e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Size

176KB
MD5

2ecf4a0cb843ef19bbf52adf1e8cff6c
SHA1

7e4b734860db8516b8c3c246a371ee8aab420cea
SHA256

e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6
SHA512

9ec62b125cc3b96f6f154734d97193077a38a6921687857c4d9b571b608e1610d6a5e0f08de4a50540955ee70be3d5928ec8f1df7424bb27206eb258504c4cb2
SSDEEP

3072:y8SBjlnc5OevGSXhuULpKwg2H+a63U57dbiLCNN1dR3:y/B5c5MSXhuU9KwG3UWLCNndZ

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
736	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{32324134-3465-4325-6543-325435274523}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\altcmd\altcmd.inf	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File created	C:\Program Files (x86)\altcmd\uninstall.bat	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File opened for modification	C:\Program Files (x86)\altcmd\uninstall.bat	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File created	C:\Program Files (x86)\altcmd\altcmd32.dll	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File opened for modification	C:\Program Files (x86)\altcmd\altcmd32.dll	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File created	C:\Program Files (x86)\altcmd\altcmd.inf	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32\ThreadingModel = "Apartment"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID\ = "{32324134-3465-4325-6543-325435274523}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0\win32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\VersionIndependentProgID	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\Programmable	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0\win32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID\ = "{32324134-3465-4325-6543-325435274523}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\FLAGS	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\VersionIndependentProgID\ = "MsVCL1.BhoApp"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\HELPDIR	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\ = "BhoApp Class"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ProgID	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\ = "BhoApp Class"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer\ = "MsVCL1.BhoApp.1"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ProgID\ = "MsVCL1.BhoApp.1"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\ = "MsVCL1 1.0 Type Library"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\altcmd\\"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ = "BhoApp Class"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\FLAGS\ = "0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
736	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 904	736	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	27
PID 736 wrote to memory of 904	736	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	27
PID 736 wrote to memory of 904	736	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	27
PID 736 wrote to memory of 904	736	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	27

C:\Users\Admin\AppData\Local\Temp\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
"C:\Users\Admin\AppData\Local\Temp\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\4E2.bat
  2⤵
  PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4E2.bat

Filesize
294B

MD5
a0baa2efdd8779569acd363bba8081ac

SHA1
5eead3814ca26f65f62c15b89f8117e6dbd2eedf

SHA256
6002fb63acf6a46a8affdb3ee2e0a07402ee5a0b3b1a3d51996ba761d3dbd707

SHA512
ab68e2026be9c49bff9f386641e78f6433354b29be982b7f0f5b143aa6fd47c85dc5bc500201b8483b47976af39a9f7a8afd9f0a8361e24710f115fac20573b9

Download Submit
\Program Files (x86)\altcmd\altcmd32.dll

Filesize
160KB

MD5
968158bf7662cea9e0f5c89b97a81a12

SHA1
5eb4903d8cf6448b97c5f5f25e9e89351b53919f

SHA256
c3131cdc0d4f9adf633b2e58b05730924f284fc8e51a7bf90151a7a075dc750f

SHA512
3962378f0f76b1f4a1846bd957a1eaa10a3222bd8d26e44705845c5f395d2284e7af9045bf379ad23019e4a24a5313a31e5b1f139f80ff20d767dd9febe45744

Download Submit
memory/736-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download