3efc4518a663cc15ee2022ec284fbcf7ce41a562ce45c2380e6c1cf9822edaab

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f9cc18d3743f189e0702d941c4423da.exe
Size 866KB
Sample240204-tvnsysgcar
SHA256 3efc4518a663cc15ee2022ec284fbcf7ce41a562ce45c2380e6c1cf9822edaab
MD5 8f9cc18d3743f189e0702d941c4423da
SHA1 249578de07ac2ec3ffc2ffd400e0a4f72afff0bc
SHA512 ba04fb24288772d2ff625555674d62a4723389fc892aa5c1e01553aabcdc18c1342aa0c9dccb4d4cf58963359550749c26b6472eeeee2efda33c8271909c053d
SSDEEP 24576:38GwXmL0hk0v0XW/xVfCyHH1VQJxhGjS0:38Jhkw/xVfCy1iJeO0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	8f9cc18d3743f189e0702d941c4423da.exe

Executes dropped EXE 2 IoCs

pid	Process
4756	setup2.exe
5104	setup1.exe

Loads dropped DLL 1 IoCs

pid	Process
4756	setup2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5E2402A0-5F99-4188-B30D-D8743996B340}\ = "LuckyTender"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5E2402A0-5F99-4188-B30D-D8743996B340}	setup2.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LuckyTender\1.3.0\LuckyTender.dll	setup2.exe
File created	C:\Program Files (x86)\LuckyTender\uninst.exe	setup2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000023212-6.dat	nsis_installer_1

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\NumMethods\ = "7"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\0	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\InProcServer32\ = "C:\\Program Files (x86)\\LuckyTender\\1.3.0\\LuckyTender.dll"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ProxyStubClsid32	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\NumMethods	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\NumMethods\ = "11"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\HELPDIR	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ = "ISliderShowCtrl"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ = "ISliderWindowAx"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\InProcServer32	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl\CurVer\ = "SliderShow.SliderShowCtrl.1"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32\ = "{3794345D-C731-4FBB-8471-73DDC8DFFDD2}"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\VersionIndependentProgID	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ = "ISliderShowCtrl"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib\Version = "1.0"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib\Version = "1.0"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\ = "SliderShowCtrl Class"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\NumMethods	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\LuckyTender\\1.3.0\\"	setup2.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\WOW6432Node\Interface	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\ = "SliderShow 1.0 Type Library"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl.1\CLSID	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl\ = "SliderShowCtrl Class"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl\CLSID\ = "{5E2402A0-5F99-4188-B30D-D8743996B340}"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl\CurVer	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\ProxyStubClsid32\ = "{3794345D-C731-4FBB-8471-73DDC8DFFDD2}"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7656BFE4-2AAE-4E04-98B6-5912E99FBE38}	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl.1\CLSID\ = "{5E2402A0-5F99-4188-B30D-D8743996B340}"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\TypeLib	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ = "ISliderWindowAx"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl.1	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl.1\ = "SliderShowCtrl Class"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\FLAGS	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\FLAGS\ = "0"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ProxyStubClsid32	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\ = "ISliderWindow"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7656BFE4-2AAE-4E04-98B6-5912E99FBE38}\ = "SliderShow"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\ProgID\ = "SliderShow.SliderShowCtrl.1"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\0\win32	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\ = "PSFactoryBuffer"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\ProxyStubClsid32	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SliderShow.DLL	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\VersionIndependentProgID\ = "SliderShow.SliderShowCtrl"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}"	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}	setup2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\Programmable	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\0\win32\ = "C:\\Program Files (x86)\\LuckyTender\\1.3.0\\LuckyTender.dll"	setup2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4756	2740	8f9cc18d3743f189e0702d941c4423da.exe	84
PID 2740 wrote to memory of 4756	2740	8f9cc18d3743f189e0702d941c4423da.exe	84
PID 2740 wrote to memory of 4756	2740	8f9cc18d3743f189e0702d941c4423da.exe	84
PID 2740 wrote to memory of 5104	2740	8f9cc18d3743f189e0702d941c4423da.exe	85
PID 2740 wrote to memory of 5104	2740	8f9cc18d3743f189e0702d941c4423da.exe	85
PID 2740 wrote to memory of 5104	2740	8f9cc18d3743f189e0702d941c4423da.exe	85

C:\Users\Admin\AppData\Local\Temp\8f9cc18d3743f189e0702d941c4423da.exe
"C:\Users\Admin\AppData\Local\Temp\8f9cc18d3743f189e0702d941c4423da.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup2.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Modifies registry class
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup1.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup1.exe"
  2⤵
  - Executes dropped EXE
  PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LuckyTender.dll

Path C:\Program Files (x86)\LuckyTender\1.3.0\LuckyTender.dll
Size 184KB
SHA256 ff68a2096413a90a3505610353307a88355e1f34d9417acdd4f2d4855db33b62
MD5 fbbd36fc9f5de933753a1b855944e04a
SHA1 6aff38e2228f86233e103da286381da37feff0ce
SHA512 7bc90a7084cfeb60d6abe4c4d4ac641c9b65fd477c8d57c5b4fa0d84b9a797b6c4b207b5ac9fb503b42b12212dbefc9507eddf73ef984eb2d4a9cf6b064dbace
SSDEEP 3072:+Do4Ch2AX5sdO3snudT5X/sX2gvZbVGBahJVj8lr2W4tlpSR8:corhWO3j/Bg/j8pkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup1.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup1.exe
Size 1.7MB
SHA256 b58d68b9c4488c7a2137582ae26c7e743f8a8c1bbbef1f9f1cd9f8a03f03ccdd
MD5 6eb8b23d51279bb8585fc88731001d80
SHA1 b993ba10af96d7db79ec4fd4771511d880255604
SHA512 74683daefdc3095fe298dcfe0b7596fd91526f4281974f14bf39c04f0e19343e3792b34c114d4c8bcc418b7b5d9cdc201eebe06538347337abcb1231af60ef0a
SSDEEP 49152:4xTqr2oFslOQ7z0oNutuEXsbwF46U87M:4kPFslOWAv5BM
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup2.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup2.exe
Size 148KB
SHA256 bd0bd14950691bbbd1a8c791b6cecc0136b7f361d3d3617f97ab8aec4bfaee8e
MD5 5b4a528aff5726712c3c4714492fc71a
SHA1 e60a68d8ffb33a81957199e7fa2720a5b74c6ae0
SHA512 11cae2ad6dc83762c48d30703f0e404d7c708c2c19eb58d32ab557474271c816b08141ffd7588fc0b220728ed00d8e4c1a287becf9451bdcce3d201c098179b9
SSDEEP 3072:5mEaomoD6kJNU4t5n4eVvXfwrGLJ5gFPKMR9CC2zPUNVcwCzuSqPnBon32:U7E5t9GGLJ5gsMPYUXcwL3PBG2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2740-27-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads