c71d39bc13977f68e0f1a6002eef482ea9d983fffa1d725a8d1be4c325367527

General

Target

1b2bb91f9751c574d418a36a55938fa5.exe
Size

148KB
MD5

1b2bb91f9751c574d418a36a55938fa5
SHA1

e46ee7a3bbe68014c573083f3146ac9c734a0c22
SHA256

c71d39bc13977f68e0f1a6002eef482ea9d983fffa1d725a8d1be4c325367527
SHA512

dd9c6a70d464785871e25a58eeaba811f0e6806e60496b2133488c8e55f0cb792fc64999f004582fdc039800300b47d2cc6832c3d6ad6b1bb6c2394bb77369f5
SSDEEP

3072:wDh380BMyJ1sizw4LiFjv7rveixfuHgmT0LeahNcnmhCGV:V0bPzw4Wjv7TzAHRZahNym9

Score

7^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00050000000006e9-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4764	1b2bb91f9751c574d418a36a55938fa5.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00050000000006e9-1.dat	upx
behavioral2/memory/4764-4-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-11188-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-23478-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-29585-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-35495-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-47486-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-59244-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-72144-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-84555-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/4764-97910-0x0000000010000000-0x0000000010056000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML module"	1b2bb91f9751c574d418a36a55938fa5.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msxml71.dll	1b2bb91f9751c574d418a36a55938fa5.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID\ = "XML.XML"	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D2631E5-8696-7543-50B2-F674CD4308EB}	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ThreadingModel = "Apartment"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID\ = "XML.XML.1"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\ = "XML Class"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D2631E5-8696-7543-50B2-F674CD4308EB}\.0\ = "XML Library"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML Class"	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ = "C:\\Windows\\SysWow64\\msxml71.dll"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib\ = "{5D2631E5-8696-7543-50B2-F674CD4308EB}"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\ = "XML Class"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer\ = "XML.XML.1"	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D2631E5-8696-7543-50B2-F674CD4308EB}\.0\ = "C:\\Windows\\SysWow64\\msxml71.dll"	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Install = "OK"	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D2631E5-8696-7543-50B2-F674CD4308EB}\.0	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Programmable	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML	1b2bb91f9751c574d418a36a55938fa5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID	1b2bb91f9751c574d418a36a55938fa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}"	1b2bb91f9751c574d418a36a55938fa5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4764	1b2bb91f9751c574d418a36a55938fa5.exe

C:\Users\Admin\AppData\Local\Temp\1b2bb91f9751c574d418a36a55938fa5.exe
"C:\Users\Admin\AppData\Local\Temp\1b2bb91f9751c574d418a36a55938fa5.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msxml71.dll

Filesize
116KB

MD5
2923d19b6a9b6d4ed430c9c4648c4822

SHA1
55cde96bcc3a028675cd38b38a1d50cd64057e24

SHA256
f9e4b0bdcc8c2e7b125fc3840ee5a2d99c1606184bf8467178fd37f4c894fce8

SHA512
3d5f25d3e1cd3a15f7f3be602aa551ec57fe78618fddf18bd37f45ce1cff498e18886ca84e4b2738502916f5301562f3e6614328756471bbc31193b7279879d9

Download Submit
memory/4764-4-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-11188-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-23478-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-29585-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-35495-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-47486-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-59244-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-72144-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-84555-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/4764-97910-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing