f9 | Triage

Sharing

General

Target

ed7dc6ad15102dc742658be78b7076f5f8d0b27c64c9c6c80eda8d79dc14c2f9
Size

329KB
Sample

221107-llvwxaaae2
MD5

0922b6822bf9de45f4ba68a936557c30
SHA1

a9aba947f9bd21d6e0aa861643e974ab7e54162a
SHA256

ed7dc6ad15102dc742658be78b7076f5f8d0b27c64c9c6c80eda8d79dc14c2f9
SHA512

74bef007a2b7927002f866c942838e23ed65286063b14d2786d90aa21ef3564ee7ac0ebe132e339ad102545e5820395792cd0713d575ff70448a334c61868431
SSDEEP

6144:uqpxvlACym6wGGWFGDwZyoJ3fzBeM6SpktqHQI6mVk8cL3/CzYjsHh:uqjvlA06wLBHAf9eMvHwmVkhL36zYwHh

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Targets

- Target
  
  ed7dc6ad15102dc742658be78b7076f5f8d0b27c64c9c6c80eda8d79dc14c2f9
- Size
  
  329KB
- MD5
  
  0922b6822bf9de45f4ba68a936557c30
- SHA1
  
  a9aba947f9bd21d6e0aa861643e974ab7e54162a
- SHA256
  
  ed7dc6ad15102dc742658be78b7076f5f8d0b27c64c9c6c80eda8d79dc14c2f9
- SHA512
  
  74bef007a2b7927002f866c942838e23ed65286063b14d2786d90aa21ef3564ee7ac0ebe132e339ad102545e5820395792cd0713d575ff70448a334c61868431
- SSDEEP
  
  6144:uqpxvlACym6wGGWFGDwZyoJ3fzBeM6SpktqHQI6mVk8cL3/CzYjsHh:uqjvlA06wLBHAf9eMvHwmVkhL36zYwHh
Score

8^/10

adware discovery exploit persistence stealer
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  persistence
- Deletes itself
- Modifies file permissions
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryexploitpersistencestealer

behavioral2

adwarediscoveryexploitpersistencestealer