2eeb0679d6f277074cd115ea462c110c56c68134027330097f3b5c5a3237a959

General

Target

8fa3d0be26fb0078bea9668053a2278e.exe
Size

1008KB
MD5

8fa3d0be26fb0078bea9668053a2278e
SHA1

9f7a61325107bff5f2ac2dc5e9086ec618d970bf
SHA256

2eeb0679d6f277074cd115ea462c110c56c68134027330097f3b5c5a3237a959
SHA512

51ce166d7b00dfd03e8a6735ea9489f6efc79f397e109e91ff980fa49bc864cf41841aaf1882d938ad5f52841ab06376097efe5e1545d83f0339776ade93ce03
SSDEEP

12288:sc4+Lnk67JtN5M9UeGFpNFQfQ+1XNyDTzA8GrSHEU3cRuwjQKd9NIXRHQMDhbnxF:pdDxofGYfQ+9EnBGrSkVu102RHQkhbn

Score

7^/10

adware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	8fa3d0be26fb0078bea9668053a2278e.exe

Loads dropped DLL 1 IoCs

pid	Process
2176	Regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}	Regsvr32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~1\fx678Toolbar\fx678Toolbar.dll	8fa3d0be26fb0078bea9668053a2278e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ime\SPTIPIMERS.ini	8fa3d0be26fb0078bea9668053a2278e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.m4455.com"	8fa3d0be26fb0078bea9668053a2278e.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	8fa3d0be26fb0078bea9668053a2278e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}\InprocServer32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fx678Toolbar.ShowBarEx	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fx678Toolbar.ShowBarEx\Clsid\ = "{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	8fa3d0be26fb0078bea9668053a2278e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fx678Toolbar.ShowBarEx\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fx678Toolbar.ShowBarEx\Clsid	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	8fa3d0be26fb0078bea9668053a2278e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}\ProgID\ = "fx678Toolbar.ShowBarEx"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	8fa3d0be26fb0078bea9668053a2278e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}\InprocServer32\ = "C:\\PROGRA~1\\FX678T~1\\FX678T~1.DLL"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}\ProgID	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	8fa3d0be26fb0078bea9668053a2278e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2176	2708	8fa3d0be26fb0078bea9668053a2278e.exe	88
PID 2708 wrote to memory of 2176	2708	8fa3d0be26fb0078bea9668053a2278e.exe	88
PID 2708 wrote to memory of 2176	2708	8fa3d0be26fb0078bea9668053a2278e.exe	88
PID 2708 wrote to memory of 4232	2708	8fa3d0be26fb0078bea9668053a2278e.exe	91
PID 2708 wrote to memory of 4232	2708	8fa3d0be26fb0078bea9668053a2278e.exe	91
PID 2708 wrote to memory of 4232	2708	8fa3d0be26fb0078bea9668053a2278e.exe	91

C:\Users\Admin\AppData\Local\Temp\8fa3d0be26fb0078bea9668053a2278e.exe
"C:\Users\Admin\AppData\Local\Temp\8fa3d0be26fb0078bea9668053a2278e.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s C:\PROGRA~1\fx678Toolbar\fx678Toolbar.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DelTemp.bat" "
  2⤵
  PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\fx678Toolbar\fx678Toolbar.dll

Filesize
574KB

MD5
923512e3c24ab8c1bae00c8651517f62

SHA1
4946a5ac59527f210f9bb63584d2b75935304653

SHA256
531ab7f4453e2807d9bcd242dc5f8d94780499932b14c10b6009c36d9dec4f21

SHA512
2ef5bfea63e515598d30bf128acda0713fdf2e32f10003b97a9d719cd2cb1494ac5f91983b69099178c6b4593e689738d47aa277aa55a3f59f0b35d649d6ba67

Download Submit
C:\Users\Admin\AppData\Local\Temp\DelTemp.bat

Filesize
123B

MD5
b12493931e5294e78df99889cf3ab3ce

SHA1
d7da714fb97888d8a8cac64e220e410c380d461e

SHA256
661eada4df31a24144e47949d7c3e9406a06b9339af09d64912dce199373d02e

SHA512
7089e09c695c6901886bca32104d1c67e65572489fa63f60ca99a14b29dd41675871c3a31249bcf109f7fc3640dc9b39027f1132820923d9a2bc7cecad9b1f05

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Æô¶¯ Internet Explorer ä¯ÀÀÆ÷.url

Filesize
103B

MD5
534bb0175e95a0aae130995e507d5e05

SHA1
295077632d9815e4af4c30718f4534133a45b5b5

SHA256
cfa730e16a89744189ce9f198e27843c1063fbce23722e73f7e72dca23221ead

SHA512
df7ce3ee1c8ae3b8b2142e5929b4ab4b3a4c0a5dfab030baa26b18f0d81a310a3b48664ae148dfd02f4aa6d07d37c625ae29571c361997e88fe03323cfbdbf51

Download Submit
memory/2708-1-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/2708-26-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads