191720a048e0633840dcdcc464229f2e0a869186da6e16e486f700c51f0b07f2 | Triage

Submit
Reports

Overview

overview

8

Static

static

191720a048...f2.exe

windows7-x64

8

191720a048...f2.exe

windows10-2004-x64

8

Sharing

General

Target

191720a048e0633840dcdcc464229f2e0a869186da6e16e486f700c51f0b07f2
Size

4.3MB
Sample

221125-e23s5aef6z
MD5

2cc584f073ca5b499e25f2cd49547096
SHA1

4579594c1569f371a1cd14b37cc29e92b397d63f
SHA256

191720a048e0633840dcdcc464229f2e0a869186da6e16e486f700c51f0b07f2
SHA512

e94ce2ce2b038a6e06a2575dc92b031bdbf66f6d541397e6c000d87fe8419ada39d22328e41dd8d2b44c9a281e4c27fb9332fdeb12bc32c7e5ad8f6f69ef46ab
SSDEEP

49152:fhOqIruzyb7SO6rmxup4ZdGKvghxfki1iPXGIjQbZ8hpTQdu/:nuuzAT6/KcEP2iQbZspsdu

Score

8^/10

adware discovery persistence stealer

Static task

static1

Behavioral task

behavioral1

Sample

191720a048e0633840dcdcc464229f2e0a869186da6e16e486f700c51f0b07f2.exe

Resource

win7-20220812-en

adware discovery persistence stealer

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

191720a048e0633840dcdcc464229f2e0a869186da6e16e486f700c51f0b07f2.exe

Resource

win10v2004-20221111-en

adware discovery persistence stealer

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  191720a048e0633840dcdcc464229f2e0a869186da6e16e486f700c51f0b07f2
- Size
  
  4.3MB
- MD5
  
  2cc584f073ca5b499e25f2cd49547096
- SHA1
  
  4579594c1569f371a1cd14b37cc29e92b397d63f
- SHA256
  
  191720a048e0633840dcdcc464229f2e0a869186da6e16e486f700c51f0b07f2
- SHA512
  
  e94ce2ce2b038a6e06a2575dc92b031bdbf66f6d541397e6c000d87fe8419ada39d22328e41dd8d2b44c9a281e4c27fb9332fdeb12bc32c7e5ad8f6f69ef46ab
- SSDEEP
  
  49152:fhOqIruzyb7SO6rmxup4ZdGKvghxfki1iPXGIjQbZ8hpTQdu/:nuuzAT6/KcEP2iQbZspsdu
Score

8^/10

adware discovery persistence stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencestealer

behavioral2

adwarediscoverypersistencestealer

© 2018-2024

Terms | Privacy