12cd7c5646eaa9136f10d87d8a19748a7b49b5bcf554970aa5237fd3daf88ff9

Analysis

max time kernel
176s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f3be430b1661d632bc8efa4f396b5e8.exe
Size 443KB
Sample231226-vpgm5ahac2
SHA256 12cd7c5646eaa9136f10d87d8a19748a7b49b5bcf554970aa5237fd3daf88ff9
MD5 7f3be430b1661d632bc8efa4f396b5e8
SHA1 363c78a458bdef7459dc2eeed1dac1fded9fedec
SHA512 f070ffa07a2c743695900c3685cf390e0914812aa00d887a1040d3e209129624dc43ba66995fcaf3471ca5cc2a42d61bec39052d16c90afc4d3bb7afd54a6e67
SSDEEP 12288:L2HxZ++CXtpPnxbPEQmP9HWeh7O1uFc12drBD6jq:gZ+DvPnx9m12e81uyMfD6jq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	7f3be430b1661d632bc8efa4f396b5e8.exe

Executes dropped EXE 1 IoCs

pid	Process
4168	wnjnoie.exe

Loads dropped DLL 2 IoCs

pid	Process
560	regsvr32.exe
4556	regsvr32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3572-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3572-7-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3572-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{70130026-5925-4F43-B95F-BB24BDF9BD08}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70130026-5925-4F43-B95F-BB24BDF9BD08}\	regsvr32.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\wnjnoie.dll	7f3be430b1661d632bc8efa4f396b5e8.exe
File created	C:\Program Files (x86)\Common Files\mnjnoi.dll	7f3be430b1661d632bc8efa4f396b5e8.exe
File opened for modification	C:\Program Files (x86)\Common Files\mnjnoi.dll	7f3be430b1661d632bc8efa4f396b5e8.exe
File created	C:\Program Files (x86)\Common Files\ehbsmlcx.bat	wnjnoie.exe
File created	C:\Program Files (x86)\Common Files\wnjnoie.exe	7f3be430b1661d632bc8efa4f396b5e8.exe
File opened for modification	C:\Program Files (x86)\Common Files\wnjnoie.exe	7f3be430b1661d632bc8efa4f396b5e8.exe
File created	C:\Program Files (x86)\Common Files\wnjnoie.dll	7f3be430b1661d632bc8efa4f396b5e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{107F436E-FA63-411F-A608-53A165DDF8E0}	regsvr32.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mnjnoi.mierst\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70130026-5925-4F43-B95F-BB24BDF9BD08}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wnjnoie.mtshgsd	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70130026-5925-4F43-B95F-BB24BDF9BD08}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107F436E-FA63-411F-A608-53A165DDF8E0}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node\CLSID	wnjnoie.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	wnjnoie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mnjnoi.mierst\Clsid\ = "{107F436E-FA63-411F-A608-53A165DDF8E0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107F436E-FA63-411F-A608-53A165DDF8E0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70130026-5925-4F43-B95F-BB24BDF9BD08}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70130026-5925-4F43-B95F-BB24BDF9BD08}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	wnjnoie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107F436E-FA63-411F-A608-53A165DDF8E0}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wnjnoie.mtshgsd\Clsid\ = "{70130026-5925-4F43-B95F-BB24BDF9BD08}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70130026-5925-4F43-B95F-BB24BDF9BD08}\ProgID\ = "wnjnoie.mtshgsd"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107F436E-FA63-411F-A608-53A165DDF8E0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107F436E-FA63-411F-A608-53A165DDF8E0}\InprocServer32\ = "C:\\PROGRA~2\\COMMON~1\\mnjnoi.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70130026-5925-4F43-B95F-BB24BDF9BD08}\InprocServer32\ = "C:\\PROGRA~2\\COMMON~1\\wnjnoie.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	wnjnoie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://www.net9981.cn"	wnjnoie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	wnjnoie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mnjnoi.mierst	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107F436E-FA63-411F-A608-53A165DDF8E0}\ProgID\ = "mnjnoi.mierst"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wnjnoie.mtshgsd\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70130026-5925-4F43-B95F-BB24BDF9BD08}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node	wnjnoie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	wnjnoie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wnjnoie.mtshgsd\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	wnjnoie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	wnjnoie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mnjnoi.mierst\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	wnjnoie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	wnjnoie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107F436E-FA63-411F-A608-53A165DDF8E0}\ProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4556	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	93
PID 3572 wrote to memory of 4556	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	93
PID 3572 wrote to memory of 4556	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	93
PID 3572 wrote to memory of 560	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	94
PID 3572 wrote to memory of 560	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	94
PID 3572 wrote to memory of 560	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	94
PID 3572 wrote to memory of 4168	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	95
PID 3572 wrote to memory of 4168	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	95
PID 3572 wrote to memory of 4168	3572	7f3be430b1661d632bc8efa4f396b5e8.exe	95
PID 4168 wrote to memory of 1448	4168	wnjnoie.exe	96
PID 4168 wrote to memory of 1448	4168	wnjnoie.exe	96
PID 4168 wrote to memory of 1448	4168	wnjnoie.exe	96

C:\Users\Admin\AppData\Local\Temp\7f3be430b1661d632bc8efa4f396b5e8.exe
"C:\Users\Admin\AppData\Local\Temp\7f3be430b1661d632bc8efa4f396b5e8.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s mnjnoi.dll
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:4556
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s wnjnoie.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:560
- C:\Program Files (x86)\Common Files\wnjnoie.exe
  "C:\Program Files (x86)\Common Files\wnjnoie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Common Files\ehbsmlcx.bat""
    3⤵
    PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ehbsmlcx.bat

Path C:\Program Files (x86)\Common Files\ehbsmlcx.bat
Size 138B
SHA256 3475dc832f7467df1c47257698404978e0232fd67be96eb46271f3a137b882c2
MD5 ca6b1d32d1c77b181afce7c4caef1ef3
SHA1 b7c28bdf4be0f37fb8f449895ecff06f97c61a56
SHA512 2a3e27d89f46f2d8f8c84d3a05a436a3d1d7e20c1d7626d7674316df2601ddcac1e1716dca2f9202050ff16fa3d5d9a9327be1789209195485134ef27d2477ec
MD5 SHA1 SHA512

Submit Download

mnjnoi.dll

Path C:\Program Files (x86)\Common Files\mnjnoi.dll
Size 371KB
SHA256 660fb55ca81b168a79747a2db22ec39cf5f8c91f7bf43e7ebd1791c70f1bce81
MD5 ba868fce596ef708eeafb008e612e273
SHA1 ed38c88a646425d58e2b0b6b720b17796f666250
SHA512 67f8f3b83d890963b64e48934c7b69cbaba8b0baae8311fec139e0e58436ab122b9fac8c78495d2d0e7522d50b4268cda8789628fbbc0c6a734332c2e08faa57
SSDEEP 6144:R+Ka7ZXdAcKlsdWxAL6n96vUsc2sXMb5TYLhB2dZ/iS:Udd3Kls+9sUsZsyqLT2dZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mnjnoi.dll

Path C:\Program Files (x86)\Common Files\mnjnoi.dll
Size 213KB
SHA256 1b4fe2409a36a441883c0bd0d1c28c9e40b830ef3385146b235e03f52ec6e9dd
MD5 86af4a6a492bb78987aca0e7f7c55ec8
SHA1 b656381ba8ff0b8caa8733821d3a3159c74d5aeb
SHA512 3f6a3467c5bfd830df9bb2351d6741d320671788ef8699b701127ac523ad1f9ff5efba407ec11a9586c679dcdf0e8be103740d01c3d0394250d9805e5f6c8742
SSDEEP 3072:YI+7Ga7ANQa23DM0jA7OKAIs5KEZwo8rrWxKAOJ0VZjxWSeqsKF96j79Yrvg3scV:R+Ka7ZXdAcKlsdWxAL6n96vUsc2sX3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnjnoie.dll

Path C:\Program Files (x86)\Common Files\wnjnoie.dll
Size 411KB
SHA256 e0bf7fd28c5b0286ed3980c68ced7307a41beb2eab459f720afe343bda66ef1a
MD5 020dbf5c98b3bde79b7a15daef677c2d
SHA1 30b357bcad6abfda1bb22f54744921af1c262503
SHA512 9be385637aa7e48fb9bc57d62b8f8bf852eda327aa0a1a283bf81af4dcc53a5a68cc05c4beb9682f96ba10fada52c56dc5a07956480b89b7bc1f90b58203cd40
SSDEEP 6144:QjOY6+f+Q0SgMkmdKDDb5aki/9h3AyhLeBiVL45K8Q55HrwG/eEdVFvT+EvVC:e6+f+7SFkmdK8Eg4YFHwyfFv1
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnjnoie.exe

Path C:\Program Files (x86)\Common Files\wnjnoie.exe
Size 122KB
SHA256 81aafb71b62194c814235cbf3b29c1ee9df2d4907319ddd6f30c8f71a063fd59
MD5 54ef7ebae83103a68b1b8ce36a27c0d0
SHA1 91e04c24dd54aba126521ab6371b2fc2bb47739c
SHA512 19b61ebabaf1101e8c75af9589d039ec8ef818bc6d10e9b651bd09ee0014460ff4fa3dd080ce91cd7b3697122a29055d641fef6a8b8a1d203c63641f2f6aea4f
SSDEEP 3072:9JzzmNHrDy0AiscBmksERSTz+mvoEjahD4L0B/pslNJelG:nCZIiPEojRDqq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3572-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3572-7-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3572-20-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4168-22-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads