43bbc3894e89014e018da12303824647970fa14510f646be7fefd038f2e38b96

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Visualizar.exe
Size

380KB
MD5

a0499c528485f98d6f92a1d417abb9ec
SHA1

5143a1ed4ebd77f6c957def9a9967c353f8bce63
SHA256

1df1b7974395702532365b128b157c6f248baa1fce453b45772098aabd92a954
SHA512

2437fb42750182dfec70d6cba86053873abe29357749d3ab89f2e855fbb5734e16ce4d31e7b7cec22b5060cb677cbded78f777cdb006d405a0909b3945b1a227
SSDEEP

6144:Wifrt/9VPG/iLfryD12MXWrQhWXRcSQWCGrikUg1UTab7cwveEF6W6K1A:R/9pG/iLiPXWkjfmekHNcwveEF6WK

Score

7^/10

adware spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	Visualizar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\	Visualizar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win000.tmp	Visualizar.exe
File opened for modification	C:\Windows\cqrm944.dll	Visualizar.exe
File created	C:\Windows\win000.tmp	Visualizar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	Visualizar.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2872	1712	Visualizar.exe	28
PID 1712 wrote to memory of 2872	1712	Visualizar.exe	28
PID 1712 wrote to memory of 2872	1712	Visualizar.exe	28
PID 1712 wrote to memory of 2872	1712	Visualizar.exe	28
PID 2872 wrote to memory of 2540	2872	cmd.exe	30
PID 2872 wrote to memory of 2540	2872	cmd.exe	30
PID 2872 wrote to memory of 2540	2872	cmd.exe	30
PID 2872 wrote to memory of 2540	2872	cmd.exe	30
PID 1712 wrote to memory of 2812	1712	Visualizar.exe	31
PID 1712 wrote to memory of 2812	1712	Visualizar.exe	31
PID 1712 wrote to memory of 2812	1712	Visualizar.exe	31
PID 1712 wrote to memory of 2812	1712	Visualizar.exe	31
PID 1712 wrote to memory of 2812	1712	Visualizar.exe	31
PID 1712 wrote to memory of 2812	1712	Visualizar.exe	31
PID 1712 wrote to memory of 2812	1712	Visualizar.exe	31

C:\Users\Admin\AppData\Local\Temp\Visualizar.exe
"C:\Users\Admin\AppData\Local\Temp\Visualizar.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADDHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System/v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADDHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System/v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:2540
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s C:\Windows\cqrm944.dll
  2⤵
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads