Overview

overview

10

Static

static

10

02b2807a96...b0.exe

windows7-x64

7

02b2807a96...b0.exe

windows10-2004-x64

7

$PLUGINSDI...er.exe

windows7-x64

7

$PLUGINSDI...er.exe

windows10-2004-x64

7

$PLUGINSDI...BI.exe

windows7-x64

7

$PLUGINSDI...BI.exe

windows10-2004-x64

7

$PLUGINSDI...cc.exe

windows7-x64

7

$PLUGINSDI...cc.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDIR/Failed.js

windows7-x64

1

$PLUGINSDIR/Failed.js

windows10-2004-x64

1

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...lp.dll

windows7-x64

1

$PLUGINSDI...lp.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows7-x64

9

$PLUGINSDI...ay.dll

windows10-2004-x64

9

$PLUGINSDI...st.dll

windows7-x64

1

$PLUGINSDI...st.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09/03/2024, 17:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe
  • Size 1.1MB
  • Sample240309-wkpcvaeb57
  • SHA256 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe
    "C:\Users\Admin\AppData\Local\Temp\02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\BI\BI.exe { "json_send_time" : "9/3/2024 19:59:5:526" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "52286" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130825.01" , "bundle_id" : "6edd9812-2408-4b4d-bb69-e522c0252fef" , "machine_user_id" : "{6898E8E3-C258-420B-AEAC-43D38FDEC687}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "9B60F893-60FB-4ED0-A9C0-5B94B4714AF1" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2848
    • C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\BI\BI.exe { "user_ie_security_level" : "Medium-High" , "json_send_time" : "9/3/2024 19:59:41:624" , "internal_error_description" : "HttpPost result: try1- SendRequest Error; try2- SendRequest Error; try3- SendRequest Error" , "internal_error_number" : "3" , "is_parallel" : "0" , "mrs_id" : "" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "52286" , "general_status_code" : "2" , "duration_details" : " InitPluginsDir:0 initializeParams:94 load_BITool:15 send_BI_Init:0 load_DownloadACC:31 retrieveUISource:0 unpack_webappfolder:0 unpack_icon:0 RetrieveMainOfferKey:0 unpack_OpenCandyDll:16 unpack_BunndleDll:31 load_webapphost:0 unpack_ProxyInstaller:0 navigate_loadingUI:531 navigateAsync_constMainOffer:0 BuildUserProfile:0 retrieve cid:0 callService1:12090 callService1:11559 callService1:11841 " , "phase_duration" : "" , "error_details" : "Failed communicate with the DistributionEngineService. Inner Error: SendRequest Error. InternalRetryNum: 3" , "result" : "Error" , "user_operating_system_bits" : "64" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.11.9600.16428" , "user_default_browser_version" : "9.11.9600.16428" , "user_default_browser" : "IEXPLORE.EXE" , "user_service_pack" : "1.0" , "user_operating_system" : "Windows 7 Ultimate" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130825.01" , "bundle_id" : "6edd9812-2408-4b4d-bb69-e522c0252fef" , "machine_user_id" : "{6898E8E3-C258-420B-AEAC-43D38FDEC687}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "9B60F893-60FB-4ED0-A9C0-5B94B4714AF1" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1212

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        errorPageStrings[2]
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34C79QVV\errorPageStrings[2]
        • Size 2KB
        • SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
        • MD5 SHA1 SHA512
        Submit Download

        BI.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\BI\BI.exe
        • Size 75KB
        • SHA256 fe0af5e14e37fd0b642aa08495ae63a4ed441c92909dfd7a8a25a050b5ed097e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Failed.htm
        • Path C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\Failed.htm
        • Size 6KB
        • SHA256 16b03f64adc522298a636a117869d821379e341314704a4eb7e2263689e76d91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        webapphost.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsy196C.tmp\webapphost.dll
        • Size 760KB
        • SHA256 54c6ca5ddcc600bb6ffd283760b843cc0af41b7b9ea1767a9aa4826262c407fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path \Users\Admin\AppData\Local\Temp\nsy196C.tmp\System.dll
        • Size 17KB
        • SHA256 e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        inetc.dll
        • Path \Users\Admin\AppData\Local\Temp\nsy1A08.tmp\inetc.dll
        • Size 29KB
        • SHA256 37adc0183d94ae6ca1895643423dac0c97750d7103e6b00c14299dfc4ad2271e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download