bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3

Analysis

max time kernel
322s
max time network
401s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Size

406KB
MD5

1efa62dd8aadaacc9d7677f7fc592570
SHA1

eaf4e26d38ddccaa377f8300b9357f4890d3908f
SHA256

bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3
SHA512

0fea95e33aa6a8e7c095803471540db12e8dba324c76087ce3878053602dcff0c7c19c3b292f21c2d659cde418beac9e85a5b650396f05e932ca8a8cf2d7efef
SSDEEP

12288:CgtqqpPi1mOgfo1t+JAr+yxKuZri8QOvOvhXL:CqqqpPiYo1EyHCGkXL

Score

7^/10

adware stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2068	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
2068	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
2068	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
2068	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D26848B4-CF41-45B2-A3FB-68E9735898BE}	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D26848B4-CF41-45B2-A3FB-68E9735898BE}\ = "LPVideoPlugin"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D26848B4-CF41-45B2-A3FB-68E9735898BE}\NoExplorer = "1"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\LPVideo.dll	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
File created	C:\Windows\SysWOW64\LPVideo.dll	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LPVideoPlugin\5378.exe	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.XMLDOMDocumentEventsSink.1\ = "XMLDOMDocumentEventsSink Class"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin.1\ = "LPVideoPlugin"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\LPVideo.dll"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D26848B4-CF41-45B2-A3FB-68E9735898BE}\Programmable	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D26848B4-CF41-45B2-A3FB-68E9735898BE}\TypeLib\ = "{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F3E3F953-DF8A-49D3-AC2B-59EE191F8998}\ = "LPVideo"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.XMLDOMDocumentEventsSink.1	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.XMLDOMDocumentEventsSink\CurVer	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}\AppID = "{F3E3F953-DF8A-49D3-AC2B-59EE191F8998}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin.1\CLSID\ = "{D26848B4-CF41-45B2-A3FB-68E9735898BE}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin\CLSID	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}\1.0\HELPDIR	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}\TypeLib\ = "{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}\ProxyStubClsid32	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}\TypeLib\Version = "1.0"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}\ProxyStubClsid32	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}\InprocServer32\ThreadingModel = "Apartment"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D26848B4-CF41-45B2-A3FB-68E9735898BE}\ = "LPVideoPlugin"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D26848B4-CF41-45B2-A3FB-68E9735898BE}\ProgID\ = "LPVideo.LPVideoPlugin.1"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}\TypeLib	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.XMLDOMDocumentEventsSink.1\CLSID	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\TypeLib\ = "{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\TypeLib	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LPVideo.DLL\AppID = "{F3E3F953-DF8A-49D3-AC2B-59EE191F8998}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}\ProgID\ = "LPVideo.XMLDOMDocumentEventsSink.1"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin\CurVer\ = "LPVideo.LPVideoPlugin.1"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D26848B4-CF41-45B2-A3FB-68E9735898BE}	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D26848B4-CF41-45B2-A3FB-68E9735898BE}\InprocServer32	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.XMLDOMDocumentEventsSink.1\CLSID\ = "{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.XMLDOMDocumentEventsSink\CurVer\ = "LPVideo.XMLDOMDocumentEventsSink.1"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}\1.0\0\win32	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}\1.0\0	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}\TypeLib\ = "{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}\InprocServer32\ = "C:\\Windows\\SysWow64\\LPVideo.dll"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin.1	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin\ = "LPVideoPlugin"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin\CurVer	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D26848B4-CF41-45B2-A3FB-68E9735898BE}\TypeLib	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}\1.0\FLAGS\ = "0"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\TypeLib	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}\ProgID	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}\TypeLib	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\TypeLib\ = "{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\TypeLib\Version = "1.0"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\ = "IXMLDOMDocumentEventsSink"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.XMLDOMDocumentEventsSink	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD952F46-F031-4FD4-99C4-9C5F53AB12CC}\TypeLib\ = "{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4D6A7B8-B281-4C55-96E8-0728B2EA7DEA}\1.0	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F072B84-04C5-421E-86AD-694204B3F1D9}\ = "ILPVideoPlugin"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\ = "IXMLDOMDocumentEventsSink"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4520CC1-5383-4150-AB2A-E8E79D424625}\ProxyStubClsid32	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F3E3F953-DF8A-49D3-AC2B-59EE191F8998}	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LPVideo.DLL	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LPVideo.LPVideoPlugin\CLSID\ = "{D26848B4-CF41-45B2-A3FB-68E9735898BE}"	bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe

C:\Users\Admin\AppData\Local\Temp\bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe
"C:\Users\Admin\AppData\Local\Temp\bf678ab4ef9529fc7f31cbd3fd5fb1942b8c722a32fb6a305c11659b022899f3.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg9C23.tmp\System.dll

Filesize
10KB

MD5
bf01b2d04e8fad306ba2f364cfc4edfa

SHA1
58f42b45ca9fc1818c4498ecd8bac088d20f2b18

SHA256
d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903

SHA512
30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7

Download Submit
C:\Windows\SysWOW64\LPVideo.dll

Filesize
168KB

MD5
9b0a21b4e638bd8dee830f69cba5aedd

SHA1
96843589e3c6d970f0a766b1d19d968b417e72af

SHA256
f1d00b3a71518b67a5c3e468ab5109393028eed3adb394547fa2b45629bc9dcc

SHA512
cce9f13cfb20b49969161b62d964eb368ae4d68a336e8579546e39f3bf3e3623e439bf1e66d392a09523d848733fa0d9066b8660ee3e96df2967eeccb5b7bf51

Download Submit
C:\Windows\SysWOW64\LPVideo.dll

Filesize
168KB

MD5
9b0a21b4e638bd8dee830f69cba5aedd

SHA1
96843589e3c6d970f0a766b1d19d968b417e72af

SHA256
f1d00b3a71518b67a5c3e468ab5109393028eed3adb394547fa2b45629bc9dcc

SHA512
cce9f13cfb20b49969161b62d964eb368ae4d68a336e8579546e39f3bf3e3623e439bf1e66d392a09523d848733fa0d9066b8660ee3e96df2967eeccb5b7bf51

Download Submit
C:\Windows\SysWOW64\LPVideo.dll

Filesize
168KB

MD5
9b0a21b4e638bd8dee830f69cba5aedd

SHA1
96843589e3c6d970f0a766b1d19d968b417e72af

SHA256
f1d00b3a71518b67a5c3e468ab5109393028eed3adb394547fa2b45629bc9dcc

SHA512
cce9f13cfb20b49969161b62d964eb368ae4d68a336e8579546e39f3bf3e3623e439bf1e66d392a09523d848733fa0d9066b8660ee3e96df2967eeccb5b7bf51

Download Submit
memory/2068-136-0x00000000027E0000-0x000000000280B000-memory.dmp

Filesize
172KB

Download