c06a5dc04ba1bacf5fbbeda165870abe89d79dca8a808391bd9a8526d70834a2 | Triage

Sharing

General

Target

NEAS.1380be22df410cedb771834c6c38d310.exe
Size

328KB
Sample

231101-gqggvsdd99
MD5

1380be22df410cedb771834c6c38d310
SHA1

a54e339316224b5821d8f8b879d994f930cb8724
SHA256

c06a5dc04ba1bacf5fbbeda165870abe89d79dca8a808391bd9a8526d70834a2
SHA512

2c1b17ee88d0138d88a571785e9453a953a64df086e7a6a73dc359170dff15be635b7ba39e21550c8c65f88b6b08be0e995c56b0f4f2a3eb27bcd2390dc18320
SSDEEP

6144:gyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:gCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Targets

- Target
  
  NEAS.1380be22df410cedb771834c6c38d310.exe
- Size
  
  328KB
- MD5
  
  1380be22df410cedb771834c6c38d310
- SHA1
  
  a54e339316224b5821d8f8b879d994f930cb8724
- SHA256
  
  c06a5dc04ba1bacf5fbbeda165870abe89d79dca8a808391bd9a8526d70834a2
- SHA512
  
  2c1b17ee88d0138d88a571785e9453a953a64df086e7a6a73dc359170dff15be635b7ba39e21550c8c65f88b6b08be0e995c56b0f4f2a3eb27bcd2390dc18320
- SSDEEP
  
  6144:gyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:gCemx0vN3HKGi6sYjJLUGGtedud5tr7
Score

8^/10

adware discovery exploit persistence stealer
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  persistence
- Deletes itself
- Modifies file permissions
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryexploitpersistencestealer

behavioral2

adwarediscoveryexploitpersistencestealer