Overview

overview

7

Static

static

3

91c91d4e6e...da.exe

windows7-x64

6

91c91d4e6e...da.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    89s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/02/2024, 10:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    91c91d4e6ebafe5be9457646111416da.exe
  • Size 349KB
  • Sample240205-msfw1agaar
  • SHA256 8ff816a25ae55b26aa257fb24be4f6d3e266d8e2cf678ab13bb8aeeff4431a3c
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91c91d4e6ebafe5be9457646111416da.exe
    "C:\Users\Admin\AppData\Local\Temp\91c91d4e6ebafe5be9457646111416da.exe"
    1⤵
    • Checks computer location settings
    • Installs/modifies Browser Helper Object
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com/search?q=live video
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1604
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\oddoxu.dll"
      2⤵
        PID:3060

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Size 471B
          • SHA256 821420f187b512f853c8b73d9439e940e6e04c499532561343a739717a9a76ee
          • MD5 SHA1 SHA512
          Submit Download

          7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Size 404B
          • SHA256 2cf3d7917f55a0ebd001a7cfd8c86dd59dca40fe81fdfdea820f0aec57bf79ce
          • MD5 SHA1 SHA512
          Submit Download

          verBC1C.tmp
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verBC1C.tmp
          • Size 15KB
          • SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          imagestore.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\buhspo8\imagestore.dat
          • Size 5KB
          • SHA256 61ca735f8ae1ee7acf0367d75a7b10d1bca6a3f16df8662be769ad23c8bc0080
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          recaptcha__en[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\recaptcha__en[1].js
          • Size 488KB
          • SHA256 689c72d7718868395eaf4bbe26e9f52e92f16daaa1d5486b53ae3744a996f1e2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          suggestions[1].en-US
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\suggestions[1].en-US
          • Size 17KB
          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          styles__ltr[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\styles__ltr[1].css
          • Size 55KB
          • SHA256 7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          favicon[1].ico
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\favicon[1].ico
          • Size 5KB
          • SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BBVJIBNNUUM
          • Path C:\Windows\BBVJIBNNUUM
          • Size 247KB
          • SHA256 c53f211cf3815035a4e008ad627644fc83ec4c01e2aaded4da33ca2d7450e55b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/3608-6-0x0000000000400000-0x000000000041F000-memory.dmp
          Download