ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398

Analysis

max time kernel
143s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
Size

746KB
MD5

4e6154324e68d1bfc386907b9c522d03
SHA1

590bfaf67662a5aede2f56d8bd85a5b52a4b2766
SHA256

ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398
SHA512

abc34604e04ddf826dd590ed98ea083bff3db39cbdb89c2a933884217d301af6b4579e5f9d417c70132977d7a42db5deb2c8dec57549b0c75b150c6ad0ed5ef9
SSDEEP

12288:REiQd8h2mGiP6so1kAbXz3AW9i+yYqcqJqqtBRGhbkCooPr1YhUAtw:Ruq8uCso1keXzQUqcqrtehkCo/htw

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe = "11000"	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\WebBrowser_embedded.exe = "11000"	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
2408	ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe

C:\Users\Admin\AppData\Local\Temp\ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe
"C:\Users\Admin\AppData\Local\Temp\ace89c38bbd48ea3dba8ab017cdd66423d88b86e4c3f03f7f727a29a8b90a398.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg181E.tmp\FDMClient.dll

Filesize
222KB

MD5
b8d9503e3c0ac31fae05382a2cc6197b

SHA1
f6085be74247af30c2aa79a63e8bd1f9667951df

SHA256
e57ec829e42342a1a0826c45a52e76b5cf038d3074f88b64b41dd75a367979c0

SHA512
8b926afbd47b42541e51e3eed65eaa7dffab3295d0ee1350174b187995e0d232e2c5b76e426407577c590d6a2418ef12e37bddc15438c1eeaed1e134feda8f6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg181E.tmp\System.dll

Filesize
17KB

MD5
62008374a494afeea2ee2ae9eee4c8c0

SHA1
94808fcf0748c437f4d7ffa4d540e054cb014fab

SHA256
9c4affddfa97b268b07c00ac28a2fe617dda806bf55088ccf348da149ee76c1a

SHA512
f584ed647b69ff8ff80450be8f0b267ebb3c97826dbf01d078165ea94b43afd1f00fc58b91d9e8f4d78465d70312c1b1a6ac66583ebdc009b0ce471a6cf149a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg181E.tmp\webapphost.dll

Filesize
1.4MB

MD5
502644b41549622acc7c5116620a22e6

SHA1
a7ce72ea70457478f244a3b9e04c5c61e72d6bee

SHA256
4653dcd1cd888e0ee00f9f5312523354384f7aa2b3cdd1fd4ebb7a1300faaf51

SHA512
cb236405d280e67262202d0f18acb5eee93ad5f0dbcb7207a267f6f8d8efd7042bb73b0f2ce8385c8f066976cc604830184ab645f09f9b930e31ad95c0e977f0

Download Submit