28b4cfb40267d9ccfa07b6be024fa8404f73f116bd4da24c7f4735b5887be773

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89ad5a598d1f9d1bafe86be2162d6350.exe
Size 235KB
Sample240202-q6fd6shhap
SHA256 28b4cfb40267d9ccfa07b6be024fa8404f73f116bd4da24c7f4735b5887be773
MD5 89ad5a598d1f9d1bafe86be2162d6350
SHA1 5e80fe86d4b74a7ec65e56c4771e2d294fed8808
SHA512 d5c60e1233c10843c590885567d1417f9b58ac5a219c230e6ad51622d1255d562dbe87de27b14fb7abab64aad2897ee85e70afbf037905c1d5ffa57651b84c83
SSDEEP 3072:HJg+0OybGCkJd19huDI3oj7wbEzrBj8IsbSAkPCKXtzeq8ar5bt53x1Va8AgV7R:pgweHuADCI8S/L9zLv
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gbpdist\ImagePath = "\"C:\\WINDOWS\\system32\\gbpservice.exe\""	89ad5a598d1f9d1bafe86be2162d6350.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	89ad5a598d1f9d1bafe86be2162d6350.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}	89ad5a598d1f9d1bafe86be2162d6350.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	2976	WerFault.exe	86

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32	89ad5a598d1f9d1bafe86be2162d6350.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	89ad5a598d1f9d1bafe86be2162d6350.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	89ad5a598d1f9d1bafe86be2162d6350.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}	89ad5a598d1f9d1bafe86be2162d6350.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32\ = "C:\\WINDOWS\\SysWow64\\GbpDist.dll"	89ad5a598d1f9d1bafe86be2162d6350.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32\ThreadingModel = "Apartment"	89ad5a598d1f9d1bafe86be2162d6350.exe

C:\Users\Admin\AppData\Local\Temp\89ad5a598d1f9d1bafe86be2162d6350.exe
"C:\Users\Admin\AppData\Local\Temp\89ad5a598d1f9d1bafe86be2162d6350.exe"
1⤵
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 724
  2⤵
  - Program crash
  PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2976 -ip 2976
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads