a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0

Analysis

max time kernel
300s
max time network
365s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe
Size

128KB
MD5

f274830467ae5097bed240d2df72e22a
SHA1

971d5d77d904c0518695b24d8a71c7c3aee4e371
SHA256

a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0
SHA512

4d945af708b65507c2ee5421852a1bc67c7da5edd21f6f18a59b747802d329c3bf2b11329d485b769db40beebe45b273fc50e1da817feb40be0dff9387840cc2
SSDEEP

3072:4ATMTCJpo5HmyjTbwkwd46PLV8WQ+fb7FSw2+:fTMTCJpo5HmyjTSdHz7jT

Score

8^/10

adware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2732	snss.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TM.lnk	snss.exe

Loads dropped DLL 1 IoCs

pid	Process
932	Regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01443AEC-0FD1-40fd-9C87-E93D1494C233}	Regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\NoExplorer = "1"	Regsvr32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sysini.ini	snss.exe
File created	C:\Windows\SysWOW64\csys.dat	snss.exe
File opened for modification	C:\Windows\SysWOW64\Thunder.dll	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe
File created	C:\Windows\SysWOW64\sysini.ini	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe
File opened for modification	C:\Program Files (x86)\snss.exe	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\Programmable	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0\HELPDIR	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\ProxyStubClsid32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper.1\ = "xlhelper Class"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper\CLSID\ = "{01443AEC-0FD1-40fd-9C87-E93D1494C233}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0\ = "Thunder 1.0 Type Library"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\ = "Ixlhelper"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\ProxyStubClsid32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\TypeLib	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper\ = "xlhelper Class"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\TypeLib\ = "{87CA3845-37FE-414C-81CF-E08A7D0F6779}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0\FLAGS	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\ = "Ixlhelper"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\ProgID	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper\CurVer	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\ = "xlhelper Class"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\ProgID\ = "Thunder.xlhelper.1"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\InprocServer32\ = "C:\\Windows\\SysWow64\\Thunder.dll"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\TypeLib	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0\FLAGS\ = "0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0\0\win32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper.1	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\Thunder.dll"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0\HELPDIR\ = "C:\\Windows\\system32"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper.1\CLSID	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper\CLSID	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\VersionIndependentProgID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\VersionIndependentProgID\ = "Thunder.xlhelper"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\InprocServer32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\TypeLib\Version = "1.0"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper.1\CLSID\ = "{01443AEC-0FD1-40fd-9C87-E93D1494C233}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper\CurVer\ = "Thunder.xlhelper.1"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\TypeLib\ = "{87CA3845-37FE-414C-81CF-E08A7D0F6779}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\TypeLib\Version = "1.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xlhelper	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{87CA3845-37FE-414C-81CF-E08A7D0F6779}\1.0\0	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C849754-C410-455A-842E-75DBCBD222B6}\TypeLib	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01443AEC-0FD1-40fd-9C87-E93D1494C233}\TypeLib\ = "{87CA3845-37FE-414C-81CF-E08A7D0F6779}"	Regsvr32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1812	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe
2732	snss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2732	1812	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe	80
PID 1812 wrote to memory of 2732	1812	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe	80
PID 1812 wrote to memory of 2732	1812	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe	80
PID 1812 wrote to memory of 932	1812	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe	83
PID 1812 wrote to memory of 932	1812	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe	83
PID 1812 wrote to memory of 932	1812	a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe	83

C:\Users\Admin\AppData\Local\Temp\a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe
"C:\Users\Admin\AppData\Local\Temp\a427a5b090ac92a64e65b83ab3bb3449d976b85837d37225cca6db88c3ea04f0.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\snss.exe
  "C:\Program Files (x86)\snss.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2732
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s "C:\Windows\system32\Thunder.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\snss.exe

Filesize
40KB

MD5
f5ef30ebebab471bd64770671030a405

SHA1
ccdb7fd7e2c2a3c7438a0e19c4b2979ba5b20c1b

SHA256
fdff92507a77f2a85c716c11e0f17bf182fcab72d6e0d908669d86fa394fcdbe

SHA512
e74d3d06090bfeab6201d1b4ceceac09f25f2b81a0c4976fa0b6f83170307326a358ffccaabb3d83a5168253c2d8cea1b65c227c0c357fed4687f5b469482be9

Download Submit
C:\Program Files (x86)\snss.exe

Filesize
40KB

MD5
f5ef30ebebab471bd64770671030a405

SHA1
ccdb7fd7e2c2a3c7438a0e19c4b2979ba5b20c1b

SHA256
fdff92507a77f2a85c716c11e0f17bf182fcab72d6e0d908669d86fa394fcdbe

SHA512
e74d3d06090bfeab6201d1b4ceceac09f25f2b81a0c4976fa0b6f83170307326a358ffccaabb3d83a5168253c2d8cea1b65c227c0c357fed4687f5b469482be9

Download Submit
C:\Windows\SysWOW64\Thunder.dll

Filesize
32KB

MD5
6723e0bc4cabd932678be8c816d6e37b

SHA1
b8912738bb375e9920653d0485caa678a81bbfdb

SHA256
7b1d085aadeb19b8e5b3cf62c3f7bcc07a46ad1cf6565590ee21d0dab6fabca5

SHA512
62b9c721a7772c78e28d7c3f89ef0e6c6b204c8aadea1f40c1a42caa648c6c21e9b5cda59c8637679072d635f6059dc5d2395f7f7bd79275ca89d9d1fb7ff919

Download Submit
C:\Windows\SysWOW64\Thunder.dll

Filesize
32KB

MD5
6723e0bc4cabd932678be8c816d6e37b

SHA1
b8912738bb375e9920653d0485caa678a81bbfdb

SHA256
7b1d085aadeb19b8e5b3cf62c3f7bcc07a46ad1cf6565590ee21d0dab6fabca5

SHA512
62b9c721a7772c78e28d7c3f89ef0e6c6b204c8aadea1f40c1a42caa648c6c21e9b5cda59c8637679072d635f6059dc5d2395f7f7bd79275ca89d9d1fb7ff919

Download Submit
C:\Windows\SysWOW64\sysini.ini

Filesize
194B

MD5
052699883a935af2306c27b5ee1d8032

SHA1
858fef657ad2d36993a95cfae1c9f614f6a1f4fb

SHA256
fb58ece4399022ab347035ee4f86c6dc871297486b402d63e4f9d4ed43a0c6cb

SHA512
39f57f1f0b6d06a19952bfdb0c37b48cfdd9179d46cc37993a8e7d3173604cbfb6857139298a98e831b2b1fec8a241f37f3ba5b142d3a72188be4bac637da5c8

Download Submit