cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517

General

Target

cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
Size

50KB
MD5

1a239770f419f3401508073fd348c1bc
SHA1

a8ecbe72bb45c3f4613a8c9da28cf78b549d2d67
SHA256

cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517
SHA512

9b18f9217d12670f90145a234639817a31492e3533ae07d4e55fd64e6f816039152a6517a585eb603563951b609045405e8d1d7b2a38842890185899598da466
SSDEEP

768:WFjG7I34bFD+kI5XyX6O/iuf2ooSFPP1l6SPQAA9kILXAiQDZ3A:WFjG7I3kxXh/iuf2gJ1sSPQAA9A3A

Score

10^/10

adware persistence stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe"	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe

Loads dropped DLL 1 IoCs

pid	Process
4976	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\J:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\K:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\L:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\Q:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\W:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\Y:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\G:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\S:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\T:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\U:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\F:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\M:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\O:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\V:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\Z:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\I:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\N:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\P:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\R:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\X:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened (read-only)	\??\E:	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wmdrtc32.dl_	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File created	C:\Windows\SysWOW64\wmdrtc32.dll	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4976	cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe

C:\Users\Admin\AppData\Local\Temp\cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe
"C:\Users\Admin\AppData\Local\Temp\cb5d26a3a8b898a40f201825aa18cea7df7449aed863b83148ad71cd6d61b517.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wmdrtc32.dll

Filesize
40KB

MD5
03ebc053c8eec6b4f4afbbb5dc64b169

SHA1
9ed172dbce1a6a1dd20e08a9720afba210eee79c

SHA256
ad25714f5c7eb2e27742b5e0886e865fc8884e8b65cb863d2aeba0c6dbff2d02

SHA512
40eab99574ea6614341b869239b014a74cdc24da0c4be69681eaab18de72bbef14ad4cf36215e39eff4978b8ed074762ce25bb85a042219ac5db5cb46390e9ff

Download Submit
memory/4976-133-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4976-134-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/4976-135-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads