8779ae7a1afa6b8b35b4130731d79bbc9880ebb81c424d1f9a91c3b5a0caf786 | Triage

Submit
Reports

Overview

overview

8

Static

static

8779ae7a1a...86.exe

windows7-x64

8

8779ae7a1a...86.exe

windows10-2004-x64

8

Sharing

General

Target

8779ae7a1afa6b8b35b4130731d79bbc9880ebb81c424d1f9a91c3b5a0caf786
Size

273KB
Sample

221206-ac55qsad25
MD5

f989d69e50425ecf1b6a48f651fb8cbd
SHA1

87e598bd346ccaea19ca1d8279688aa1575df49b
SHA256

8779ae7a1afa6b8b35b4130731d79bbc9880ebb81c424d1f9a91c3b5a0caf786
SHA512

f2e4f5964cffd5fd33351ce3d8081eaaf47732d7a9fbbf6fea19ae8a3bb5fe826ea2f9ef163f0704c440c0bc5b05e0bfccd2e53da779bd9845ef4618b9c18e95
SSDEEP

6144:mY94NIbbFeYjTblA9ap4IazYS9ikvHNN0ys9vSTLoGHIqL:N9OgJeGlPN9QikFayWvSLoGoqL

Score

8^/10

adware discovery persistence stealer

Static task

static1

Behavioral task

behavioral1

Sample

8779ae7a1afa6b8b35b4130731d79bbc9880ebb81c424d1f9a91c3b5a0caf786.exe

Resource

win7-20221111-en

adware discovery persistence stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

8779ae7a1afa6b8b35b4130731d79bbc9880ebb81c424d1f9a91c3b5a0caf786.exe

Resource

win10v2004-20221111-en

adware discovery persistence stealer

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  8779ae7a1afa6b8b35b4130731d79bbc9880ebb81c424d1f9a91c3b5a0caf786
- Size
  
  273KB
- MD5
  
  f989d69e50425ecf1b6a48f651fb8cbd
- SHA1
  
  87e598bd346ccaea19ca1d8279688aa1575df49b
- SHA256
  
  8779ae7a1afa6b8b35b4130731d79bbc9880ebb81c424d1f9a91c3b5a0caf786
- SHA512
  
  f2e4f5964cffd5fd33351ce3d8081eaaf47732d7a9fbbf6fea19ae8a3bb5fe826ea2f9ef163f0704c440c0bc5b05e0bfccd2e53da779bd9845ef4618b9c18e95
- SSDEEP
  
  6144:mY94NIbbFeYjTblA9ap4IazYS9ikvHNN0ys9vSTLoGHIqL:N9OgJeGlPN9QikFayWvSLoGoqL
Score

8^/10

adware discovery persistence stealer
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Network Service Scanning

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencestealer

behavioral2

adwarediscoverypersistencestealer

© 2018-2024

Terms | Privacy