715a16e23c9dc886b1c07b7d76cc94a7c058b993acc54ec035bc4d71b98d44b9

General

Target
df0741708445bd43b8e1ba76b7655626.exe
Size 297KB
Sample240326-ncffzagh32
SHA256 715a16e23c9dc886b1c07b7d76cc94a7c058b993acc54ec035bc4d71b98d44b9
MD5 df0741708445bd43b8e1ba76b7655626
SHA1 42a80a09bd679ee5a4ef0186f7d3d3e240815fcb
SHA512 5db0e541a0a921f3ad14b4af024b6c17749a9ee1e15eea11f9227f8f0b7310a3a2ac224ed75eca39b59e1fa21629c6aa6128e678bd732402e64f8462f61f1b0f
SSDEEP 6144:Ock4bs2Z4v9Kg5cVo38Ae2lWegYYVUo0ary0IiNS:Ock4+FCoMAeighaohIiNS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	df0741708445bd43b8e1ba76b7655626.exe

Executes dropped EXE 1 IoCs

pid	Process
4848	skype.exe

Loads dropped DLL 1 IoCs

pid	Process
4532	Regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9A568672-D437-469E-86C2-F6E4A1156071}	Regsvr32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\resiifers.ini	df0741708445bd43b8e1ba76b7655626.exe
File created	C:\Windows\SysWOW64\hcuufeaepv.dll	df0741708445bd43b8e1ba76b7655626.exe
File created	C:\Windows\SysWOW64\skype.exe	df0741708445bd43b8e1ba76b7655626.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\InprocServer32\ = "C:\\Windows\\SysWow64\\hcuufeaepv.dll"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hcuufeaepv.IEExtend\	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\ProgID\ = "hcuufeaepv.IEExtend"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\InprocServer32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hcuufeaepv.IEExtend\Clsid	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hcuufeaepv.IEExtend\Clsid\ = "{9A568672-D437-469E-86C2-F6E4A1156071}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\ProgID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hcuufeaepv.IEExtend	Regsvr32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4848	skype.exe
4848	skype.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4532	1616	df0741708445bd43b8e1ba76b7655626.exe	90
PID 1616 wrote to memory of 4532	1616	df0741708445bd43b8e1ba76b7655626.exe	90
PID 1616 wrote to memory of 4532	1616	df0741708445bd43b8e1ba76b7655626.exe	90
PID 1616 wrote to memory of 4848	1616	df0741708445bd43b8e1ba76b7655626.exe	92
PID 1616 wrote to memory of 4848	1616	df0741708445bd43b8e1ba76b7655626.exe	92
PID 1616 wrote to memory of 4848	1616	df0741708445bd43b8e1ba76b7655626.exe	92

C:\Users\Admin\AppData\Local\Temp\df0741708445bd43b8e1ba76b7655626.exe
"C:\Users\Admin\AppData\Local\Temp\df0741708445bd43b8e1ba76b7655626.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s C:\Windows\system32\hcuufeaepv.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:4532
- C:\Windows\SysWOW64\skype.exe
  "C:\Windows\system32\skype.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hcuufeaepv.dll

Path C:\Windows\SysWOW64\hcuufeaepv.dll
Size 215KB
SHA256 bf7d835874b2693dbd3b2dd4371888c60715d0d6730ec7a362fe4d67dafa2807
MD5 24ee1aa32e75a589cb7656e968dcc841
SHA1 31ef033e29597991afb9e8c338f4434dc5ffa8e3
SHA512 7d01b6dda97cdb3082f022d256067483a1ce8703e097185f5d47420b69ad17c700af12d9120436ee8fdc46865ad118f411af26e199228c17a1fb355440f3afd1
SSDEEP 3072:iJZv4SAAjCLdJo/2RawjJB4ZmU4j7OnjuYcNEIN3mQ7iEOvJAOa7Vaw5nKE:NSALdJswQZWnUceYmQ7ilRWsw5KE
MD5 SHA1 SHA512 SSDEEP

Submit Download

resiifers.ini

Path C:\Windows\SysWOW64\resiifers.ini
Size 82B
SHA256 00549879bc418ffd2a8ae6709f9e5d3401ceffee1dd5820e32e6cb7d73c4af6d
MD5 da59e572d4431286428a71eb53fcaf6a
SHA1 3f9f05be9ba9c734e6ac2eaef6b20ab362bd1a5b
SHA512 4a4757df31e5caafdd0e02c236271769834fee18e4e61c1da1dfa41d33333f5d05bad6ba8d79ddc1aa04b1cb69cfb98003d6ab2efc9f11ecb583da3d107bc02a
MD5 SHA1 SHA512

Submit Download

skype.exe

Path C:\Windows\SysWOW64\skype.exe
Size 57KB
SHA256 4a5ef08d3e0896a6f2611385565f5e082b8a401596f5e6ce57b7a8c26a319116
MD5 4c7be026c2d95f893ca401abb62b614e
SHA1 0848587f9a58dffc761bdf53af3dd8ae7dd4a494
SHA512 2101ebb8d315daf0bde78e766c50c1a04ed6001028001a82303d8985594a670e11867dbbf7ffb8bcb9a84689af07feba96259c672cb823cd930833fbb26d340a
SSDEEP 768:BTENGVSVpwwgYyuccX0cVoXH4Y4A4dr1HwpWOyYUgnD5PVsXY8dthJV801:VQpKwg5uGYY4A4dr0UgD5OXY8vbVb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1616-0-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/1616-1-0x00000000020B0000-0x00000000020B2000-memory.dmp

Download

memory/1616-22-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/4532-10-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4532-11-0x0000000000B70000-0x0000000000B72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads