427e589e554cf195057169b6c737173ebe21a8edeec3170b1d9423b19402149f

General

Target
e0429d505642e0d79ac2740fc5950750.exe
Size 61KB
Sample240326-2jbm9aeb74
SHA256 427e589e554cf195057169b6c737173ebe21a8edeec3170b1d9423b19402149f
MD5 e0429d505642e0d79ac2740fc5950750
SHA1 e107f7dd1e7e1cb0c21f136cbde4d92a19aeb2bb
SHA512 a396cf2a485333a5714c5e25e3b58c29d67beaea50328a19e8c410a03eb04108b30fa776db1a4709a728b394057c5878a29d7884e7fbab9d57fc704ed26d47de
SSDEEP 1536:MiMF/5zutWoFMOUgHluFRR2t/L8DwVg0Eq:SF/to4OUU8FqADlfq
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware persistence stealer upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	e0429d505642e0d79ac2740fc5950750.exe

Executes dropped EXE 2 IoCs

pid	Process
2572	kept.exe
4852	load.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000023344-8.dat	upx
behavioral2/memory/2572-16-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/2572-37-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	kept.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	kept.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mmminlin.dll	kept.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4464	1504	WerFault.exe	91
2816	4852	WerFault.exe	99

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	kept.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2572	1504	e0429d505642e0d79ac2740fc5950750.exe	98
PID 1504 wrote to memory of 2572	1504	e0429d505642e0d79ac2740fc5950750.exe	98
PID 1504 wrote to memory of 2572	1504	e0429d505642e0d79ac2740fc5950750.exe	98
PID 1504 wrote to memory of 4852	1504	e0429d505642e0d79ac2740fc5950750.exe	99
PID 1504 wrote to memory of 4852	1504	e0429d505642e0d79ac2740fc5950750.exe	99
PID 1504 wrote to memory of 4852	1504	e0429d505642e0d79ac2740fc5950750.exe	99
PID 2572 wrote to memory of 1156	2572	kept.exe	102
PID 2572 wrote to memory of 1156	2572	kept.exe	102
PID 2572 wrote to memory of 1156	2572	kept.exe	102

C:\Users\Admin\AppData\Local\Temp\e0429d505642e0d79ac2740fc5950750.exe
"C:\Users\Admin\AppData\Local\Temp\e0429d505642e0d79ac2740fc5950750.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 424
  2⤵
  - Program crash
  PID:4464
- C:\Users\Admin\AppData\Local\Temp\kept.exe
  "C:\Users\Admin\AppData\Local\Temp\kept.exe"
  2⤵
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c preved.bat
    3⤵
    PID:1156
- C:\Users\Admin\AppData\Local\Temp\load.exe
  "C:\Users\Admin\AppData\Local\Temp\load.exe"
  2⤵
  - Executes dropped EXE
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 264
    3⤵
    - Program crash
    PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1504 -ip 1504
1⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4852 -ip 4852
1⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4084 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hGOJyITUNt

Path C:\Users\Admin\AppData\Local\Temp\hGOJyITUNt
Size 32KB
SHA256 c59e23c9b34ea3050b97f0e4e9eb1e1b197e7a460cc17bc04c4495d74ebe1dd9
MD5 0482b3f2a4ba95ccb7c88381d1fc9719
SHA1 85cf3021ca5877e58632205c191ee96616f31dc2
SHA512 8653a27b27f9caa1c0d2474210c2200e95438a891f5a56647b80d0f5746ba2469c9c34b99556002b69e61a3148e3e78329619e92281205b0c86d122de1b925db
SSDEEP 768:3p315uXz1i1k4fK+PLs+XWG7tFUCnu8o1Z3mFZs9:3ByXaPs+XFz3G3OC
MD5 SHA1 SHA512 SSDEEP

Submit Download

load.exe

Path C:\Users\Admin\AppData\Local\Temp\load.exe
Size 9KB
SHA256 d28834eb1cbffd32961d40b33d1d4c902568643f03695e50eb34834b4044f590
MD5 1881018552e81c812f99d5ed14b9dc5a
SHA1 3a1a39535f8ab75aeef4d5f59729cd6bd665d060
SHA512 f749dc298985de49f27130ce7293e59f33ca565f3e7e24cc13e12728cfd91c7be7e9013495464ba001a5a3594166d90ac095d6a152bf9d6944b35bb050c9bb36
SSDEEP 192:feN0Pf01zo8oF2r/wZa1o4tWQjdAc7ZvUO8tvtdgfOFYQJG5:feN0k1z+4rYZ2oM5zZvE5sOu5
MD5 SHA1 SHA512 SSDEEP

Submit Download

preved.bat

Path C:\Users\Admin\AppData\Local\Temp\preved.bat
Size 159B
SHA256 8920328983362064eac8d911aeea19de37727bd4bc57684782c39b25f13b0050
MD5 01d030a96ea759f7a77de4418b589d26
SHA1 c477d4510a484ac15a07d0b09ecdec0a5e227028
SHA512 984d2475f9dcbba22ac962f5750c96b15af7a9594caef73bf00ec077276f935af43e044bd74f6f122c799b88a22a1dbb60c75f434511b61a47944a766fb9e7f9
MD5 SHA1 SHA512

Submit Download

memory/1504-0-0x0000000000400000-0x0000000000417200-memory.dmp

Download

memory/1504-31-0x0000000000400000-0x0000000000417200-memory.dmp

Download

memory/2572-16-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2572-37-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads