e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035

General

Target

e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Size

1.4MB
MD5

bef495809e1dd90ff241a27015ae59e0
SHA1

14f7157b558fb918f32d200b688c20b9b8b60225
SHA256

e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035
SHA512

e676610d18873332c2262d1bc0ad84fdc08fd777f28c11ebb99e3137e1977071fdb97a0e1fe89dba084fd0ceae66410152462477a860026a3e9c3b836a5cd3ae
SSDEEP

24576:n7/iW4aTva1MpL78F9qBhAo2ODgNEBOvVf7wj7+a6B51zY7tpstbQTSD9x:nLiMTlA4BAOEEwsj7aB/zqSbQ2

Score

10^/10

adware evasion persistence stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe,"	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
756	DllHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1968	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe

C:\Users\Admin\AppData\Local\Temp\e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe
"C:\Users\Admin\AppData\Local\Temp\e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1968

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Hidden Files and Directories

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035.jpg

Filesize
239KB

MD5
a765df00d58bf83639aa81e53d737148

SHA1
b4ff9778e8c21d1d859eb63c00d7d2c897132177

SHA256
c73b6ee13aaf0448e5c31375c8faa780bc5e0834f374a81c917ae8f9b5e82c41

SHA512
ae15297192151dd7918f6b92202320cadd2390df9505667bf7ee9950d5044e6f752f376da6fc7202dc277128d02aee358ef35ab9a9cb2188f3190d6b97efe130

Download Submit
memory/1968-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/1968-56-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/1968-59-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/1968-60-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/1968-62-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads