06fc6c1bab824512c694f8da3676c734290fa5afac309911dae7891023286320

General

Target

29ae3ac9e78b909c4d41585f867f9e52.dll
Size

564KB
MD5

29ae3ac9e78b909c4d41585f867f9e52
SHA1

0f390c02e64657a2d402e1694f597e76ea5bb40f
SHA256

06fc6c1bab824512c694f8da3676c734290fa5afac309911dae7891023286320
SHA512

7439f2afb0ecb05bdb6575fa5bbf23227d79b9eed291e8638d695cf40cd9cb79cd52e9750826d674920fa94d2ffc554ba4b303d134e5a03c41486c8163f2f208
SSDEEP

12288:zVhi9MR3BV71yfNdSQZDZuFQVIioiRphGFnQuamTl2n5I4S63:+UV7gfDSQSKVbRwUm6BS63

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3E1BEA96-02D9-4992-B508-9B51819D9D86}	regsvr32.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\ = "DosSpecFolder Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\AppID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder.1	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\VersionIndependentProgID\ = "DosSpecFolder.DosSpecFolder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\ProgID\ = "DosSpecFolder.DosSpecFolder.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder\ = "DosSpecFolder Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\TypeLib\ = "{BAD59A24-6891-417D-A041-C8FD495B77F1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29ae3ac9e78b909c4d41585f867f9e52.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder\CurVer\ = "DosSpecFolder.DosSpecFolder.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder.1\ = "DosSpecFolder Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder\CLSID\ = "{3E1BEA96-02D9-4992-B508-9B51819D9D86}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E1BEA96-02D9-4992-B508-9B51819D9D86}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DosSpecFolder.DosSpecFolder.1\CLSID\ = "{3E1BEA96-02D9-4992-B508-9B51819D9D86}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2516	1716	regsvr32.exe	16
PID 1716 wrote to memory of 2516	1716	regsvr32.exe	16
PID 1716 wrote to memory of 2516	1716	regsvr32.exe	16
PID 1716 wrote to memory of 2516	1716	regsvr32.exe	16
PID 1716 wrote to memory of 2516	1716	regsvr32.exe	16
PID 1716 wrote to memory of 2516	1716	regsvr32.exe	16
PID 1716 wrote to memory of 2516	1716	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\29ae3ac9e78b909c4d41585f867f9e52.dll
1⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2516

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\29ae3ac9e78b909c4d41585f867f9e52.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2516-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2516-1-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing