91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd

General

Target

91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Size

650KB
MD5

89a4688501be6b470f2837a414f214d9
SHA1

2af62ce2d39cdfc1624a1a8cddc52e1fb70f8ba3
SHA256

91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd
SHA512

ca6f470bc264769d3288cef7962bd06170e099d6d7bfcf15239e71a4a668afefab9d6234c8f7493f2ac46c80ff862c5886829fb8a3e9a78ce5a5c74bb330e72b
SSDEEP

12288:pC6wyk1nvfBP0FQoOd/566f81qjbravk7o3xLWAB8TMfo+aqwFtaif8dHOqPNspy:pC6wp1vfhboOb66Uyavk8hdo+g8BOON3

Score

7^/10

bootkit persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4792-0-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/4792-45-0x0000000000400000-0x00000000005AC000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	4792	WerFault.exe	80

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\NumberOfSubdomains = "1"	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "33"	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.msn.com	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "33"	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "55"	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "33"	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "55"	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "55"	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e2000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
Token: SeIncBasePriorityPrivilege	4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
4792	91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe

C:\Users\Admin\AppData\Local\Temp\91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe
"C:\Users\Admin\AppData\Local\Temp\91fbdf764109184d71a2848d11ab45ef67295d04737bd17b0c16924f2e1244cd.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 3100
  2⤵
  - Program crash
  PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4792 -ip 4792
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\CLDOB2BF\www.msn[1].xml

Filesize
146B

MD5
4205eff7f50778f2f5d71d7f59b0c181

SHA1
18d4c79c421f0ada970eab08ed8ded3c6b6c9110

SHA256
0b23c33afe7bd0c436c7675d107d7831851a2f24ab1f803959811c496d58bf0a

SHA512
c11b7553c5dcc55c796b6b505d302e63a71ad9c11c281197f7fe456a77de242a348dbc0f5cf8a12c46a8b180256fd89720ff37f121b34ed41e433262a3350d6e

Download Submit
memory/4792-0-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/4792-2-0x000000006F040000-0x000000006F050000-memory.dmp

Filesize
64KB

Download
memory/4792-45-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads