75f63c3e16bb579c8ebf03f19cd32936f667fb4dfa197c6386912398b359055e

General

Target

c6333dd81f6de28c6eead6dd66c18044.exe
Size

22KB
MD5

c6333dd81f6de28c6eead6dd66c18044
SHA1

d78d61e039ecff4a95acd4a897d01bb3b8b983e2
SHA256

75f63c3e16bb579c8ebf03f19cd32936f667fb4dfa197c6386912398b359055e
SHA512

fb814864dff101e25ba21989e34a9d5516a4efc3683be1d145f1485810d2a122ac0a1ad8f725e023f845958c7b32a9c5766f539ff613de4030572673076a1b55
SSDEEP

384:ApIbktQkmxlCglvqn/SVYm7LDzxsDXKi0b+CIA+qLe+5UXjUhEoHdDwncpjFpQo3:O+M8lCaS/m7LDK6iE+of0jU

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	c6333dd81f6de28c6eead6dd66c18044.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dafrui.dll	c6333dd81f6de28c6eead6dd66c18044.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\ProgID	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\VersionIndependentProgID	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\InprocServer32	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\TypeLib	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Version	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Programmable	c6333dd81f6de28c6eead6dd66c18044.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Implemented Categories	c6333dd81f6de28c6eead6dd66c18044.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4968	c6333dd81f6de28c6eead6dd66c18044.exe
4968	c6333dd81f6de28c6eead6dd66c18044.exe
4968	c6333dd81f6de28c6eead6dd66c18044.exe
4968	c6333dd81f6de28c6eead6dd66c18044.exe
4968	c6333dd81f6de28c6eead6dd66c18044.exe
4968	c6333dd81f6de28c6eead6dd66c18044.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	c6333dd81f6de28c6eead6dd66c18044.exe
Token: SeDebugPrivilege	4968	c6333dd81f6de28c6eead6dd66c18044.exe
Token: SeDebugPrivilege	4968	c6333dd81f6de28c6eead6dd66c18044.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 608	4968	c6333dd81f6de28c6eead6dd66c18044.exe	5
PID 4968 wrote to memory of 608	4968	c6333dd81f6de28c6eead6dd66c18044.exe	5
PID 4968 wrote to memory of 608	4968	c6333dd81f6de28c6eead6dd66c18044.exe	5

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608

C:\Users\Admin\AppData\Local\Temp\c6333dd81f6de28c6eead6dd66c18044.exe
"C:\Users\Admin\AppData\Local\Temp\c6333dd81f6de28c6eead6dd66c18044.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads