7f7d72116f508eb997daa4941b0d28f596b56c8ccf49257065e5e87aa7599b99 | Triage

Sharing

General

Target

7f7d72116f508eb997daa4941b0d28f596b56c8ccf49257065e5e87aa7599b99
Size

4.2MB
Sample

221124-26blrseg75
MD5

c22c1bd9df8f79d85cf4502a2f8d186a
SHA1

0577a3870ac7c3f5dd72bcfe853a42e4ceb0263a
SHA256

7f7d72116f508eb997daa4941b0d28f596b56c8ccf49257065e5e87aa7599b99
SHA512

bd1aa7bcd0f94095e23eef075fca70d9ca97d0b3328b93f64efa04ef6518b9c8c2360fdc1b2e11d58eeea0639ebe6a4d54dc74a16acbebeb83c61b13775266c7
SSDEEP

49152:s+HmRHHuFHnWnjMZVA0wyOOnfwZU5BcumhlKbUT9FiISyaqwlQmEbp7YuwLkV:smm0FW0pOnlKb6FaqmDElZwg

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  7f7d72116f508eb997daa4941b0d28f596b56c8ccf49257065e5e87aa7599b99
- Size
  
  4.2MB
- MD5
  
  c22c1bd9df8f79d85cf4502a2f8d186a
- SHA1
  
  0577a3870ac7c3f5dd72bcfe853a42e4ceb0263a
- SHA256
  
  7f7d72116f508eb997daa4941b0d28f596b56c8ccf49257065e5e87aa7599b99
- SHA512
  
  bd1aa7bcd0f94095e23eef075fca70d9ca97d0b3328b93f64efa04ef6518b9c8c2360fdc1b2e11d58eeea0639ebe6a4d54dc74a16acbebeb83c61b13775266c7
- SSDEEP
  
  49152:s+HmRHHuFHnWnjMZVA0wyOOnfwZU5BcumhlKbUT9FiISyaqwlQmEbp7YuwLkV:smm0FW0pOnlKb6FaqmDElZwg
Score

8^/10

adware discovery persistence spyware stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer