eddddf85c2a6f9fa9e65163d7e020c08a3dc438b2d00d46919e998936d183c65

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4d013b3b1e327cc9582acc74f65ac150.exe
Size

32KB
MD5

4d013b3b1e327cc9582acc74f65ac150
SHA1

6f803ae0c715fbe22aed55e50c59d7fb351017a4
SHA256

eddddf85c2a6f9fa9e65163d7e020c08a3dc438b2d00d46919e998936d183c65
SHA512

1d35af44de5e7208aec3b396c9691b9393842a3c9fc0f445dad9554078b15fd29516611a788cdb32cec48be26048505c84316f65d82be4c0fc850bf069a9fbdc
SSDEEP

768:pp315yV9XsO0d9PIzAeDnGFv77APKsmVciNS8C4:pBWHH0dG0ebE7iKAj8C4

Score

8^/10

adware persistence stealer upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
2696	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2136-9-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/2136-1-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	4d013b3b1e327cc9582acc74f65ac150.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	4d013b3b1e327cc9582acc74f65ac150.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mmmsczsc.dll	4d013b3b1e327cc9582acc74f65ac150.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar	4d013b3b1e327cc9582acc74f65ac150.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2696	2136	4d013b3b1e327cc9582acc74f65ac150.exe	29
PID 2136 wrote to memory of 2696	2136	4d013b3b1e327cc9582acc74f65ac150.exe	29
PID 2136 wrote to memory of 2696	2136	4d013b3b1e327cc9582acc74f65ac150.exe	29
PID 2136 wrote to memory of 2696	2136	4d013b3b1e327cc9582acc74f65ac150.exe	29

C:\Users\Admin\AppData\Local\Temp\4d013b3b1e327cc9582acc74f65ac150.exe
"C:\Users\Admin\AppData\Local\Temp\4d013b3b1e327cc9582acc74f65ac150.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c preved.bat
  2⤵
  - Deletes itself
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\preved.bat

Filesize
215B

MD5
86d9502f464fea85f6d483e201f3506d

SHA1
ae851aa1f938974584b93c4f905e16c6e76b2920

SHA256
d76380da75079449882acfb99accfb86f4de704bafb4757461e95164720f441b

SHA512
fd1825c25262a18dccdfced91be0eb27a958b4c273823edef320c2a989be6db233d99abbc745324f983ef8052cda8f1cba5b65293d484571d8ffb044574eb69f

Download Submit
memory/2136-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2136-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads