108e077a393f52d496ae83dd05472ff3ccb3d469478309b1d49c70c93e1cf667

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a579b82b404dda9baa4565e6701ee87.exe
Size 717KB
Sample240108-d8m6ksbec6
SHA256 108e077a393f52d496ae83dd05472ff3ccb3d469478309b1d49c70c93e1cf667
MD5 4a579b82b404dda9baa4565e6701ee87
SHA1 a2d068bd0875baed84153777a0052ddba54bfc17
SHA512 45e526cb052c7529a8ea8354f841c29383d9971d86c12ae13227a7643a7f5405babc67ae9e3351be7d9179bbc0bfc11f24101804a9494f3db0b97ca688189102
SSDEEP 12288:BKnekrL58xwokOTtwN6jBFyy26caMHC2N8+NALWKrYPTDN89Q4SvrM4ykAznsZHC:OLix4SnFDFcHFNASXbp89QHzM4ZAzuHC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4388	T4Xo4.exe

Loads dropped DLL 1 IoCs

pid	Process
4388	T4Xo4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\haaopachmoimjkjefpbpadndimigbdgj\1.6\manifest.json	T4Xo4.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ = "DowwnlloaD keepEr"	T4Xo4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\NoExplorer = "1"	T4Xo4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}	T4Xo4.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	T4Xo4.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}	T4Xo4.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}	T4Xo4.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	T4Xo4.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper.1.6\CLSID	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper\CLSID	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\InprocServer32\ThreadingModel = "Apartment"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper\CurVer\ = "Downlooadd keeper.1.6"	T4Xo4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ProgID	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper\CurVer	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\Programmable	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	T4Xo4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\VersionIndependentProgID	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\DowwnlloaD keepEr"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\VersionIndependentProgID	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper.1.6\CLSID\ = "{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Downlooadd	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper.1.6\ = "DowwnlloaD keepEr"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper\ = "DowwnlloaD keepEr"	T4Xo4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper.Downlooadd	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper.1.6	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeper\CLSID\ = "{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ProgID	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ProgID\ = "Downlooadd keeper.1.6"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\InprocServer32	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}	T4Xo4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\InprocServer32	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\DowwnlloaD keepEr\\JuaU.tlb"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ = "DowwnlloaD keepEr"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\VersionIndependentProgID\ = "Downlooadd keeper"	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\InprocServer32\ = "C:\\ProgramData\\DowwnlloaD keepEr\\JuaU.dll"	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	T4Xo4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	T4Xo4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\Programmable	T4Xo4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	T4Xo4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4388	4656	4a579b82b404dda9baa4565e6701ee87.exe	17
PID 4656 wrote to memory of 4388	4656	4a579b82b404dda9baa4565e6701ee87.exe	17
PID 4656 wrote to memory of 4388	4656	4a579b82b404dda9baa4565e6701ee87.exe	17

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61} = "1"	T4Xo4.exe

C:\Users\Admin\AppData\Local\Temp\4a579b82b404dda9baa4565e6701ee87.exe
"C:\Users\Admin\AppData\Local\Temp\4a579b82b404dda9baa4565e6701ee87.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\00294823\T4Xo4.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/T4Xo4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

T4Xo4.exe

Path C:\Users\Admin\AppData\Local\Temp\00294823\T4Xo4.exe
Size 334KB
SHA256 f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5
MD5 8300c91b40229b42301aebc6d8859907
SHA1 0b55e56a6add6b4dd4ceff475a0018a203d02a5a
SHA512 0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f
SSDEEP 6144:8jTc99/rsv9Et5hDG0SAMs9jkO/jYZRJKTCy1W7nnJdwY:Yo99/rsFEt5hDG0SAMs9jR/jeRJKu9T7
MD5 SHA1 SHA512 SSDEEP

Submit Download

T4Xo4.exe

Path C:\Users\Admin\AppData\Local\Temp\00294823\T4Xo4.exe
Size 92KB
SHA256 43e80bd841ee840d321fc00aaf05d8b1274d2860aee407d956e3df7ff33a105c
MD5 ac22720c569c5178894c02e3d28582a3
SHA1 a946bac539edfea7b6af287e58d8bf111f6d8ce5
SHA512 5f4dca640ee485e5a5ca14222cc46480c1a875a84869996f24d4edad86ff4ade53f53b5399c076680e3b5fc3ef382982750c4b50f0018847c03a5c915853b821
SSDEEP 1536:8JastZp/EIAVlsgoEGNHJPYJPWJmITmhCqsvacfEt5hDG0SAMs9js5arEgSI:8jTcIglLoEGpWYvqsv9Et5hDG0SAMs9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads