c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814

Analysis

max time kernel
143s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe
Size

1.9MB
MD5

90d63f01ac77504bb55cbfd72e8ba186
SHA1

f70b569e9c29684b36e4241f36b463f9d6aa03a2
SHA256

c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814
SHA512

5b855c8ab7438b703cb21146318ef6f0fbe0b408d74eff287e003a90c072e924cc1af2ca7cc9623fbc38df72db4ab8c84aa8cd6094845d4fdb30c8cec3a47b54
SSDEEP

49152:GwHv9lt/SgRIpVQIIFJxGfVSDiQAU4KzPZTm19Gkt/:GwVlxSgRUKhGfApAUPz1mzGkt/

Score

8^/10

adware aspackv2 discovery persistence stealer

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00070000000132fc-60.dat	aspack_v212_v242
behavioral1/files/0x00070000000132fc-62.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
1284	searchgoosginst.exe
1812	serkle.exe

Loads dropped DLL 3 IoCs

pid	Process
1768	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe
1284	searchgoosginst.exe
1284	searchgoosginst.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	searchgoosginst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\searchgoosg = "C:\\Program Files (x86)\\searchgoosg\\serkle.exe"	searchgoosginst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F85CACCB-E910-43D2-8C18-75EA1295196F}	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F85CACCB-E910-43D2-8C18-75EA1295196F}\	searchgoosginst.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\searchgoosginst.exe	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe
File opened for modification	C:\Windows\SysWOW64\VB6KO.DLL	searchgoosginst.exe
File opened for modification	C:\Windows\SysWOW64\MSINET.OCX	searchgoosginst.exe
File opened for modification	C:\Windows\SysWOW64\INETKO.DLL	searchgoosginst.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\searchgoosg\searchgoosg.dll	searchgoosginst.exe
File opened for modification	C:\Program Files (x86)\searchgoosg\searchgoosgdl.exe	searchgoosginst.exe
File opened for modification	C:\Program Files (x86)\searchgoosg\serkle.exe	searchgoosginst.exe
File opened for modification	C:\Program Files (x86)\searchgoosg\Uninstall.exe	searchgoosginst.exe
File created	C:\Program Files (x86)\searchgoosg\Uninstall.ini	searchgoosginst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\Implemented Categories	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0\HELPDIR\ = "C:\\Program Files (x86)\\searchgoosg"	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ = "_searchgoosg"	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ProxyStubClsid32	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\InprocServer32	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\VERSION\ = "3.0"	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\searchgoosgpg.searchgoosg\ = "searchgoosgpg.searchgoosg"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\TypeLib\ = "{764B25C4-3744-4625-B33A-E471E2374151}"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\searchgoosgpg.searchgoosg\Clsid	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\searchgoosgpg.searchgoosg\Clsid\ = "{F85CACCB-E910-43D2-8C18-75EA1295196F}"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\TypeLib	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\ProgID	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\ProgID\ = "searchgoosgpg.searchgoosg"	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ = "searchgoosg"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\TypeLib\Version = "3.0"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\searchgoosgpg.searchgoosg	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0\FLAGS	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0\FLAGS\ = "0"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ProxyStubClsid32	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\TypeLib\Version = "3.0"	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\InprocServer32\ = "C:\\Program Files (x86)\\searchgoosg\\searchgoosg.dll"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\TypeLib	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\TypeLib\ = "{764B25C4-3744-4625-B33A-E471E2374151}"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0\0	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0\0\win32	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0\0\win32\ = "C:\\Program Files (x86)\\searchgoosg\\searchgoosg.dll"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0\HELPDIR	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ = "_searchgoosg"	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\InprocServer32\ThreadingModel = "Apartment"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{764B25C4-3744-4625-B33A-E471E2374151}\3.0\ = "searchgoosgpg"	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\TypeLib\ = "{764B25C4-3744-4625-B33A-E471E2374151}"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\VERSION	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\ProxyStubClsid	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66A85F2F-A5D3-442A-85E4-3B901CF2B4C6}\TypeLib	searchgoosginst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\ = "searchgoosgpg.searchgoosg"	searchgoosginst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F85CACCB-E910-43D2-8C18-75EA1295196F}\Programmable	searchgoosginst.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1812	serkle.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1284	1768	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe	27
PID 1768 wrote to memory of 1284	1768	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe	27
PID 1768 wrote to memory of 1284	1768	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe	27
PID 1768 wrote to memory of 1284	1768	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe	27
PID 1768 wrote to memory of 1284	1768	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe	27
PID 1768 wrote to memory of 1284	1768	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe	27
PID 1768 wrote to memory of 1284	1768	c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe	27
PID 1284 wrote to memory of 1812	1284	searchgoosginst.exe	28
PID 1284 wrote to memory of 1812	1284	searchgoosginst.exe	28
PID 1284 wrote to memory of 1812	1284	searchgoosginst.exe	28
PID 1284 wrote to memory of 1812	1284	searchgoosginst.exe	28

C:\Users\Admin\AppData\Local\Temp\c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe
"C:\Users\Admin\AppData\Local\Temp\c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\searchgoosginst.exe
  C:\Windows\system32\searchgoosginst.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Program Files (x86)\searchgoosg\serkle.exe
    "C:\Program Files (x86)\searchgoosg\serkle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\searchgoosg\serkle.exe

Filesize
1.2MB

MD5
c0d559d1d7b5607179f142b53bb11c79

SHA1
5f059c4fbbe790f1e54c4ac53353b07e41854c59

SHA256
b8d8d0f5752d070607d695a1196f0e38e7991f34c83cdb6858b9c4f075a06184

SHA512
a85989ad9560166ff1ffbd73bc3b0515c93ead1350c588c72739d06642ea79b3677cf06b1e2f6f545657c4d7a4fa4d47a988dfd3980611a7b853f4c44c478f67

Download Submit
C:\Windows\SysWOW64\searchgoosginst.exe

Filesize
1.8MB

MD5
6fb4ee2d4197eb0a9d36108569a01219

SHA1
74f516d60430f187dbadc77327ac5f3a34423f01

SHA256
f5f48954e71b613b69eabf2cba550c7ada448fbb49d353d00f25e000559d7253

SHA512
f580c9d9e8c57b92dec34bc43c6c9002d5dd1c504797b4bbbf00467c3e4af07053c1a0e5f5918ad02495b4e6e1f16b3e8b9c4fc05b3bf1caa5481f9ec3b26407

Download Submit
C:\Windows\SysWOW64\searchgoosginst.exe

Filesize
1.8MB

MD5
6fb4ee2d4197eb0a9d36108569a01219

SHA1
74f516d60430f187dbadc77327ac5f3a34423f01

SHA256
f5f48954e71b613b69eabf2cba550c7ada448fbb49d353d00f25e000559d7253

SHA512
f580c9d9e8c57b92dec34bc43c6c9002d5dd1c504797b4bbbf00467c3e4af07053c1a0e5f5918ad02495b4e6e1f16b3e8b9c4fc05b3bf1caa5481f9ec3b26407

Download Submit
\Program Files (x86)\searchgoosg\searchgoosg.dll

Filesize
123KB

MD5
e8b4bf324251922a7fb629a140b214b2

SHA1
419a66e8841d4fc1bd15b0a95c9afb778e54566b

SHA256
ad6bca5dd0092942fc7bf6020a40fe5e68f826ea9599d21225b1159532ca7114

SHA512
3604352022fad3fe92975205221a91a85be1a8184fb244f57ecb52a1b5611fb353e156522411d812f500058d57793903b81e22cc8bd504ffd9646ebaff46f79d

Download Submit
\Program Files (x86)\searchgoosg\serkle.exe

Filesize
1.2MB

MD5
c0d559d1d7b5607179f142b53bb11c79

SHA1
5f059c4fbbe790f1e54c4ac53353b07e41854c59

SHA256
b8d8d0f5752d070607d695a1196f0e38e7991f34c83cdb6858b9c4f075a06184

SHA512
a85989ad9560166ff1ffbd73bc3b0515c93ead1350c588c72739d06642ea79b3677cf06b1e2f6f545657c4d7a4fa4d47a988dfd3980611a7b853f4c44c478f67

Download Submit
\Windows\SysWOW64\searchgoosginst.exe

Filesize
1.8MB

MD5
6fb4ee2d4197eb0a9d36108569a01219

SHA1
74f516d60430f187dbadc77327ac5f3a34423f01

SHA256
f5f48954e71b613b69eabf2cba550c7ada448fbb49d353d00f25e000559d7253

SHA512
f580c9d9e8c57b92dec34bc43c6c9002d5dd1c504797b4bbbf00467c3e4af07053c1a0e5f5918ad02495b4e6e1f16b3e8b9c4fc05b3bf1caa5481f9ec3b26407

Download Submit
memory/1284-57-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1284-55-0x0000000000000000-mapping.dmp

Download
memory/1812-61-0x0000000000000000-mapping.dmp

Download
memory/1812-64-0x0000000000400000-0x00000000007F1000-memory.dmp

Filesize
3.9MB

Download
memory/1812-65-0x0000000000400000-0x00000000007F1000-memory.dmp

Filesize
3.9MB

Download
memory/1812-67-0x0000000000400000-0x00000000007F1000-memory.dmp

Filesize
3.9MB

Download
memory/1812-66-0x0000000000400000-0x00000000007F1000-memory.dmp

Filesize
3.9MB

Download
memory/1812-68-0x0000000000400000-0x00000000007F1000-memory.dmp

Filesize
3.9MB

Download
memory/1812-69-0x0000000000400000-0x00000000007F1000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads