Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 15:27

General

  • Target

    bf45a498cd8cb6afaa53f0b014dca7f564447a0293812d6146721e188076099a.exe

  • Size

    125KB

  • MD5

    8f15008642ae1765c2d053c497b39e1b

  • SHA1

    07ed572ecaed2e01db46b5674cdf5501dd1a3bdc

  • SHA256

    bf45a498cd8cb6afaa53f0b014dca7f564447a0293812d6146721e188076099a

  • SHA512

    28c29e7800f0fb07781233a9aa4fa2e881f450e0a08653c7251ec712567a5958c5dc354f93fb98d29cf5cc8c502847fbc1e7d8fbe0b626f01f61d2555f4b6476

  • SSDEEP

    3072:EmeDmBqskJ7uGpAkEKpo8FJlLs9sYlFWb43:E8yflpb7g5FWU3

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf45a498cd8cb6afaa53f0b014dca7f564447a0293812d6146721e188076099a.exe
    "C:\Users\Admin\AppData\Local\Temp\bf45a498cd8cb6afaa53f0b014dca7f564447a0293812d6146721e188076099a.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\PushWare\cpush.dll"
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:3732

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\PushWare\cpush.dll

    Filesize

    200KB

    MD5

    35d22ce8a0c24e279698782463e77adc

    SHA1

    f3bde32b64dd10424ac7b287df3b2d15c9aa7211

    SHA256

    f8de3ba4c997f96d30d0de2bdd4d9feb226c8820495fc2b8540f99aca81e5736

    SHA512

    45eedaec79de5e12160a4f74a93dc573dcd27de4352de13e35bdd42f5d33d0ae151b19e08483f0900a1955e64cc2bdef42727b728de1e55116d81a8d945a00e9

  • C:\Program Files (x86)\Common Files\PushWare\cpush.dll

    Filesize

    200KB

    MD5

    35d22ce8a0c24e279698782463e77adc

    SHA1

    f3bde32b64dd10424ac7b287df3b2d15c9aa7211

    SHA256

    f8de3ba4c997f96d30d0de2bdd4d9feb226c8820495fc2b8540f99aca81e5736

    SHA512

    45eedaec79de5e12160a4f74a93dc573dcd27de4352de13e35bdd42f5d33d0ae151b19e08483f0900a1955e64cc2bdef42727b728de1e55116d81a8d945a00e9

  • memory/3732-132-0x0000000000000000-mapping.dmp