f8e8d9079cb6bc2c1adc7a7e00af3ce27f46b5394b38666f4623cc095da62224

General

Target

d435ca3a32cf0a322e03ef4eee5424e9.exe
Size

16KB
MD5

d435ca3a32cf0a322e03ef4eee5424e9
SHA1

29a3d304aa32705bdec80bb5374a3449774a76d1
SHA256

f8e8d9079cb6bc2c1adc7a7e00af3ce27f46b5394b38666f4623cc095da62224
SHA512

2125769f35aaa1403b34b1947960d895e388ac080c0ab9b34c9821d2b857ab0984c0c944d561fd892597a25456cc8dcbb489d6913dff0279eb1b8534dbbccb8f
SSDEEP

384:RnlGe8iIwTUkgWp66dFFgl6eGG1lg6cdjn1NLd:RnlnFq6eP1lI11NL

Score

10^/10

adware persistence stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	d435ca3a32cf0a322e03ef4eee5424e9.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\spools.exe	d435ca3a32cf0a322e03ef4eee5424e9.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	d435ca3a32cf0a322e03ef4eee5424e9.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	d435ca3a32cf0a322e03ef4eee5424e9.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\cftmon.exe \"%1\" %*"	d435ca3a32cf0a322e03ef4eee5424e9.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	d435ca3a32cf0a322e03ef4eee5424e9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\cftmon.exe"	d435ca3a32cf0a322e03ef4eee5424e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	d435ca3a32cf0a322e03ef4eee5424e9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\cftmon.exe"	d435ca3a32cf0a322e03ef4eee5424e9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	reg.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	reg.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe"	d435ca3a32cf0a322e03ef4eee5424e9.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\cftmon.exe \"%1\" %*"	d435ca3a32cf0a322e03ef4eee5424e9.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2076	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	28
PID 2200 wrote to memory of 2076	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	28
PID 2200 wrote to memory of 2076	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	28
PID 2200 wrote to memory of 2076	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	28
PID 2200 wrote to memory of 3060	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	29
PID 2200 wrote to memory of 3060	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	29
PID 2200 wrote to memory of 3060	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	29
PID 2200 wrote to memory of 3060	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	29
PID 2200 wrote to memory of 2988	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	30
PID 2200 wrote to memory of 2988	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	30
PID 2200 wrote to memory of 2988	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	30
PID 2200 wrote to memory of 2988	2200	d435ca3a32cf0a322e03ef4eee5424e9.exe	30

C:\Users\Admin\AppData\Local\Temp\d435ca3a32cf0a322e03ef4eee5424e9.exe
"C:\Users\Admin\AppData\Local\Temp\d435ca3a32cf0a322e03ef4eee5424e9.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
  2⤵
  - Installs/modifies Browser Helper Object
  PID:2076
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:3060
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:2988