2757657d1bfa20dfeda4e34807d215fbfcc9b40d7715f0748cc5313c02b2e048

Analysis

max time kernel
143s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

194e7b8cc5c4a79afcec6dbc7386df7c.exe
Size

58KB
MD5

194e7b8cc5c4a79afcec6dbc7386df7c
SHA1

8cc4647565b2706a4aa48a21cfca1389302afffb
SHA256

2757657d1bfa20dfeda4e34807d215fbfcc9b40d7715f0748cc5313c02b2e048
SHA512

5b5ea4b8561cab21eab3cc98a85c35426a1cd2fdaf607bfad2fef3ef1d455d19cb2a9b0e823dc83e799fccead128ffaefb723a80954e927f86e208b2c773b22d
SSDEEP

1536:/SuAHAhOI6Cv0gg2szO/71mbXKLSEky9t/9:0HAhOI6pgghi/x8XeV9f

Score

7^/10

adware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	194e7b8cc5c4a79afcec6dbc7386df7c.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}	194e7b8cc5c4a79afcec6dbc7386df7c.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hnew32.dll	194e7b8cc5c4a79afcec6dbc7386df7c.exe
File created	C:\Windows\SysWOW64\gl.txt	194e7b8cc5c4a79afcec6dbc7386df7c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	194e7b8cc5c4a79afcec6dbc7386df7c.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}\InprocServer32\ThreadingModel = "Apartment"	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}\ProgID\ = "RITLAB.1"	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}\TypeLib	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}\TypeLib\ = "{1CD0B071-DFD5-4e9f-BFD5-307E0AF078C8}"	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}\ = "Std plugin"	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}\InprocServer32\ = "hnew32.dll"	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}\InprocServer32	194e7b8cc5c4a79afcec6dbc7386df7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-08DF-483c-BD3A-99CBCF44E4DC}\ProgID	194e7b8cc5c4a79afcec6dbc7386df7c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3048	3180	194e7b8cc5c4a79afcec6dbc7386df7c.exe	19
PID 3180 wrote to memory of 3048	3180	194e7b8cc5c4a79afcec6dbc7386df7c.exe	19
PID 3180 wrote to memory of 3048	3180	194e7b8cc5c4a79afcec6dbc7386df7c.exe	19

C:\Users\Admin\AppData\Local\Temp\194e7b8cc5c4a79afcec6dbc7386df7c.exe
"C:\Users\Admin\AppData\Local\Temp\194e7b8cc5c4a79afcec6dbc7386df7c.exe"
1⤵
- Checks computer location settings
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\194E7B~1.EXE >> NUL
  2⤵
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads