Analysis

  • max time kernel
    27s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 17:11

General

  • Target

    5432f95a46c51a89550f1787f0e34e072ff79ae6743a5b65e9d97c6840890b55.exe

  • Size

    3.6MB

  • MD5

    ef69b9bc7277c17f77498c87f925b250

  • SHA1

    25c9b30f93f07546c780bc8b869becd59fb6c1f7

  • SHA256

    5432f95a46c51a89550f1787f0e34e072ff79ae6743a5b65e9d97c6840890b55

  • SHA512

    4d2fb93f854bc84c9540c3bf80761b608a2dbd5b829665d98d8016332a143fd8645e06586b059c7282e96f890ac43cc93c7e11e48f5fdc80806e9b71037deef1

  • SSDEEP

    98304:9ud29of5RqtmqfriR42N/29nzNsccMpY:Ax6TzNjNpY

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5432f95a46c51a89550f1787f0e34e072ff79ae6743a5b65e9d97c6840890b55.exe
    "C:\Users\Admin\AppData\Local\Temp\5432f95a46c51a89550f1787f0e34e072ff79ae6743a5b65e9d97c6840890b55.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1108
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\GoSaveu\nbA6grcyh555aE.x64.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files (x86)\GoSaveu\nbA6grcyh555aE.x64.dll"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:880

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSaveu\nbA6grcyh555aE.dat

    Filesize

    3KB

    MD5

    4f1ebc7b7c52e281065a733bc9328fc2

    SHA1

    39a0aaba2ee471f0437358a7d4ccb5b2fce177c0

    SHA256

    e28afa58ff637cb46d480e118944687e9bdf74c6957f1aeb7bbe859ae70b91c7

    SHA512

    7aa612ff37db885d02a8add391a0a82ef60b04874624810d6bfabb9da24d2bce354971818477df3e8aa4ce19affcfe6714eb7784ef4aff5a5c5d0ed922bb6c72

  • C:\Program Files (x86)\GoSaveu\nbA6grcyh555aE.tlb

    Filesize

    3KB

    MD5

    934268ece04f6de7c76bfed3478cf1d4

    SHA1

    a4e0ca22b9db6bfcf061d76e8101ef7559813954

    SHA256

    ab54518451a446e00679b2dbecd9285d8a96841ad27df558a2e0b6ce55252b8c

    SHA512

    043fa5fd301b7bbdb6f9ee7766c46dfe5da897b7f7dd164372326416fdb1b7cb3c3809f1293b987077ded2664daf123f9bb217cb12c7d9bf923b1df6a2afccea

  • C:\Program Files (x86)\GoSaveu\nbA6grcyh555aE.x64.dll

    Filesize

    700KB

    MD5

    5bdec27c100693ecb0b61cc2555e8505

    SHA1

    771242d417269c2f9150d649f06e6ec8e8bd8cb7

    SHA256

    ca873de4e82bcaefde87f524b1284723ee61e70767bcb9f45f78a2e52547b326

    SHA512

    1b4067351a9912bdd4ad0285470396273563336bad6029c2d05e48fb1fd9971c69115cca1ec46dc7ce37274c7c48a2364498cb180563f7871cd838aebbd8c6b4

  • \Program Files (x86)\GoSaveu\nbA6grcyh555aE.dll

    Filesize

    617KB

    MD5

    5b02fe261c5832aba1e2b35228934c17

    SHA1

    b30aef32bfc7fb93add291dd7699d209fc3a60c1

    SHA256

    af2632d8ad1a0b0e706f260de79b687cf94855d911bf5fc9d4b7007e256e7a6c

    SHA512

    936b81acb1219be1c18b958f4fc3bd7c5c1ab617fa20e76db165f6ffdb2f674c602c18522980527d84cad7a93dcc79cb222e5e4a8b301298ec141a8b6eb26e72

  • \Program Files (x86)\GoSaveu\nbA6grcyh555aE.x64.dll

    Filesize

    700KB

    MD5

    5bdec27c100693ecb0b61cc2555e8505

    SHA1

    771242d417269c2f9150d649f06e6ec8e8bd8cb7

    SHA256

    ca873de4e82bcaefde87f524b1284723ee61e70767bcb9f45f78a2e52547b326

    SHA512

    1b4067351a9912bdd4ad0285470396273563336bad6029c2d05e48fb1fd9971c69115cca1ec46dc7ce37274c7c48a2364498cb180563f7871cd838aebbd8c6b4

  • \Program Files (x86)\GoSaveu\nbA6grcyh555aE.x64.dll

    Filesize

    700KB

    MD5

    5bdec27c100693ecb0b61cc2555e8505

    SHA1

    771242d417269c2f9150d649f06e6ec8e8bd8cb7

    SHA256

    ca873de4e82bcaefde87f524b1284723ee61e70767bcb9f45f78a2e52547b326

    SHA512

    1b4067351a9912bdd4ad0285470396273563336bad6029c2d05e48fb1fd9971c69115cca1ec46dc7ce37274c7c48a2364498cb180563f7871cd838aebbd8c6b4

  • memory/880-65-0x0000000000000000-mapping.dmp

  • memory/880-66-0x000007FEFC091000-0x000007FEFC093000-memory.dmp

    Filesize

    8KB

  • memory/1028-61-0x0000000000000000-mapping.dmp

  • memory/1108-54-0x0000000076691000-0x0000000076693000-memory.dmp

    Filesize

    8KB

  • memory/1108-55-0x0000000002870000-0x0000000002912000-memory.dmp

    Filesize

    648KB