528d1fc3d9d2cba918dbc0b2b735c286caf844c51da3be3dece7891f09ebcdc6

General

Target

Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
Size

2.6MB
MD5

6a6b50832f0fd4d909c5a29be1ace1e6
SHA1

00b85d6b4b49d694bbc61b75c3e9c9d60e362f78
SHA256

528d1fc3d9d2cba918dbc0b2b735c286caf844c51da3be3dece7891f09ebcdc6
SHA512

d3cd734f01c9cf8efec31513588dbcb107913fbc30524a150b145731049f441291b8a06e171480cefec8c1920ea6db37e31c0af2e527b23d3a6367dbd19dff83
SSDEEP

49152:hSBrpYL3+HzziPX0imuldpMnlRe+eWyocsVuponN5RT7YE7:CpYSz2PdInl0+eMcxoB

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
2468	Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe

C:\Users\Admin\AppData\Local\Temp\Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe
"C:\Users\Admin\AppData\Local\Temp\Malicious_1afa0bdf1dda537129e435ac361f6333e5c0f4640db278ed2598c274babe5791.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html

Filesize
12KB

MD5
f024bf4e4d888ef713cef3423dd113a2

SHA1
a29a58594b279349de1d37a088d401614fffdcb1

SHA256
e5a3f7964d7316da868be5e433d4d3631e5617e22b9588147559f0bde6468431

SHA512
05f782826f40f4831f87a1b797c277890117ab0e9d9d4e1deb55fb25e05436d0c50007e996bb36929d54ba4fd38a9d1e8e9dcd444ab27d05f2aee9cdf41091fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js

Filesize
202KB

MD5
a4fdd77e182bd2fabe300a47b5617a35

SHA1
e002b335c75b5edefcd251962f61f53a2ab8e0f2

SHA256
8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b

SHA512
ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js

Filesize
89KB

MD5
ea75b2a8f1b4241a872b1cbddbaed154

SHA1
18678dd78c1f5a3525127b442bc70375faf09c16

SHA256
4a62927a380e201c4ee51321dcc1e6b1f7dfbf82049cf349df990629e01e9178

SHA512
dc69cd4703dcba3c8f4a52058c44a34fa7c0b6096bed20f30ce3dab872461eb6dda9d0d381137b9cb022219ad92ca7f5f25d3964ed33d5f41e9fc05efa5330fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\preloader.html

Filesize
352B

MD5
3e2a88c55776a6118c91b8b11d5211a3

SHA1
e42024445c7859365c52c305b08b50152bd1e256

SHA256
57b689d69089b3de9be51928fe6c9a08664f986bc68ebabbb886bf3c26b1ec03

SHA512
706232d6c903955385ab95248e46bf293ed457aaf56b4095b023c782892d5a702b1da1e69f3de8fa81a9140d1e0f90c0dfca5f7d28071da3e3318dbba9477f26

Download Submit
memory/2468-54-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2468-317-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing