736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa

Analysis

max time kernel
128s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97a77c8e8daa0ad6717a99f95acfb160.exe
Size 449KB
Sample240214-clyhcsfe95
SHA256 736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa
MD5 97a77c8e8daa0ad6717a99f95acfb160
SHA1 ca5f8b285cfd56d4b43e06f187a75b867f1caa33
SHA512 efcd57f74697b46c8c55686ef09e866e97eab748b47b6454d305fb547f27fa315f0d535e8f326df33f4eb15a9bdd35893ee4c6701cec1507fdb903e295070383
SSDEEP 12288:qC1x/d6lwKsVqBwDFS7HKAXKZwACaewbt:XFd6Kn5Jt0eJrdt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
3016	midiasvc.exe
2884	midiasvc.exe
736	midiasvc.exe
2676	mineeosvc.ex_
2780	mineeosvc.ex_
2772	mineeosvc.exe
2572	mineeosvc.exe
2548	mineeosvc.exe

Loads dropped DLL 35 IoCs

pid	Process
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
3016	midiasvc.exe
3016	midiasvc.exe
3016	midiasvc.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
2884	midiasvc.exe
2884	midiasvc.exe
2884	midiasvc.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
2772	mineeosvc.exe
2772	mineeosvc.exe
2772	mineeosvc.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
2572	mineeosvc.exe
2572	mineeosvc.exe
2572	mineeosvc.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\ = "MineFilterc3a007APIClass Helper"	97a77c8e8daa0ad6717a99f95acfb160.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\midiasvc.exe	97a77c8e8daa0ad6717a99f95acfb160.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mineeosvc.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MineFilter\mine_uins.dat	97a77c8e8daa0ad6717a99f95acfb160.exe
File created	C:\Program Files (x86)\MineFilter\mineeo.dl_	97a77c8e8daa0ad6717a99f95acfb160.exe
File created	C:\Program Files (x86)\MineFilter\minerun.ex_	97a77c8e8daa0ad6717a99f95acfb160.exe
File opened for modification	C:\Program Files (x86)\MineFilter\Log\minefilter_up_20240214.txt	mineeosvc.ex_
File created	C:\Program Files (x86)\MineFilter\mineeonad.dll	97a77c8e8daa0ad6717a99f95acfb160.exe
File created	C:\Program Files (x86)\MineFilter\minerun.exe	97a77c8e8daa0ad6717a99f95acfb160.exe
File created	C:\Program Files (x86)\MineFilter\uninst.exe	97a77c8e8daa0ad6717a99f95acfb160.exe
File created	C:\Program Files (x86)\MineFilter\mineeonad.dl_	97a77c8e8daa0ad6717a99f95acfb160.exe
File created	C:\Program Files (x86)\MineFilter\mineeosvc.ex_	97a77c8e8daa0ad6717a99f95acfb160.exe
File created	C:\Program Files (x86)\MineFilter\mineeo.dll	97a77c8e8daa0ad6717a99f95acfb160.exe
File created	C:\Program Files (x86)\MineFilter\mineeosvc.exe	97a77c8e8daa0ad6717a99f95acfb160.exe
File opened for modification	C:\Program Files (x86)\MineFilter\Log\minefilter_up_20240214.txt	mineeosvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\SOFTWARE\Microsoft\Internet Explorer\Main	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	97a77c8e8daa0ad6717a99f95acfb160.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mineeosvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-41-c4-49-76-40\WpadDecision = "0"	mineeosvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mineeosvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mineeosvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mineeosvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mineeosvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC0A58C9-7805-4A40-980C-827FF289AF57}	mineeosvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC0A58C9-7805-4A40-980C-827FF289AF57}\WpadDecisionTime = 70c18626eb5eda01	mineeosvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mineeosvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mineeosvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mineeosvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mineeosvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mineeosvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC0A58C9-7805-4A40-980C-827FF289AF57}\WpadDecision = "0"	mineeosvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-41-c4-49-76-40	mineeosvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mineeosvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mineeosvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0083000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mineeosvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC0A58C9-7805-4A40-980C-827FF289AF57}\WpadDecisionReason = "1"	mineeosvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC0A58C9-7805-4A40-980C-827FF289AF57}\WpadNetworkName = "Network 3"	mineeosvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC0A58C9-7805-4A40-980C-827FF289AF57}\fe-41-c4-49-76-40	mineeosvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-41-c4-49-76-40\WpadDecisionReason = "1"	mineeosvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-41-c4-49-76-40\WpadDecisionTime = 70c18626eb5eda01	mineeosvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mineeosvc.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\TypeLib	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\ = "MineFilterc3a007APIClass 1.0 Type Library"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\0\win32	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\CLSID	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\CurVer\ = "MineFilterc3a007BHO.MineFilterc3a007APIClass.1"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\ = "MineFilter"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\ProgID\ = "MineFilterc3a007BHO.MineFilterc3a007APIClass.1"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\InprocServer32\ThreadingModel = "Apartment"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\FLAGS	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\0\win32\ = "C:\\Program Files (x86)\\MineFilter\\mineeo.dll"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\ = "MineFilterc3a007APIClass Class"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\VersionIndependentProgID\ = "MineFilterc3a007BHO.MineFilterc3a007APIClass"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\Programmable	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\InprocServer32	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass.1\ = "MineFilterc3a007APIClass Class"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass.1\CLSID\ = "{11F0542B-643D-40b3-B447-DEFEE8A12ABC}"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\CLSID\ = "{11F0542B-643D-40b3-B447-DEFEE8A12ABC}"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\TypeLib\ = "{01F0542B-643D-40b3-B447-DEFEE8A12ABC}"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib\Version = "1.0"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib\Version = "1.0"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\tst_key = "test_ok"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\CurVer	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\HELPDIR	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\MineFilter\\"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ProxyStubClsid32	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass.1\CLSID	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib\ = "{01F0542B-643D-40B3-B447-DEFEE8A12ABC}"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ = "IMineFilterc3a007API"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ProxyStubClsid32	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\ProgID	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\VersionIndependentProgID	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\FLAGS\ = "0"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ = "IMineFilterc3a007API"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib\ = "{01F0542B-643D-40B3-B447-DEFEE8A12ABC}"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass.1	97a77c8e8daa0ad6717a99f95acfb160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\InprocServer32\ = "C:\\Program Files (x86)\\MineFilter\\mineeo.dll"	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\0	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}	97a77c8e8daa0ad6717a99f95acfb160.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib	97a77c8e8daa0ad6717a99f95acfb160.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe
1888	97a77c8e8daa0ad6717a99f95acfb160.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1888	97a77c8e8daa0ad6717a99f95acfb160.exe
Token: SeBackupPrivilege	1888	97a77c8e8daa0ad6717a99f95acfb160.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 3016	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	28
PID 1888 wrote to memory of 3016	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	28
PID 1888 wrote to memory of 3016	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	28
PID 1888 wrote to memory of 3016	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	28
PID 1888 wrote to memory of 3016	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	28
PID 1888 wrote to memory of 3016	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	28
PID 1888 wrote to memory of 3016	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	28
PID 1888 wrote to memory of 2884	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	29
PID 1888 wrote to memory of 2884	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	29
PID 1888 wrote to memory of 2884	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	29
PID 1888 wrote to memory of 2884	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	29
PID 1888 wrote to memory of 2884	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	29
PID 1888 wrote to memory of 2884	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	29
PID 1888 wrote to memory of 2884	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	29
PID 1888 wrote to memory of 2676	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	32
PID 1888 wrote to memory of 2676	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	32
PID 1888 wrote to memory of 2676	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	32
PID 1888 wrote to memory of 2676	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	32
PID 1888 wrote to memory of 2676	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	32
PID 1888 wrote to memory of 2676	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	32
PID 1888 wrote to memory of 2676	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	32
PID 1888 wrote to memory of 2780	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	33
PID 1888 wrote to memory of 2780	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	33
PID 1888 wrote to memory of 2780	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	33
PID 1888 wrote to memory of 2780	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	33
PID 1888 wrote to memory of 2780	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	33
PID 1888 wrote to memory of 2780	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	33
PID 1888 wrote to memory of 2780	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	33
PID 1888 wrote to memory of 2772	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	34
PID 1888 wrote to memory of 2772	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	34
PID 1888 wrote to memory of 2772	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	34
PID 1888 wrote to memory of 2772	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	34
PID 1888 wrote to memory of 2772	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	34
PID 1888 wrote to memory of 2772	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	34
PID 1888 wrote to memory of 2772	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	34
PID 1888 wrote to memory of 2572	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	35
PID 1888 wrote to memory of 2572	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	35
PID 1888 wrote to memory of 2572	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	35
PID 1888 wrote to memory of 2572	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	35
PID 1888 wrote to memory of 2572	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	35
PID 1888 wrote to memory of 2572	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	35
PID 1888 wrote to memory of 2572	1888	97a77c8e8daa0ad6717a99f95acfb160.exe	35

C:\Users\Admin\AppData\Local\Temp\97a77c8e8daa0ad6717a99f95acfb160.exe
"C:\Users\Admin\AppData\Local\Temp\97a77c8e8daa0ad6717a99f95acfb160.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\midiasvc.exe
  "C:\Windows\System32\midiasvc.exe" /i
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3016
- C:\Windows\SysWOW64\midiasvc.exe
  "C:\Windows\System32\midiasvc.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2884
- C:\Program Files (x86)\MineFilter\mineeosvc.ex_
  "C:\Program Files (x86)\MineFilter\mineeosvc.ex_" /stop
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Program Files (x86)\MineFilter\mineeosvc.ex_
  "C:\Program Files (x86)\MineFilter\mineeosvc.ex_" /u
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2780
- C:\Program Files (x86)\MineFilter\mineeosvc.exe
  "C:\Program Files (x86)\MineFilter\mineeosvc.exe" /i
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2772
- C:\Program Files (x86)\MineFilter\mineeosvc.exe
  "C:\Program Files (x86)\MineFilter\mineeosvc.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2572

C:\Windows\SysWOW64\midiasvc.exe
C:\Windows\SysWOW64\midiasvc.exe
1⤵
- Executes dropped EXE
PID:736

C:\Program Files (x86)\MineFilter\mineeosvc.exe
"C:\Program Files (x86)\MineFilter\mineeosvc.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

minefilter_up_20240214.txt

Path C:\Program Files (x86)\MineFilter\Log\minefilter_up_20240214.txt
Size 230B
SHA256 9b87ab5cd784fc37c962e74a5594cb4095ccb30d7927dcea9d67dd22d0ff0769
MD5 d3e51adf0a35dbb518705ea3540b13a0
SHA1 f65f123cadfe729f6206fbcea89897c0bedd37b2
SHA512 fd1ef34950ed910da8361a1a362fab1a72ac689eb87de154a63e1c83ca85ee8ee9397fa1157a4b756cadf51b61475d1c557b17356e879c4336a92e03bf88aebe
MD5 SHA1 SHA512

Submit Download

minerun.exe

Path C:\Program Files (x86)\MineFilter\minerun.exe
Size 129KB
SHA256 bfac7a61df4335acfe677ca09fb1996bef63530a3867a81bfb2fceed5a123dc5
MD5 596199aebea31fbddb0044fdfb2e75ec
SHA1 00f1136ecfe4b5c7d8045f65e4ff4fd11959fd54
SHA512 52efc0b8a6890d93db74b1d3e77b0d21c1fe9c7e1300c440f49a3971b6914cd02722c9150559f882054f8c8e56e34627cef88852d626e9810bda22a96a8a3e7a
SSDEEP 1536:RYW/2vJd49J2uSF0/cyqcMYdLY3wy2vgcUZ:eW7B/cyqcMYorco
MD5 SHA1 SHA512 SSDEEP

Submit Download

splash.jpg

Path C:\Users\Admin\AppData\Local\Temp\nsy88A1.tmp\splash.jpg
Size 631B
SHA256 25cf0f0ce42f8acd9ea6facc223f54105c7fd0cce63fb7bb5d83e6600100acbd
MD5 d68e763c825dc0e388929ae1b375ce18
SHA1 7951a43bbfb08fd742224ada280913d1897b89ab
SHA512 1e146e2631a4f3bd091905ccc10ed1054700349648cd52aad24eaeeedff0fac4b44b6212284a6d0855942ff16308c66402ecb895e68ef1c66dcd496973043cdb
MD5 SHA1 SHA512

Submit Download

mineeo.dll

Path \Program Files (x86)\MineFilter\mineeo.dll
Size 121KB
SHA256 b9eacbc9112e1b97017b7e1b5213f1bc20b56bfbfdcd6898315b76bd56d72834
MD5 c7cff0342d39a8b13fa47c7c8d5f5cbf
SHA1 6b86fb16a10be1c8b5ae6111407cd3085a0c5660
SHA512 9a80098bda278ccae5ca9958e6a8c2bfd5f27995f66b7b8b2a06212c9942cebb5363f97f4ac8cbc90ba246586d39e8679c918ddc953e990e0a7dc284f81d5e34
SSDEEP 3072:c20bUZLSzWRtfU3tOA3wO4aeqtBG+EctaS:c9AAz45UsAbeN+NaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

mineeosvc.ex_

Path \Program Files (x86)\MineFilter\mineeosvc.ex_
Size 105KB
SHA256 a7be80960f400b55533195f07c40e413e51542b4c0dade35d5a72988a36ab1d8
MD5 2b69deccb1730858b225c58f6437d64a
SHA1 ae92bd082409911dc21de122ec7bcefe22d4aaa9
SHA512 e61875b104982b8780c1e556f792328fae48aacdbf12e6fcb352c371efa2695106084f7ac30c339fcf53dedec513f59f0d96fc2be4c2b19aa0cbba9c700703a0
SSDEEP 1536:3iZb/FwJ3etrGhmxkMS29jENmMISOLKV35PawzZXhGJHM1tkloqkcn:ubDtrGhm2MxjUhtOoJP7zZXhGJs1tDcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsy88A1.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

newadvsplash.dll

Path \Users\Admin\AppData\Local\Temp\nsy88A1.tmp\newadvsplash.dll
Size 8KB
SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
MD5 7ee14dff57fb6e6c644b318d16768f4c
SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path \Users\Admin\AppData\Local\Temp\nsy88A1.tmp\nsProcess.dll
Size 4KB
SHA256 b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
MD5 8f4ac52cb2f7143f29f114add12452ad
SHA1 29dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA512 2f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
SSDEEP 48:6sG7qYBUYBFxhRwYCI0owYlOdkPm4LYZ5sRXEv26vqAa4GEVu:HhYBUYBL0Toa7+Q5sKG4GEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

mineeonad.dll

Path \Users\Admin\AppData\Local\Temp\~nsis\c3a007\mineeonad.dll
Size 577KB
SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
MD5 ec10d3888f7907ee3dffc5f883d84196
SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
MD5 SHA1 SHA512 SSDEEP

Submit Download

midiasvc.exe

Path \Windows\SysWOW64\midiasvc.exe
Size 85KB
SHA256 7e864083928b1574a3cdad0827653fb91eaf96acb0b32445ed4725c8ee3d7059
MD5 e47777c0038db4950a72da594518b328
SHA1 7f858c3161d020d0c500fbb29a0f2d38cb93d44c
SHA512 4d6d02415afff4a2ceb229e3181dcd3fc7df89a99a3b6c7c0addb9f5265c03c1b3f0231f3b6d1c29c7e529ddfee83ab8e6f6a3e3e7eef838de5c42fbed60988a
SSDEEP 1536:TkriKIIIgLMYHoAtSXG4FkgrExEJHmLtzZnLr4:TkWKBIAHoOaFkjEJGLthLc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1888-31-0x0000000002760000-0x00000000027F4000-memory.dmp

Download

memory/1888-63-0x0000000003140000-0x000000000315F000-memory.dmp

Download