87be75726ef7fe92060437aace68dc50857d43be0a7ddf796ab1da186f46f9c5

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f2e6e3fea8ccd60e2d8fa5ac8249007.dll
Size

273KB
MD5

7f2e6e3fea8ccd60e2d8fa5ac8249007
SHA1

1c23c84fc92e8d9319c73739492b955ed9fdd145
SHA256

87be75726ef7fe92060437aace68dc50857d43be0a7ddf796ab1da186f46f9c5
SHA512

4a97d80205337765e2b92c48ed6fd8bb2d1c0eb944969b29bc987bd2ff0dc7e2c71c72961e2b9a477d8858f905ef5cc08be4b9ca14f7a5bc1f20424c731b3253
SSDEEP

6144:3BMwD29lCtiWtnw61k1w+rg8szt9izE9FJgZ/OWmhVexD88G1jmUY39:RMN5WtnwCKRsXizagdO90m/g

Score

7^/10

adware persistence stealer upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2644-0-0x0000000024820000-0x00000000248DB000-memory.dmp	upx
behavioral1/memory/2644-2-0x0000000024820000-0x00000000248DB000-memory.dmp	upx
behavioral1/memory/2644-4-0x0000000024820000-0x00000000248DB000-memory.dmp	upx
behavioral1/memory/2644-6-0x0000000024820000-0x00000000248DB000-memory.dmp	upx
behavioral1/memory/2644-7-0x0000000024820000-0x00000000248DB000-memory.dmp	upx
behavioral1/memory/2644-441-0x0000000024820000-0x00000000248DB000-memory.dmp	upx
behavioral1/memory/2644-442-0x0000000024820000-0x00000000248DB000-memory.dmp	upx
behavioral1/memory/2644-444-0x0000000024820000-0x00000000248DB000-memory.dmp	upx
behavioral1/memory/2644-445-0x0000000024820000-0x00000000248DB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xsdtginwjacbvc = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\7f2e6e3fea8ccd60e2d8fa5ac8249007.dll\""	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{482FDE96-25B3-85E6-918B-FFC2513C15C6}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{482FDE96-25B3-85E6-918B-FFC2513C15C6}\NoExplorer = "1"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C4AC521-BE73-11EE-B1E2-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412673212"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{482FDE96-25B3-85E6-918B-FFC2513C15C6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{482FDE96-25B3-85E6-918B-FFC2513C15C6}\ = "brincome browser plug-in"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{482FDE96-25B3-85E6-918B-FFC2513C15C6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{482FDE96-25B3-85E6-918B-FFC2513C15C6}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{482FDE96-25B3-85E6-918B-FFC2513C15C6}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7f2e6e3fea8ccd60e2d8fa5ac8249007.dll"	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2644	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2644	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2644	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2644	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2644	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2644	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2644	1728	regsvr32.exe	28
PID 2968 wrote to memory of 2712	2968	iexplore.exe	30
PID 2968 wrote to memory of 2712	2968	iexplore.exe	30
PID 2968 wrote to memory of 2712	2968	iexplore.exe	30
PID 2968 wrote to memory of 2712	2968	iexplore.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7f2e6e3fea8ccd60e2d8fa5ac8249007.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7f2e6e3fea8ccd60e2d8fa5ac8249007.dll
  2⤵
  - Adds Run key to start application
  - Installs/modifies Browser Helper Object
  - Maps connected drives based on registry
  - Modifies registry class
  PID:2644

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eda64dcd66d0a189082b74819a96826

SHA1
8505cf8bd5f41b5593276893b93744423affcb2a

SHA256
d87f35bb75b56b1b864f8e5e794c60a972b665619044c176755913f9b2c9645b

SHA512
3ba1034723c6fd66737b7e761c0ab02eff79db05f018cd7c21f225fc135e15328bc95f4b3390663e673a23526b5808bb95a94698cb88cdb57b971b33fba5f909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b84d762032474206acbe506112a421

SHA1
87fcc2a959d0b71f724b69d1b99905a53b6cf985

SHA256
e1c1982458e3b4cc08f087b541aaa03b0d0b9375f8b46f65ee17c16ab7761a35

SHA512
b83cec86b5746565c12486f6238be6e3d804d1ed9a7e046cb74ae237bd3347454bf7da9ca699e8af7321b9877bfdacc6421bfd8a2751505d454e0df98c5433a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db2add356f2a351426869f2c898fcf8e

SHA1
b535218210defbf3aab116aa812ecbe18d20255d

SHA256
25d1e73398034f8c32dd7e25442b08ff022b993f894ccf5fb9dae1d869a65d96

SHA512
89e7a512c780d5c2e52ccb458b176d16caf2fc7a2ebef216e74e38dcba937c7f868a19e152020fd2f6144b31193f1b9f0289346638d8a1e1c67670be09d1f06d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fade95cc5549f1b6c0dcbc6587f22e04

SHA1
a3dc85e562ed36919a4c305eaeb8ac4212af0405

SHA256
43e6ae4dfbba582bb6a63192456acef08965600c08ec313c5ea4024286a0c173

SHA512
a8f805b80a714ef8d0358574cfaa8d715582293d97ec4480751c29730574ca0a9d0e2e73e93cb61dbb51dbd23607f378a445fa278b02c6fce7b572f902c6e758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de9f7db58951aca8396f0c2762d90208

SHA1
cb07af6324d07c26833635d35f2b45fd74e3a1d0

SHA256
bc7ddc5dea51b19f65fa17d29a7bbd3310ee7837ba2a5e3f08359319aa30a56d

SHA512
1844e76c455dd566a06065b2e64b174ac8ea945c83c674a4e2ae9f8890c7a1710ed185069e714ef34ca414a9d5dca474403e5fff5ffbed846e11b9612e928bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8672ff84e8ed40297804c45aec56ff7

SHA1
d6923988f9e61f138fece9ad94c3e083777a1c6e

SHA256
19400742770ce822685cb138fdeb9cfc7744e3e4f0f0771d372bd3c2f10e97d8

SHA512
e5aa560afccdf42406cde00963f4289568fb733795db92aa2a44c21fe61ebc80c8c5a2c2281ff3ad3e976873e712b9d12eff3defbfd2c039af12cab66fbcfcf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc376d3bec1dc470aced6c176463e4f

SHA1
ae6ac37b3344328293777452a1077c4666eaa364

SHA256
e3444a7b4ecc549458f7a4af822cbe71de08eafe8f4a395fdc18c074dc52b564

SHA512
33572569bbda4da98c97f474dc95d2115e78c86b820928c816679cd1d15841467481952f911bf2c4be422e7d8c75cf7ad6971374b3f25868c2c5b0cf7b66a90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3673ef67797e721403907efe0e4a4028

SHA1
9f88567a7d90cf7e8e1d5981cd423b35df16e928

SHA256
91add76656e9bf305a555f14462b5ef27b02e25ce24a24323715d2a1eea7e0a7

SHA512
7cd39d1efbe84cf5bbe14932c72912b9d2b993c77411fe217937300f9ba844323b91d5aaced805383449b8a121c30ef65a8dddb85f8f18e982a7d00959abe716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7a090f3a35039bef4aa8d07231e730

SHA1
1835e09465414a3324b584ee7dc1e6b194b7d29f

SHA256
d8902fa375f2e4278e815cb83cd2205be09b0156494c6176859261f37ba5d307

SHA512
fffd9414eb91b3cb6545c219010358199b2b28c4ef659a2d2b707334e30be10ecf845cd113a510592d6ca0e2a818069753dd8fa46e8332740d392a12fbecba22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08a9306c49817d8e949b417e99d6bfe7

SHA1
5317a56bc4f6824f517438c9ce4b483c10f18174

SHA256
b6eb52719978c635bb946fd480d9a4893e2534865798ad613d14f8c0d0c7f96d

SHA512
cde6e4cc598725bcbdfbb2a12bad5ee8316f566ecea3ca0379632263090447bba774f4bc874d396ab00198d34fcb38b78bf1c854b3d08f2456a3d59e226009c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c9701aa771efd2a54ee4aa63060304

SHA1
0e4cbf97bb9f63b188e38a9073c00c4bf4027a1a

SHA256
fa2202d11b4808f74e3df756adda82c410df75c874ef603a315a24e98369b931

SHA512
f0df05db0b1f4f0a2ea3e3c15dc6b1ebebe7464dabaa2d91f47ff2024b2b981f1c84ac57cad6a6cc7c699119a32272e3462b866e17adf8314239938d56fe9b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5BB7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C89.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2644-0-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download
memory/2644-7-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download
memory/2644-6-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download
memory/2644-4-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download
memory/2644-2-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download
memory/2644-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2644-441-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download
memory/2644-442-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download
memory/2644-444-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download
memory/2644-445-0x0000000024820000-0x00000000248DB000-memory.dmp

Filesize
748KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads