aec7d3254663753493cc816f6064fd39c6eaa477e9fe1af715480c4c2aee8112

Analysis

max time kernel
147s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55589f0ba31caeb1506b805768840749.exe
Size 1.5MB
Sample240112-dv16aadffq
SHA256 aec7d3254663753493cc816f6064fd39c6eaa477e9fe1af715480c4c2aee8112
MD5 55589f0ba31caeb1506b805768840749
SHA1 be7a0fa20dec57b9b94efb533e23a513547e3981
SHA512 a6484eeb0eeadd1e16f1ddd33e130f7a8194da2a68236d6178f5bb404fdc45b2e2fc6c615e045d10c013d9d9a745beebc1cfe70d78b3c9724d397849cbe47078
SSDEEP 49152:68Gl0svU8HLuBX2sdu7c/WJdHhZZ39MT4Xq:68Y0svHLuBX2SuY/WJ5t3924Xq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2420	dnt-firstlook-sntb.exe
2092	dnt-firstlook-sntb.exe
2808	ispassistant-bho-setup.exe

Loads dropped DLL 64 IoCs

pid	Process
1708	55589f0ba31caeb1506b805768840749.exe
1708	55589f0ba31caeb1506b805768840749.exe
1708	55589f0ba31caeb1506b805768840749.exe
1708	55589f0ba31caeb1506b805768840749.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\StartNowToolbarHelper = "\"C:\\Program Files (x86)\\StartNow Toolbar\\ToolbarHelper.exe\""	dnt-firstlook-sntb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}\ = "StartNow Toolbar Helper"	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ToolbarUpdaterService.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\constants.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\netutils.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome.manifest	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\uninstall.exe	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome.manifest	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\events.js	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\netutils.js	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\searcher.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\searcher.xul	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\ispassistant.dll	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\searcher.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\events.js	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\constants.js	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\searcher.xul	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\utils.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\chrome\content\utils.js	ispassistant-bho-setup.exe
File opened for modification	C:\Program Files (x86)\IspAssistant Addon\xpi\install.rdf	ispassistant-bho-setup.exe
File created	C:\Program Files (x86)\IspAssistant Addon\xpi\install.rdf	ispassistant-bho-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral1/files/0x00070000000146b5-14.dat	nsis_installer_1
behavioral1/files/0x00070000000146b5-14.dat	nsis_installer_2
behavioral1/files/0x00070000000146b5-17.dat	nsis_installer_1
behavioral1/files/0x00070000000146b5-17.dat	nsis_installer_2
behavioral1/files/0x00070000000146b5-18.dat	nsis_installer_1
behavioral1/files/0x00070000000146b5-18.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\lastFFToolbarDisabledTimeL = "1592678736"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	ispassistant-bho-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\lastFFToolbarDisabledTimeH = "31081734"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\AutoSearch = "0"	ispassistant-bho-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar	ispassistant-bho-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0B778685-E426-F581-3E23-25863083650B}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={Language}&form=IE8SSC&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}"	dnt-firstlook-sntb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}\DisplayName = "Bing"	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{5911488E-9D1E-40ec-8CBB-06B231CC153F} = "StartNow Toolbar"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EE47E41-B0F9-11EE-A2F4-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411191536"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	dnt-firstlook-sntb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\MonitorSearchChanges = "0"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0B778685-E426-F581-3E23-25863083650B}\URL = "http://www.bing.com/search?q={searchTerms}&pc=Z153&form=ZGAIDF&install_date=20240112&iesrc={referrer:source}"	dnt-firstlook-sntb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\saveFFToolbarDisabledState = "1"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\MonitorHomepageChanges = "0"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0B778685-E426-F581-3E23-25863083650B}"	dnt-firstlook-sntb.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F5B8301-B0F9-11EE-A2F4-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\StartNow Toolbar\MonitorSearchChanges = "0"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607cb2760645da01	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.msn.com/?pc=Z153&install_date=20240112"	dnt-firstlook-sntb.exe

Modifies data under HKEY_USERS 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\WpadDecisionReason = "1"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-b2-fc-d7-e5-21\WpadDecision = "0"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\MonitorHomepageChanges = "0"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-b2-fc-d7-e5-21	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\MonitorSearchChanges = "0"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\WpadDecision = "0"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ToolbarUpdaterService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ToolbarUpdaterService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-b2-fc-d7-e5-21\WpadDecisionTime = 406c85600645da01	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\lastUpdateErrorTimeH = "31081734"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ToolbarUpdaterService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\WpadDecisionTime = 406c85600645da01	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\3e-b2-fc-d7-e5-21	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ToolbarUpdaterService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}\WpadNetworkName = "Network 3"	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\lastUpdateErrorTimeL = "1620598736"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ToolbarUpdaterService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CAF4FC5-ADEE-423B-A27B-B402D5DA2E10}	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry	ToolbarUpdaterService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER	ToolbarUpdaterService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-b2-fc-d7-e5-21\WpadDecisionReason = "1"	ToolbarUpdaterService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}\ = "Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ = "IBandObject"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject\CurVer = "Toolbar.BandObject.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\CLSID = "{6E13D095-45C3-4271-9475-F3B48227DD9F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DA1E850-9F71-4B3C-81A4-D9EEEF6FCD50}	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DA1E850-9F71-4B3C-81A4-D9EEEF6FCD50}\ = "IspAssistant Add-on"	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject.1\ = "BandObject Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1B1E911-0191-409E-81D2-C0BAECE1A380}\prod = "IspAssistant"	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\ = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\ = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1\CLSID = "{6E13D095-45C3-4271-9475-F3B48227DD9F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\Programmable\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\StartNow Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ = "IToolbarHelperObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1B1E911-0191-409E-81D2-C0BAECE1A380}	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\VersionIndependentProgID = "Toolbar.BandObject"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1\ = "ToolbarHelperObject Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\ = "ToolbarHelperObject Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Toolbar.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Toolbar.DLL\AppID = "{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject\ = "BandObject Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject\CLSID = "{5911488E-9D1E-40ec-8CBB-06B231CC153F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\ = "StartNow Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\CurVer = "Toolbar.ToolbarHelperObject.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\ = "Toolbar 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\TypeLib = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ = "IToolbarHelperObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DA1E850-9F71-4B3C-81A4-D9EEEF6FCD50}\InProcServer32\ThreadingModel = "Apartment"	ispassistant-bho-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\TypeLib = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0\win32\ = "C:\\Program Files (x86)\\StartNow Toolbar\\Toolbar32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\VersionIndependentProgID = "Toolbar.ToolbarHelperObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\ProgID = "Toolbar.BandObject.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\ = "StartNow Toolbar Helper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DA1E850-9F71-4B3C-81A4-D9EEEF6FCD50}\InProcServer32	ispassistant-bho-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib\ = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe
2420	dnt-firstlook-sntb.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1116	iexplore.exe
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1116	iexplore.exe
1116	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2516	iexplore.exe
2516	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2420	1708	55589f0ba31caeb1506b805768840749.exe	28
PID 1708 wrote to memory of 2420	1708	55589f0ba31caeb1506b805768840749.exe	28
PID 1708 wrote to memory of 2420	1708	55589f0ba31caeb1506b805768840749.exe	28
PID 1708 wrote to memory of 2420	1708	55589f0ba31caeb1506b805768840749.exe	28
PID 1708 wrote to memory of 2092	1708	55589f0ba31caeb1506b805768840749.exe	29
PID 1708 wrote to memory of 2092	1708	55589f0ba31caeb1506b805768840749.exe	29
PID 1708 wrote to memory of 2092	1708	55589f0ba31caeb1506b805768840749.exe	29
PID 1708 wrote to memory of 2092	1708	55589f0ba31caeb1506b805768840749.exe	29
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1708 wrote to memory of 2808	1708	55589f0ba31caeb1506b805768840749.exe	35
PID 1116 wrote to memory of 2484	1116	iexplore.exe	37
PID 1116 wrote to memory of 2484	1116	iexplore.exe	37
PID 1116 wrote to memory of 2484	1116	iexplore.exe	37
PID 1116 wrote to memory of 2484	1116	iexplore.exe	37
PID 1708 wrote to memory of 2516	1708	55589f0ba31caeb1506b805768840749.exe	39
PID 1708 wrote to memory of 2516	1708	55589f0ba31caeb1506b805768840749.exe	39
PID 1708 wrote to memory of 2516	1708	55589f0ba31caeb1506b805768840749.exe	39
PID 1708 wrote to memory of 2516	1708	55589f0ba31caeb1506b805768840749.exe	39
PID 2516 wrote to memory of 2236	2516	iexplore.exe	40
PID 2516 wrote to memory of 2236	2516	iexplore.exe	40
PID 2516 wrote to memory of 2236	2516	iexplore.exe	40
PID 2516 wrote to memory of 2236	2516	iexplore.exe	40

C:\Users\Admin\AppData\Local\Temp\55589f0ba31caeb1506b805768840749.exe
"C:\Users\Admin\AppData\Local\Temp\55589f0ba31caeb1506b805768840749.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe
  "dnt-firstlook-sntb.exe" /CHANNEL=US728 /OFFERED /TOOLBAR /DEFAULTSTART /DEFAULTSEARCH
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe
  "dnt-firstlook-sntb.exe" /RETURNSTATUS /CHANNEL=US728 /TOOLBAR /DEFAULTSEARCH /DEFAULTSTART
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2092
- - C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
    "C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --install
    3⤵
    - Modifies Internet Explorer settings
    PID:3020
- - C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
    "C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --start
    3⤵
    - Modifies Internet Explorer settings
    PID:1100
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /i /s "C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll"
    3⤵
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:2412
- C:\Users\Admin\AppData\Local\Temp\ispassistant-bho-setup.exe
  "ispassistant-bho-setup.exe" -d 5
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2808
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://pornclips69.com/?tmp=adultvideo
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2236

C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
"C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
PID:1324

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact