905c47e009a30d6bf9b695f728d8b61d7a83f077c2dc7e12beb6731a373f7522 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_76d3df5c84f7fc8f5638e4e58b0f1353
Size 634KB
Sample240204-pdpxgaghb4
SHA256 905c47e009a30d6bf9b695f728d8b61d7a83f077c2dc7e12beb6731a373f7522
MD5 76d3df5c84f7fc8f5638e4e58b0f1353
SHA1 a2162b800dad460e71a33c480690b1aaa3f1ed93
SHA512 7a39381dd98f463b24c15a16ffce146c38f53ec6196c3e3d101fc57ca86daea7e9308d3ec8a6dacc71e1c520235a1e2020714803354f3bd74727a28d384783bd
SSDEEP 12288:nnb2tG4GjeZHkwuPikQ7lKH5p5H9x1veZHkwu5iRQFlKd5pDCsQz7PYB:nytG4GjeZEXi37l6Br1veZExi2Fle7Ca
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_76d3df5c84f7fc8f5638e4e58b0f1353
- Size 634KB
- SHA256 905c47e009a30d6bf9b695f728d8b61d7a83f077c2dc7e12beb6731a373f7522
- MD5 76d3df5c84f7fc8f5638e4e58b0f1353
- SHA1 a2162b800dad460e71a33c480690b1aaa3f1ed93
- SHA512 7a39381dd98f463b24c15a16ffce146c38f53ec6196c3e3d101fc57ca86daea7e9308d3ec8a6dacc71e1c520235a1e2020714803354f3bd74727a28d384783bd
- SSDEEP 12288:nnb2tG4GjeZHkwuPikQ7lKH5p5H9x1veZHkwu5iRQFlKd5pDCsQz7PYB:nytG4GjeZEXi37l6Br1veZExi2Fle7Ca
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home269chaction.js
- Size 829B
- SHA256 164f9c57db3b97808ee54f151a96b54c68a740cc3be40a5958b8a25565980656
- MD5 63b787a210051972368c1cd9e1d46090
- SHA1 1d1e20b7a7f032f629a63eddd4de350759342bf5
- SHA512 96c2d0d444cbf36bedf8ee3c0dbec8a4f6aec9b19cf80420a1d8f8135ae77c14c080edf8f313a9ec9e9ac60019832db505fea4ee3359a1214bf1cdb6e2b79879
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home269.js
- Size 744B
- SHA256 7a2f0dd220e22b3dd0d025be57dc13ff6cc62886f030455b13d4cfbea97a2b28
- MD5 32069840b437b156793a3e5db8822c2d
- SHA1 b159134d01163b8709ecde322dae7a85c6552718
- SHA512 a92ff852198a1ad111e45be9e35d670a2978dfafbb3d2448555d0c88fe626e619918965dc9b0cf434571f246b6b83d0f2c13479b45efda1e5c5f3693d76e8524
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home269ffaction.js
- Size 674B
- SHA256 04d5f6eaab880c858124a1738fb3a99566f38d40fd9d9a9aed69a2ad251b42d3
- MD5 4e65dcee102534af3d79738d5fc1f4d7
- SHA1 03a3463872dbdb9038ccbf4cd12e0a3ac3f9ef8f
- SHA512 3817294c6fb88335b3ffdb14325b9b99057c0b0ae7aed581294c26764b2e78eace0ef8f1b5c61dfe2434d7bc0dfa7608a50c356b036f16a7ac69d65cf150f3b5
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home269.dll
- Size 85KB
- SHA256 c270f577833cbf3b2c406ab85fedfc00c62ff27e413fc8f05c4b7fd880864f09
- MD5 163ef0c2707b6cb76f068444ee69c5c6
- SHA1 4bf20b4d0af53acf15c71d32701fb3a8bacc5903
- SHA512 4af09f333cc07ed95d782677007446c0d211247cbb6454c3af2cc91e68b2894c0628e230e600e8999ce9dc2a024220514faa97aef2225127a0eced75e3aee8e9
- SSDEEP 1536:13flScQkGMA5tasrOb8Dk98RHgNglQj0Et:9likGMAbasrOwRA+aj0g
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 425cabefb9613e9d98f678ae4a473b0a9c6c5098d9764b8447441669683519b7
- MD5 944a90d9fb8c81ab35c26e15e90aa7f2
- SHA1 e4fc1cf97d11d52bffbf9bb4c992ade069bd1e42
- SHA512 111ea8f9da8f6c08b6d36b741c7d28343ff42b2ca6d8432233a1c91f8940bd9e1a5ef630b961698b6413dc7e865a86f7ec22b1300d9cb3e78288f47add3fa0b5
- SSDEEP 6144:Ee34YspeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1b:NweZHkwuPikQ7lKH5p5H9x1b
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16