41ec4e93748809b11e633102e9bc110bc736586d0cc1dffda1320be2382f5e46

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f34d804d5a1f1d03385229fd9a3924e.exe
Size

75KB
MD5

1f34d804d5a1f1d03385229fd9a3924e
SHA1

4e4a8d90dbe967caaf410dbc35bdfc21f5e6d77e
SHA256

41ec4e93748809b11e633102e9bc110bc736586d0cc1dffda1320be2382f5e46
SHA512

73bee553b4704c3153dae7e872b666a11ea253d74a43f94823b8d510cb413ebb7dd7506aced6ba23477202aa6714209b1150fc1c171f6e73c7d39cf7d0799e73
SSDEEP

1536:XID1x5RWw3nuyH31Q8toRHsuCvCtSZLx2zk2:XIDb54w3/39oRHEv/9x2zk2

Score

10^/10

adware evasion stealer upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	1f34d804d5a1f1d03385229fd9a3924e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"	1f34d804d5a1f1d03385229fd9a3924e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	1f34d804d5a1f1d03385229fd9a3924e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	1f34d804d5a1f1d03385229fd9a3924e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5048-5-0x0000000010000000-0x0000000010008000-memory.dmp	upx
behavioral2/memory/5048-1-0x0000000010000000-0x0000000010008000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\browser helper objects\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}	1f34d804d5a1f1d03385229fd9a3924e.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ipv6monl.dll	1f34d804d5a1f1d03385229fd9a3924e.exe
File opened for modification	C:\Windows\SysWOW64\ipv6monl.dll	1f34d804d5a1f1d03385229fd9a3924e.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	5048	WerFault.exe	19

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	1f34d804d5a1f1d03385229fd9a3924e.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}\InprocServer32	1f34d804d5a1f1d03385229fd9a3924e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}\InprocServer32\ = "C:\\Windows\\SysWow64\\ipv6monl.dll"	1f34d804d5a1f1d03385229fd9a3924e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}\InprocServer32\ThreadingModel = "apartment"	1f34d804d5a1f1d03385229fd9a3924e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}	1f34d804d5a1f1d03385229fd9a3924e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}	1f34d804d5a1f1d03385229fd9a3924e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5048	1f34d804d5a1f1d03385229fd9a3924e.exe

C:\Users\Admin\AppData\Local\Temp\1f34d804d5a1f1d03385229fd9a3924e.exe
"C:\Users\Admin\AppData\Local\Temp\1f34d804d5a1f1d03385229fd9a3924e.exe"
1⤵
- Modifies firewall policy service
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 436
  2⤵
  - Program crash
  PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5048-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5048-5-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/5048-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/5048-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads