Overview

overview

7

Static

static

3

0a796da6a1...4a.exe

windows7-x64

7

0a796da6a1...4a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 06:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a796da6a167694858aaedfd05dc0b4a.exe

  • Size

    1.8MB

  • MD5

    0a796da6a167694858aaedfd05dc0b4a

  • SHA1

    97a2d0742150156e09ca5ac6192f1b9e6f20bf1e

  • SHA256

    e25580890c90ae7aab2fb18297aeb49de95b818d91ec717bfa5733cd746989c7

  • SHA512

    41fef0674e438c21851b202ecda8e23eee6c87d26534dba3215fb129bd50391448cedfdee8427a91ae4abeb074d4a32e88c806e950b70f1460fd838d76361cc4

  • SSDEEP

    49152:JJmFnyeHSDKfuWnZR4EboBndcs+qtG53enzg2BzbPgTd:DWHHSDxWaD4kzDJrgx

Score
7/10
adwarediscoverystealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 28 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a796da6a167694858aaedfd05dc0b4a.exe
    "C:\Users\Admin\AppData\Local\Temp\0a796da6a167694858aaedfd05dc0b4a.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM tbhelper.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM rssclient.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2384
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32 /s "C:\Program Files (x86)\Layouts Express Toolbar\tbcore3.dll"
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Program Files (x86)\Layouts Express Toolbar\TbHelper2.exe
        "C:\Program Files (x86)\Layouts Express Toolbar\TbHelper2.exe" -RegServer
        3⤵
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:2568
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Program Files (x86)\Layouts Express Toolbar\TbCommonUtils.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1956
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.bigseekpro.com/i_end/0/1/1/1/1/layoutsexpress
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:992
  • C:\Program Files (x86)\Layouts Express Toolbar\TbHelper2.exe
    "C:\Program Files (x86)\Layouts Express Toolbar\TbHelper2.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    PID:452
  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:2
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    0787ffe190c9d17fcefac0f306189cd5

    SHA1

    a79cfa8b3ce59fef15fa83aa34122498ad1c0bf3

    SHA256

    80d24c5aa53ec3f54c353459864be1591806a6f6972e14d707ddc7293f9c5639

    SHA512

    19bcb09b382ebbd66f0f83b0c4ad72565160f7bc8f406ddfe688dd87be2b359d55dd4a5c6be2fe997d0d6c74f143e43b77a981e487ea61fa649da43d55ada5d1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    2f972c276bcc9462130d8317b6221530

    SHA1

    462f8e6928559e8df380db8443019e8da2f128ae

    SHA256

    2ae9a98178de7c3f205b2fb62b0b4b185f9492dc5ce01499786681aaab7cc4c6

    SHA512

    1dec5ef3367147fc507b39b0cd611d1c6471fe98edb6a2ce8fa6885fc6cc3e9d1a333b9170cdff22adf19583c00fcf10e4d3162d52a0d240901c90cb2cb407f0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    db0e2817dac4d9b7860051f10e58cc57

    SHA1

    ec4bd51fc0095fd067138757829de68878b3b319

    SHA256

    64f241f3b7342fc81dca0fd5c41fb4bf3a82ba9a6d662df8126c21f66a271c5f

    SHA512

    062e7d927d356396d113c091784c661012562b8cfb66659a892482272270b79ec15793da99548e7f5ca61939175abc2f2d21b7bb54c92735db7c75af3835e15a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    f476c105ebd788ca6d0e4c289fb7063b

    SHA1

    cbfcf98fad05a43b3bf3ba5ef2080e80221aef23

    SHA256

    3c6d8a7bd43ea477bd757f1dbb0f77c3c53f96ec78286eaadfb71895e9280f7b

    SHA512

    23febd03486b49799b557b85bd6cd29261c88f10c1802cc33e4bc3e8dfdbc341afeb2fa0e8ab9655eed672f9dbf65a3a94f964b1ea1aac8b1e80fd72ed9c1281

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    6fd9c5793938d851adcc3b6d23904ee8

    SHA1

    49f8d0e9c6ab6b96fd67226aa552ef9feb25d3fc

    SHA256

    3105f782d6986ef475c619db4e1015a594ee78021adfdd63b9b79970baaa64fb

    SHA512

    bc2ea7c383557e4fe1192c884e08854ca5ea95964d59d8fc30008bad0d4b9dec492fe2f31151aa6df30910b51e9b221f52da35bc2bf2f48c845f7382179bd289

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    0dcdb87854e958c5892386512e62d7bf

    SHA1

    0347840034f99d939d025b390547d7a493b9ac80

    SHA256

    9eef6483d2a3ec45eb7a9fa9b380aee6212abadb69fb67f12f9b6960d94f6e1e

    SHA512

    c7eebbc20bb4e1ee5e772cb9c8b704a545108bfdf15b322d8a5b61cc965337f6ccc8daf271d4bf61fc0037af546e897bd0dea4dac46de3669d0a0c2ee15e0964

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    4be71a26f4d213b0b61b9017c226f7e3

    SHA1

    26d7764f310ed6b22aac49e599ed125edf3475ef

    SHA256

    044d95da576ab209fc34f67e967280e6e374532966f42ab8bbe31da55d77ecb2

    SHA512

    a5e5b3678f672730c99b76a6bea138cd4b61fd7e50ee89aa6438e4f4b3bc0a989997f12e380d7ad8c7b1c98804f9b5a4e2b1535b22518366c386ae793185c13a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    52b3f056e8c9a84a05cd111b6bc6f2d0

    SHA1

    673065496f6e985c42646db4ea903767b3ebfc67

    SHA256

    336c0296e496a9cb7ab7476d981b432180c9d11f87549cfef5666900ab23225d

    SHA512

    33d3dc0270e4875c7eac0c90c43c8d45676e65749d3f7383880352755f73429c21eeb65aafda235a08988640f18f1d6a08ece9c66c304a91659ef7c002f367a4

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nstA11.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit

  • memory/1736-20-0x0000000000480000-0x0000000000499000-memory.dmp

    Filesize

    100KB

    Download

  • memory/1736-113-0x0000000002A40000-0x0000000002A6A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/1736-14-0x0000000000480000-0x0000000000483000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2016-170-0x0000000000460000-0x00000000004B3000-memory.dmp

    Filesize

    332KB

    Download

  • memory/2016-176-0x0000000000460000-0x00000000004B9000-memory.dmp

    Filesize

    356KB

    Download

  • memory/2016-183-0x0000000000460000-0x000000000047F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2016-180-0x0000000000460000-0x0000000000478000-memory.dmp

    Filesize

    96KB

    Download