58c9d3a5be31309d1842f9a9f0531d632df817fcd0dba5690645631a6b81b6c0

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6a819ef7e168d266b46fea369795c6d.exe
Size

1.5MB
MD5

b6a819ef7e168d266b46fea369795c6d
SHA1

fa60566c82eb267a28b456f9b71377f9b1801623
SHA256

58c9d3a5be31309d1842f9a9f0531d632df817fcd0dba5690645631a6b81b6c0
SHA512

57f48832ebc52c40e2f04c277579768d3466ff72301679c35215c59821d932bc483f64140d07cb254fa6cada9aa2e2d34d0c11050b7840e913e4befde825567c
SSDEEP

24576:sGoseufagFnX8dfncq6cPwKPqnLolyMEIChp2GClQjX0bX7xNTlRFb5jnOAJIxd:JZfaeqn56wwQqLolrEIC3J4r7/TbTjnm

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "475524515"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{47F7EA56-DB7D-11EE-B09F-4A65E849A069} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "475680503"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a0010ad04f8254f917a775005b504310000000002000000000010660000000100002000000077540f76a57cf9ec609680d85c4e565e94b10336bea8c610a13ce96e6d05dd17000000000e8000000002000020000000e34f59f398bd71b4e24f34376d300a61e386286a94c4d3715e22c499465958ec200000008f6faddd7d7d9bf6bb3da06ed77b8c449fea405a8ef8a6b692923fd144d4fb5b40000000528a9bc6f8452405624268a90b0de332c18450e96fcd7314d2785dcd54d458557596179cfc6294dded434a5ee666ff5431b53f3869fbad98a478b2dda5604028	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7014da258a6fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31092618"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a0010ad04f8254f917a775005b5043100000000020000000000106600000001000020000000153b65dda8f72de629beb6833cacdf9fcd5ce23577d403154ee37abd18d32b2e000000000e80000000020000200000001f269f7ca2b61272945954329c0a621bf776827b8cc87332381ad22c957a6773200000004f3b6601cb5453f52f5281fb185df04dab0633b78f796974ac62fe1e9ae555d7400000007e8bf650bfb9d3fe93ac9121e3ab8b7312a9c8ef64a4e2ae3e3ead264f2071b1ddb8677348ba4acdd4ad838a1f8ff2848c591cdbc348165a46d2e249ab8d7773	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31092618"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "481774594"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31092618"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4027ed258a6fda01	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3208	b6a819ef7e168d266b46fea369795c6d.exe
3208	b6a819ef7e168d266b46fea369795c6d.exe
3208	b6a819ef7e168d266b46fea369795c6d.exe
3208	b6a819ef7e168d266b46fea369795c6d.exe
1064	b6a819ef7e168d266b46fea369795c6d.exe
1064	b6a819ef7e168d266b46fea369795c6d.exe
1064	b6a819ef7e168d266b46fea369795c6d.exe
1064	b6a819ef7e168d266b46fea369795c6d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
5000	IEXPLORE.EXE
5000	IEXPLORE.EXE
5000	IEXPLORE.EXE
5000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 1064	3208	b6a819ef7e168d266b46fea369795c6d.exe	87
PID 3208 wrote to memory of 1064	3208	b6a819ef7e168d266b46fea369795c6d.exe	87
PID 3208 wrote to memory of 1064	3208	b6a819ef7e168d266b46fea369795c6d.exe	87
PID 2128 wrote to memory of 5000	2128	iexplore.exe	108
PID 2128 wrote to memory of 5000	2128	iexplore.exe	108
PID 2128 wrote to memory of 5000	2128	iexplore.exe	108

C:\Users\Admin\AppData\Local\Temp\b6a819ef7e168d266b46fea369795c6d.exe
"C:\Users\Admin\AppData\Local\Temp\b6a819ef7e168d266b46fea369795c6d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\b6a819ef7e168d266b46fea369795c6d.exe
  "C:\Users\Admin\AppData\Local\Temp\b6a819ef7e168d266b46fea369795c6d.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_52f301770"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4956

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pkg_52f301770\autorun.txt

Filesize
125B

MD5
b58695b233b69c4502acd4b65453c77a

SHA1
897699242b02206523d980d9caf18f4f0b00709c

SHA256
aee64388c220040dd53324a9c8482c3e75c2c9340dec83f0c9240da00616c8ce

SHA512
bd4d486ee5c30923fcb9f7e5e873f4c3fbd4e1f239346b60d22d3481c0cd23af6ec90b7263a5b3fa9412e66e8341ee7ab4ea647befeb190b400e53c88b4c54fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_52f301770\timings.txt

Filesize
342B

MD5
64598770fdb735f26cf48f3f45253dd8

SHA1
9de3cd1defe9c1a798aae0defd543bccc0fe3383

SHA256
e6280817b47ed3edfa59b07f1e7c7de8c3955d8ecb8fabb2f4d5c1a9d862213c

SHA512
b9c282bbe597a150111452e4c2f317c96c7ada3c969e93259cea97278f1a11b7bf94229cabdce36118c5fb9edc32c694c1d260e57157ed55ea6c7e56c0145438

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_52f301770\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit