96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854

General

Target

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
Size

689KB
MD5

7dc5aa5df69332dd9156dc3c1c952bf0
SHA1

4e633c5e717e614f3239bc93baa29b94f3ebc157
SHA256

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854
SHA512

6559eac2b653db3ea04340da0ff53b8a2b992a41146890aff9fc82caa6c7221e7394e8f21d7d493d8253058c05472e1bac41b49a02a16c37ed4a3236f297ea2b
SSDEEP

12288:JV4iR/0S3d830DBXG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDmjeKuVOvjr+N8/:JVP0Edc01XG4G37tUnvone83Z76bMHx8

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

Loads dropped DLL 5 IoCs

Processes:

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid	process
4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
860	regsvr32.exe
4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
912	regsvr32.exe
4376	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "TrustMediaViewerV1alpha4048"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "TrustMediaViewerV1alpha4048"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\NoExplorer = "1"	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Windows\System32\GroupPolicy	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

Drops file in Program Files directory 23 IoCs

Processes:

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\Thumbs.db	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\Thumbs.db	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\install.rdf	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\overlay.xul	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome.manifest	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\ffTrustMediaViewerV1alpha4048ffaction.js	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ch\TrustMediaViewerV1alpha4048.crx	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\ffTrustMediaViewerV1alpha4048.js	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\ffTrustMediaViewerV1alpha4048ffaction.js	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\overlay.xul	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\default	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\default\TrustMediaViewerV1alpha4048_32.png	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048.dll	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ch\TrustMediaViewerV1alpha4048.crx	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\ffTrustMediaViewerV1alpha4048.js	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\default\TrustMediaViewerV1alpha4048_32.png	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\uninstall.exe	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome.manifest	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\install.rdf	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Approved Extensions	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25} = 51667a6c4c1d3b1b280b1701e65c9a088bb9532b58dfc938	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

Modifies registry class 56 IoCs

Processes:

regsvr32.exe96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "TrustMediaViewerV1alpha4048"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib\ = "{5D12E980-F317-46CA-AE7A-2787FF638E72}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ = "ITrustMediaViewerV1alpha4048BHO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ = "ITrustMediaViewerV1alpha4048BHO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "TrustMediaViewerV1alpha4048"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0\win32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\ = "TrustMediaViewerV1alpha4048Lib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "Trust Media Viewer"	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Version\ = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\TypeLib\ = "{5d12e980-f317-46ca-ae7a-2787ff638e72}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib\ = "{5D12E980-F317-46CA-AE7A-2787FF638E72}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0\win64\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Version\ = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\TypeLib\ = "{5d12e980-f317-46ca-ae7a-2787ff638e72}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Programmable	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

pid	process
4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exeregsvr32.exe

description	pid	process	target process
PID 4620 wrote to memory of 860	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	regsvr32.exe
PID 4620 wrote to memory of 860	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	regsvr32.exe
PID 4620 wrote to memory of 860	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	regsvr32.exe
PID 4620 wrote to memory of 912	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	regsvr32.exe
PID 4620 wrote to memory of 912	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	regsvr32.exe
PID 4620 wrote to memory of 912	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	regsvr32.exe
PID 912 wrote to memory of 4376	912	regsvr32.exe	regsvr32.exe
PID 912 wrote to memory of 4376	912	regsvr32.exe	regsvr32.exe
PID 4620 wrote to memory of 3432	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	gpupdate.exe
PID 4620 wrote to memory of 3432	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	gpupdate.exe
PID 4620 wrote to memory of 3432	4620	96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe	gpupdate.exe

C:\Users\Admin\AppData\Local\Temp\96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
"C:\Users\Admin\AppData\Local\Temp\96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048.dll" /s
2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:860

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4376

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\System32\gpupdate.exe" /force
2⤵
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048.dll
Filesize
85KB

MD5
49aefbb4572739267b87a071cae7cb1b

SHA1
0263e6694e7ffa06a0eae5231ced364cda15e0e5

SHA256
01d5bcc2e26d8cb361fff96daac6c6172ffece1a514b139a9543632c6d0a73a6

SHA512
e5f74ab78c716bc2033c65ef21fadf61d2418b4db5a1e722ffc93d66e4efe23bd81d99250219c7ef0a48904ec6da27b4db5254f4e6f10773a418d53776f298c9

Download Submit
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048.dll
Filesize
85KB

MD5
49aefbb4572739267b87a071cae7cb1b

SHA1
0263e6694e7ffa06a0eae5231ced364cda15e0e5

SHA256
01d5bcc2e26d8cb361fff96daac6c6172ffece1a514b139a9543632c6d0a73a6

SHA512
e5f74ab78c716bc2033c65ef21fadf61d2418b4db5a1e722ffc93d66e4efe23bd81d99250219c7ef0a48904ec6da27b4db5254f4e6f10773a418d53776f298c9

Download Submit
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll
Filesize
100KB

MD5
5504d963ba44e928b38c2349c787ff39

SHA1
0c29bb0b5d83bf9062c8a6454153aa1ac261cc0b

SHA256
2f36f3e23cf67e040368c2290a04d7417283f746570c4f08402d7bc7f25285be

SHA512
483561294221b7110535880e6a59fef84ae3df4cadfdabd09c0d3f1c8cc26bd779f7e560c84d6ac675ecf77f1d2e44dbb7c44ad0c23e0f574b394add20fcb46c

Download Submit
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll
Filesize
100KB

MD5
5504d963ba44e928b38c2349c787ff39

SHA1
0c29bb0b5d83bf9062c8a6454153aa1ac261cc0b

SHA256
2f36f3e23cf67e040368c2290a04d7417283f746570c4f08402d7bc7f25285be

SHA512
483561294221b7110535880e6a59fef84ae3df4cadfdabd09c0d3f1c8cc26bd779f7e560c84d6ac675ecf77f1d2e44dbb7c44ad0c23e0f574b394add20fcb46c

Download Submit
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll
Filesize
100KB

MD5
5504d963ba44e928b38c2349c787ff39

SHA1
0c29bb0b5d83bf9062c8a6454153aa1ac261cc0b

SHA256
2f36f3e23cf67e040368c2290a04d7417283f746570c4f08402d7bc7f25285be

SHA512
483561294221b7110535880e6a59fef84ae3df4cadfdabd09c0d3f1c8cc26bd779f7e560c84d6ac675ecf77f1d2e44dbb7c44ad0c23e0f574b394add20fcb46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9B7.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9B7.tmp\aminsis.dll
Filesize
567KB

MD5
f346047b13f37f79c462e59a6319faa1

SHA1
ce9e7cb9719000a69b463fe024c81229e322279f

SHA256
e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453

SHA512
429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167

Download Submit
memory/860-133-0x0000000000000000-mapping.dmp

Download
memory/912-137-0x0000000000000000-mapping.dmp

Download
memory/3432-142-0x0000000000000000-mapping.dmp

Download
memory/4376-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads