70ac00b86b91507d96560d4c4785d64fff0f74085a893844289b11f1d99b3bd7 | Triage

Sharing

General

Target

NEAS.126d6e9073f8444dcf9560f96dba2e60.exe
Size

328KB
Sample

231101-q67tesbg22
MD5

126d6e9073f8444dcf9560f96dba2e60
SHA1

23c4585577ebc0f8265775ae9d634dbadea21141
SHA256

70ac00b86b91507d96560d4c4785d64fff0f74085a893844289b11f1d99b3bd7
SHA512

b38373954450698979d6f1b42a543815681407ffdf1ae9d1d006117a92e7657aaff23a505e1a4c870f14951827775e03f7a12a6a07bc50589ce63778d5835901
SSDEEP

6144:yyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:yCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Targets

- Target
  
  NEAS.126d6e9073f8444dcf9560f96dba2e60.exe
- Size
  
  328KB
- MD5
  
  126d6e9073f8444dcf9560f96dba2e60
- SHA1
  
  23c4585577ebc0f8265775ae9d634dbadea21141
- SHA256
  
  70ac00b86b91507d96560d4c4785d64fff0f74085a893844289b11f1d99b3bd7
- SHA512
  
  b38373954450698979d6f1b42a543815681407ffdf1ae9d1d006117a92e7657aaff23a505e1a4c870f14951827775e03f7a12a6a07bc50589ce63778d5835901
- SSDEEP
  
  6144:yyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:yCemx0vN3HKGi6sYjJLUGGtedud5tr7
Score

8^/10

adware discovery exploit persistence stealer
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  persistence
- Deletes itself
- Modifies file permissions
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryexploitpersistencestealer

behavioral2

adwarediscoveryexploitpersistencestealer