609e27656ad00574815d2a355cf429da58e082ff6ba245e74e06335a4113ea14

General

Target

04d4326343cdf1d4baef0f88aee6dce8.exe
Size

13KB
MD5

04d4326343cdf1d4baef0f88aee6dce8
SHA1

427d54e74f33b594ccf789145044e87cf7325492
SHA256

609e27656ad00574815d2a355cf429da58e082ff6ba245e74e06335a4113ea14
SHA512

a1233dff180afe52e8fc65d21b42ef9b1d97a98e8206bfe4183e85051b635e5956ce70355fd93abb7ca7caebdfdc9b27277ef8919a9ba9c7bb6a7e276d7158bb
SSDEEP

384:FtTdZjseIebeqoM6Jw3toQTgQBi88+wYzLY:7bfLFoM76QTf4BYvY

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\issearch.exe = "issearch.exe"	issearch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run	issearch.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	04d4326343cdf1d4baef0f88aee6dce8.exe

Executes dropped EXE 1 IoCs

pid	Process
1916	issearch.exe

Loads dropped DLL 1 IoCs

pid	Process
1916	issearch.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a43385f0-7113-496d-96d7-b9b550e3fcca}	issearch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a43385f0-7113-496d-96d7-b9b550e3fcca}\	issearch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	issearch.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ixt0.dll	issearch.exe
File created	C:\Windows\SysWOW64\issearch.exe	04d4326343cdf1d4baef0f88aee6dce8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main	issearch.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Search	issearch.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\SearchUrl	issearch.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca}\	issearch.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca}\InprocServer32	issearch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca}\InprocServer32\ = "C:\\Windows\\SysWow64\\ixt0.dll"	issearch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca}\InprocServer32\ThreadingModel = "Apartment"	issearch.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID	issearch.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca}	issearch.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
116	04d4326343cdf1d4baef0f88aee6dce8.exe
116	04d4326343cdf1d4baef0f88aee6dce8.exe
116	04d4326343cdf1d4baef0f88aee6dce8.exe
116	04d4326343cdf1d4baef0f88aee6dce8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	116	04d4326343cdf1d4baef0f88aee6dce8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 1916	116	04d4326343cdf1d4baef0f88aee6dce8.exe	88
PID 116 wrote to memory of 1916	116	04d4326343cdf1d4baef0f88aee6dce8.exe	88
PID 116 wrote to memory of 1916	116	04d4326343cdf1d4baef0f88aee6dce8.exe	88
PID 116 wrote to memory of 4620	116	04d4326343cdf1d4baef0f88aee6dce8.exe	92
PID 116 wrote to memory of 4620	116	04d4326343cdf1d4baef0f88aee6dce8.exe	92
PID 116 wrote to memory of 4620	116	04d4326343cdf1d4baef0f88aee6dce8.exe	92

C:\Users\Admin\AppData\Local\Temp\04d4326343cdf1d4baef0f88aee6dce8.exe
"C:\Users\Admin\AppData\Local\Temp\04d4326343cdf1d4baef0f88aee6dce8.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\issearch.exe
  C:\Windows\system32\issearch.exe
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\04D432~1.EXE > nul
  2⤵
  PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\issearch.exe

Filesize
28KB

MD5
fc7b0c097f584c0090b7dd5b8ec59934

SHA1
faa106f33bcb592fb876e4d44a3b481827aeea4b

SHA256
dacc6f71bd1c3069fba75abfcaac97359aa949a92d4bf92119a19d38242a0623

SHA512
1c159073ef7d5f8f220a2eb4bdc072aff8db2941a7cde854828f5cabb526fbe0ae1d8fc5f35085c01101ecf3eebbd2d93c01e15b840cb459291742cc1d61eb94

Download Submit
C:\Windows\SysWOW64\ixt0.dll

Filesize
18KB

MD5
0164585125ce7417a90db7afa671536f

SHA1
74e24beea416fb9c0a23fd66102909b46110f03a

SHA256
e11c7aafc30d9d0b5da7364058e7949150d8a0ab71e7f4c583ff64f81dd9206b

SHA512
ad2636db623c4645bd1c86cf5f6a98f2403c51ba4a09468f3b573d9681f342c2a7ead0a37d5b5a6a349c45d5e143fe3037674be3190331d529bac65379b2314e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads