99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94

General

Target

99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe
Size

177KB
MD5

1e6054e7c0223d0c1508cbe1f7385be5
SHA1

81dd2d3672a77e30814cc0f2dc33b1060e36fea5
SHA256

99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94
SHA512

66b69db35b8d8a7fd500d46fcea38e714e5a33bb4947a091ec4b3d266707c578f7a468b1764e0a5b86a2045b86cd7e10572c4415c40ed070fa272da63c8649de
SSDEEP

3072:RWM9GVvfUoNkaCGaHz+BUVC6GrVM5OXAfVXbmeWcnb:cpVvfUyka4qBiLSVMIXANXbmeR

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1704	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E71F5184-35A9-3C29-99D1-B72C4506A596}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E71F5184-35A9-3C29-99D1-B72C4506A596}\IExplore = "1"	regsvr32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mws77814.dll	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe
File opened for modification	C:\Windows\SysWOW64\mws77814.dll	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe
File created	C:\Windows\SysWOW64\ws77814.dll	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ = "ID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib\ = "{B73CA827-1C54-3A2F-B472-98022A047863}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\ = "LIB"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ = "ID"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mws77814.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib\ = "{B73CA827-1C54-3A2F-B472-98022A047863}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}\InprocServer32\ = "C:\\Windows\\SysWow64\\mws77814.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}\ = "D"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\FLAGS	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1704	1464	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe	27
PID 1464 wrote to memory of 1704	1464	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe	27
PID 1464 wrote to memory of 1704	1464	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe	27
PID 1464 wrote to memory of 1704	1464	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe	27
PID 1464 wrote to memory of 1704	1464	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe	27
PID 1464 wrote to memory of 1704	1464	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe	27
PID 1464 wrote to memory of 1704	1464	99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe	27

C:\Users\Admin\AppData\Local\Temp\99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe
"C:\Users\Admin\AppData\Local\Temp\99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\mws77814.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mws77814.dll

Filesize
172KB

MD5
3d866f8eb363d9f57f473e663d5cfdda

SHA1
b336650ff8899dfd76e901bf6d8cf02c9283ba6e

SHA256
2d8b5fb77b8f24879a50f32fd99490543ea0a684fb1d8195f7a318b9977a40b8

SHA512
6ad6bac7a5e44d984f3dbf76040dad3fd7a29f73cb97ff6606d36e2e5504a616fa785a36e3ffb5e257d53fd09fe5f856e3a6ec6c59ddaf8349deaa34fcd41da9

Download Submit
\Windows\SysWOW64\mws77814.dll

Filesize
172KB

MD5
3d866f8eb363d9f57f473e663d5cfdda

SHA1
b336650ff8899dfd76e901bf6d8cf02c9283ba6e

SHA256
2d8b5fb77b8f24879a50f32fd99490543ea0a684fb1d8195f7a318b9977a40b8

SHA512
6ad6bac7a5e44d984f3dbf76040dad3fd7a29f73cb97ff6606d36e2e5504a616fa785a36e3ffb5e257d53fd09fe5f856e3a6ec6c59ddaf8349deaa34fcd41da9

Download Submit
memory/1464-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing