d2019c67c287ba0fdce12b9f623736e65bc1bc53cf7acee37411f2a721feba97 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_7eefa384bb45f1c587a6c0b9efdd25b5
Size 634KB
Sample240204-tsbqlseaf5
SHA256 d2019c67c287ba0fdce12b9f623736e65bc1bc53cf7acee37411f2a721feba97
MD5 7eefa384bb45f1c587a6c0b9efdd25b5
SHA1 d1fcf425e417f5cb78c7c71b567b6b830ff6fdc8
SHA512 7e0fee0bafe90bb7759020bf254113f39c125e41aaafd82db8b8773e399d3c3dc23949354330b33eb53d7381869113e030afa0dc248782093e95dd495dcfb0db
SSDEEP 12288:aR3m+y1G4GjeZHkwuPikQ7lKH5p5H9x1geZHkwuliXQTlKB5pixyiR8:aRWvG4GjeZEXi37l6Br1geZEdigTl26i
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_7eefa384bb45f1c587a6c0b9efdd25b5
- Size 634KB
- SHA256 d2019c67c287ba0fdce12b9f623736e65bc1bc53cf7acee37411f2a721feba97
- MD5 7eefa384bb45f1c587a6c0b9efdd25b5
- SHA1 d1fcf425e417f5cb78c7c71b567b6b830ff6fdc8
- SHA512 7e0fee0bafe90bb7759020bf254113f39c125e41aaafd82db8b8773e399d3c3dc23949354330b33eb53d7381869113e030afa0dc248782093e95dd495dcfb0db
- SSDEEP 12288:aR3m+y1G4GjeZHkwuPikQ7lKH5p5H9x1geZHkwuliXQTlKB5pixyiR8:aRWvG4GjeZEXi37l6Br1geZEdigTl26i
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home2393chaction.js
- Size 834B
- SHA256 449ec28778ce36c728d0944793be3b0650b9e79d473b71e8462f7f119eb5ae3a
- MD5 2c3065c9db965b55878cc17418449cea
- SHA1 897eda2f8817978664e89c13fc6ce82e4c7c12af
- SHA512 3735fb9b5e032f6b772a69a655acacd5801d715af78fb0c6deedb04f038086955e690ce6a1395e3e82ad3fca5f4a1bbc695a203b3e4a332d9ab0e9c9f03885e3
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home2393.js
- Size 747B
- SHA256 b6fee172bbbc6dd117174d83ea0c405f9a7df8c60137847f973d5debc790ef97
- MD5 1ef040071d3b86f2acea46a78b9d7db7
- SHA1 718f66d7171950c379956d64fc335c0ef4b29447
- SHA512 ca0675759184bb7d0c3574f9d935aaa429ee9d44a01a779fefd5c388547fea08e40d8d3162e93dae005b8b18c806e6c8855ec9d81f2e692a8ad063c9790f85ba
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home2393ffaction.js
- Size 678B
- SHA256 2358b05487fe814ed430d9fa4fc83b357b1738e2d5da1123b02064a48206c62a
- MD5 7ae80831cf263560b17a994b5cbfd75c
- SHA1 73ca7f97fdc9d299293931409479911594bde079
- SHA512 cc38733000a1c5af26906e65f4e0df8c2a215c5a0680132a64fafa61089e0d14e099049750a274bac5e31bd7f663d436d6fefb00f85304c7017b8b98ab6a8389
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home2393.dll
- Size 85KB
- SHA256 b2b03590b85bcf3f20f122d1ae2189bcb12ad6e0c2862072542dc549c492207f
- MD5 8305af04e859cb3d2024fa461d340699
- SHA1 67f82a7ea03052c499be604c1abce36fd8e46e55
- SHA512 7cc58ffe224057cd4e281377f966904c478a0f003f61c6e84bcdd7deedcba800354584a87c9a25976e9ca19ba759032dd72ab32c400b1aa7405bc1e2e7df49ea
- SSDEEP 1536:e8/1CsEmka04R5RtahrOb8Dkhb2HA9glQIJDZ:p12mka0EtahrO32guaIJD
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 440b458e52ef5af7e2c3447de9a3d2ed3b81b66b131faa4e5cfd9c6ada02e3ee
- MD5 ac26380795ae1a3410ddc372487c88d6
- SHA1 4cdb5ee8f25fab513f1f4cf6004653b4961565ab
- SHA512 27b549f171094519cd6dcc084fdd0a1d9fc01e192198d62fa27bf50ae6d2443168bf218e8634f129b779419ac8fc4928346b440e1149715ef274b2f62c3544da
- SSDEEP 6144:Ee34JMpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1p:8QeZHkwuPikQ7lKH5p5H9x1p
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16