ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7

General

Target

ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Size

20KB
MD5

8560a8a5b4b8a720badefcecf4c2d719
SHA1

a252844a11605fd629f0b86573d4eb9917f3e95b
SHA256

ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7
SHA512

7dd8eb82e8f09ad127559563699f6248f67197e1f66ff1b53c5ef589335556047314ce7741839cdab574356d2fe285aa43342444207c96876e70c4bd3947ad29
SSDEEP

384:tnWCLdfkSFunjQudSkLgAL1ozYFOeLH2G:tWgJFuncudBMAL1ouOeH2G

Score

9^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00140000000054ab-57.dat	acprotect
behavioral1/files/0x00140000000054ab-58.dat	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-57.dat	upx
behavioral1/files/0x00140000000054ab-58.dat	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe

Deletes itself 1 IoCs

pid	Process
1924	explorer.exe

Loads dropped DLL 1 IoCs

pid	Process
1684	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4966E46-4B75-44C3-B3EB-0E0810927011}	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mstu.dll	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1020 set thread context of 1924	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	28

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Vd	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ID = 00000000	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LExpire = 0000000000000000	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\SExpire = 0000000000000000	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Vd\ = 466e96f4754bc344b3eb0e0810927011	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Init = 189b465da69cd92fb199cf150abaf7314eeed12ca3dc122665f42741123dec3e3df2bbe3	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Expire = 0000000000000000	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Version = 00000000	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Vd	regsvr32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4966E46-4B75-44C3-B3EB-0E0810927011}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4966E46-4B75-44C3-B3EB-0E0810927011}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4966E46-4B75-44C3-B3EB-0E0810927011}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4966E46-4B75-44C3-B3EB-0E0810927011}\InprocServer32\ = "C:\\Windows\\SysWow64\\mstu.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4966E46-4B75-44C3-B3EB-0E0810927011}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1684	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	27
PID 1020 wrote to memory of 1684	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	27
PID 1020 wrote to memory of 1684	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	27
PID 1020 wrote to memory of 1684	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	27
PID 1020 wrote to memory of 1684	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	27
PID 1020 wrote to memory of 1684	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	27
PID 1020 wrote to memory of 1684	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	27
PID 1020 wrote to memory of 1924	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	28
PID 1020 wrote to memory of 1924	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	28
PID 1020 wrote to memory of 1924	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	28
PID 1020 wrote to memory of 1924	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	28
PID 1020 wrote to memory of 1924	1020	ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe	28

C:\Users\Admin\AppData\Local\Temp\ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe
"C:\Users\Admin\AppData\Local\Temp\ace77775f97ad3861e7c9798238eec3fa886ea2d1a935480bdbe68eb650390a7.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies Control Panel
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\Windows\system32\mstu.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1684
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mstu.dll

Filesize
11KB

MD5
6c41347d34f49fe4eb76e7d78c0663f9

SHA1
034d7243596728a39053dbc29fbfad1c2ffe5ab6

SHA256
77f54f0dd6f77a6dd5bb23aa774a286c36a98125891a505e26685f3a876c67d1

SHA512
efc5f938dd92e3767f6e1d8dd78efbb49ea9573a15cce70974f146f444da42a84725ead58c1bbdb7ad2e9eba38c3adb09f261dc2649e0a6855f4706d7e2cb3f0

Download Submit
\Windows\SysWOW64\mstu.dll

Filesize
11KB

MD5
6c41347d34f49fe4eb76e7d78c0663f9

SHA1
034d7243596728a39053dbc29fbfad1c2ffe5ab6

SHA256
77f54f0dd6f77a6dd5bb23aa774a286c36a98125891a505e26685f3a876c67d1

SHA512
efc5f938dd92e3767f6e1d8dd78efbb49ea9573a15cce70974f146f444da42a84725ead58c1bbdb7ad2e9eba38c3adb09f261dc2649e0a6855f4706d7e2cb3f0

Download Submit
memory/1020-54-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1684-55-0x0000000000000000-mapping.dmp

Download
memory/1684-56-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1924-59-0x00000000004F0EFA-mapping.dmp

Download
memory/1924-61-0x00000000745D1000-0x00000000745D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads