6ab07e64e44056cecb166cc6da8c97dbbf6463bb9647d7adc9c826f811015d40

General

Target
dab20fc577ce696039b0df7f6f28cb76.exe
Size 7KB
Sample240321-e4gnnsbg85
SHA256 6ab07e64e44056cecb166cc6da8c97dbbf6463bb9647d7adc9c826f811015d40
MD5 dab20fc577ce696039b0df7f6f28cb76
SHA1 c0ac0b6f7975bdba981b12cfe207c5f9f7e8acb2
SHA512 77d1d6e1f9994e4435c6cb544d48dcda5d6b66f9972fae98dfc68266d2c4215d85f31c0ae2ead4a771ae2ef7cc50093e3f9672aa901d0b7e81e37c6caec1e373
SSDEEP 96:KCbTS8umad+dJRXqv4Q2hj5duWb9UuK1MiyAtfVZapMst8Gdv:HbTSRmawXKAhj5dpUuKnjVZaDt8Gdv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware persistence stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	dab20fc577ce696039b0df7f6f28cb76.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	dab20fc577ce696039b0df7f6f28cb76.exe
File created	C:\Windows\SysWOW64\drivers\spools.exe	dab20fc577ce696039b0df7f6f28cb76.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	dab20fc577ce696039b0df7f6f28cb76.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\cftmon.exe \"%1\" %*"	dab20fc577ce696039b0df7f6f28cb76.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2472-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/2472-3-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/2472-12-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\cftmon.exe"	dab20fc577ce696039b0df7f6f28cb76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	dab20fc577ce696039b0df7f6f28cb76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\cftmon.exe"	dab20fc577ce696039b0df7f6f28cb76.exe
Key deleted	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	dab20fc577ce696039b0df7f6f28cb76.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	reg.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe"	dab20fc577ce696039b0df7f6f28cb76.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\cftmon.exe \"%1\" %*"	dab20fc577ce696039b0df7f6f28cb76.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2472	dab20fc577ce696039b0df7f6f28cb76.exe
2472	dab20fc577ce696039b0df7f6f28cb76.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2228	2472	dab20fc577ce696039b0df7f6f28cb76.exe	83
PID 2472 wrote to memory of 2228	2472	dab20fc577ce696039b0df7f6f28cb76.exe	83
PID 2472 wrote to memory of 2228	2472	dab20fc577ce696039b0df7f6f28cb76.exe	83
PID 2472 wrote to memory of 1100	2472	dab20fc577ce696039b0df7f6f28cb76.exe	84
PID 2472 wrote to memory of 1100	2472	dab20fc577ce696039b0df7f6f28cb76.exe	84
PID 2472 wrote to memory of 1100	2472	dab20fc577ce696039b0df7f6f28cb76.exe	84
PID 2472 wrote to memory of 4172	2472	dab20fc577ce696039b0df7f6f28cb76.exe	85
PID 2472 wrote to memory of 4172	2472	dab20fc577ce696039b0df7f6f28cb76.exe	85
PID 2472 wrote to memory of 4172	2472	dab20fc577ce696039b0df7f6f28cb76.exe	85

C:\Users\Admin\AppData\Local\Temp\dab20fc577ce696039b0df7f6f28cb76.exe
"C:\Users\Admin\AppData\Local\Temp\dab20fc577ce696039b0df7f6f28cb76.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
  2⤵
  - Installs/modifies Browser Helper Object
  PID:2228
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:1100
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:4172