28b4cfb40267d9ccfa07b6be024fa8404f73f116bd4da24c7f4735b5887be773

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89ad5a598d1f9d1bafe86be2162d6350.exe
Size 235KB
Sample240202-q6fd6shhap
SHA256 28b4cfb40267d9ccfa07b6be024fa8404f73f116bd4da24c7f4735b5887be773
MD5 89ad5a598d1f9d1bafe86be2162d6350
SHA1 5e80fe86d4b74a7ec65e56c4771e2d294fed8808
SHA512 d5c60e1233c10843c590885567d1417f9b58ac5a219c230e6ad51622d1255d562dbe87de27b14fb7abab64aad2897ee85e70afbf037905c1d5ffa57651b84c83
SSDEEP 3072:HJg+0OybGCkJd19huDI3oj7wbEzrBj8IsbSAkPCKXtzeq8ar5bt53x1Va8AgV7R:pgweHuADCI8S/L9zLv
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\gbpdist\ImagePath = "\"C:\\WINDOWS\\system32\\gbpservice.exe\""	89ad5a598d1f9d1bafe86be2162d6350.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	89ad5a598d1f9d1bafe86be2162d6350.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}	89ad5a598d1f9d1bafe86be2162d6350.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	2908	WerFault.exe	27

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32	89ad5a598d1f9d1bafe86be2162d6350.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	89ad5a598d1f9d1bafe86be2162d6350.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	89ad5a598d1f9d1bafe86be2162d6350.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}	89ad5a598d1f9d1bafe86be2162d6350.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32\ = "C:\\WINDOWS\\SysWow64\\GbpDist.dll"	89ad5a598d1f9d1bafe86be2162d6350.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32\ThreadingModel = "Apartment"	89ad5a598d1f9d1bafe86be2162d6350.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2160	2908	89ad5a598d1f9d1bafe86be2162d6350.exe	28
PID 2908 wrote to memory of 2160	2908	89ad5a598d1f9d1bafe86be2162d6350.exe	28
PID 2908 wrote to memory of 2160	2908	89ad5a598d1f9d1bafe86be2162d6350.exe	28
PID 2908 wrote to memory of 2160	2908	89ad5a598d1f9d1bafe86be2162d6350.exe	28

C:\Users\Admin\AppData\Local\Temp\89ad5a598d1f9d1bafe86be2162d6350.exe
"C:\Users\Admin\AppData\Local\Temp\89ad5a598d1f9d1bafe86be2162d6350.exe"
1⤵
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 400
  2⤵
  - Program crash
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads