34358b2374ad170f22a783a32eef27bd4151136caaea1bb530b8595daf08e8f6

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0745c22f8f1672e85717ec1a4568d121.exe
Size

186KB
MD5

0745c22f8f1672e85717ec1a4568d121
SHA1

4479cef229942bd810f6ee29773ed997fa1b8a42
SHA256

34358b2374ad170f22a783a32eef27bd4151136caaea1bb530b8595daf08e8f6
SHA512

89e5777069b2e871a17976c25de14a84a171a626edb4116914801962120e953515591e17ec9fffef31a5eab561ec78ee7c544b0e93476cb1adeb61c7b9e50d93
SSDEEP

3072:vCn+3k7oxS/wMiTn1u1W3Q/wI8G/nUnWce5qablkZgQWaGPYPgNBFNHUkA+ZDUX:vC+1SIM11W3MXnLnqfSPYPAzNHi+ZwX

Score

7^/10

adware persistence stealer upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1088-0-0x0000000000400000-0x000000000047E000-memory.dmp	upx
behavioral1/memory/1088-3-0x0000000000400000-0x000000000047E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tabbrowsing = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0745c22f8f1672e85717ec1a4568d121.exe"	0745c22f8f1672e85717ec1a4568d121.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	0745c22f8f1672e85717ec1a4568d121.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeSecurityPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeLoadDriverPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeSystemProfilePrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeSystemtimePrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeProfSingleProcessPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeIncBasePriorityPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeCreatePagefilePrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeShutdownPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeDebugPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeSystemEnvironmentPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeRemoteShutdownPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeUndockPrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: SeManageVolumePrivilege	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: 33	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: 34	1088	0745c22f8f1672e85717ec1a4568d121.exe
Token: 35	1088	0745c22f8f1672e85717ec1a4568d121.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1088	0745c22f8f1672e85717ec1a4568d121.exe
1088	0745c22f8f1672e85717ec1a4568d121.exe

C:\Users\Admin\AppData\Local\Temp\0745c22f8f1672e85717ec1a4568d121.exe
"C:\Users\Admin\AppData\Local\Temp\0745c22f8f1672e85717ec1a4568d121.exe"
1⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1088-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1088-3-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads