89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663

General

Target

89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe
Size

279KB
MD5

8ad081f2fb575b0cec80b17dc6a52b3e
SHA1

40fc0872f9e95175e95ec9a8fbc2281fcc9533b4
SHA256

89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663
SHA512

121f5a1fcfc8368b850d7ca3c2ee9a3621193448e6c9329f06a30942ec95e56154392182558d633a9c866650ede02c89800b4bb40d6e0a435191cff90d4fa024
SSDEEP

6144:HfMH+yONBB6VD9WMkZPQpK2Vxls0U3C4lEMjXFjaBJyepCIyscYcOWvDSloXTu:Hf19+WMkNoVxHU3zqMzFSyepXpFWv2Si

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1980	Regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C68B0149-C717-4041-BF00-C21569B97019}	Regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pwmknoxjlhrgv.dll	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe
File created	C:\Windows\SysWOW64\windownewsups.ini	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pwmknoxjlhrgv.IEExtend	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\ProgID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32\ = "C:\\Windows\\SysWow64\\pwmknoxjlhrgv.dll"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pwmknoxjlhrgv.IEExtend\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pwmknoxjlhrgv.IEExtend\Clsid	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pwmknoxjlhrgv.IEExtend\Clsid\ = "{C68B0149-C717-4041-BF00-C21569B97019}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\ProgID\ = "pwmknoxjlhrgv.IEExtend"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}	Regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1980	1676	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe	28
PID 1676 wrote to memory of 1980	1676	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe	28
PID 1676 wrote to memory of 1980	1676	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe	28
PID 1676 wrote to memory of 1980	1676	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe	28
PID 1676 wrote to memory of 1980	1676	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe	28
PID 1676 wrote to memory of 1980	1676	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe	28
PID 1676 wrote to memory of 1980	1676	89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe	28

C:\Users\Admin\AppData\Local\Temp\89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe
"C:\Users\Admin\AppData\Local\Temp\89a94381eebfdc9930a6399c35db9b2b8310f134bc21497e5e480c4da7dba663.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s C:\Windows\system32\pwmknoxjlhrgv.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\pwmknoxjlhrgv.dll

Filesize
223KB

MD5
b11a7476b7aeca348fe33d6242b465da

SHA1
e7e72254097a2a9b08fa7d64789ca665bdfa3a96

SHA256
9ff6d68518c09f6d454370c50fa4e97143c9824fa370790d3de933429c45c4dc

SHA512
32af36f020107b66c05eecd4a203e438183a0eae0772fdbd181adfaa3ef00744d180f6768da2eabc2749fbecc8b84a38de078fd407a7873ca9345fb9ccb10008

Download Submit
\Windows\SysWOW64\pwmknoxjlhrgv.dll

Filesize
223KB

MD5
b11a7476b7aeca348fe33d6242b465da

SHA1
e7e72254097a2a9b08fa7d64789ca665bdfa3a96

SHA256
9ff6d68518c09f6d454370c50fa4e97143c9824fa370790d3de933429c45c4dc

SHA512
32af36f020107b66c05eecd4a203e438183a0eae0772fdbd181adfaa3ef00744d180f6768da2eabc2749fbecc8b84a38de078fd407a7873ca9345fb9ccb10008

Download Submit
memory/1676-54-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1676-59-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1980-56-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing