c7660f9f7aee2d5e66d04ee28e7c9a0a8d5ce4c8e381d3c32ab45e25548deaeb

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e04b154e039e6433c090498ff977a1a8.exe
Size 19KB
Sample240327-adm1jsad2z
SHA256 c7660f9f7aee2d5e66d04ee28e7c9a0a8d5ce4c8e381d3c32ab45e25548deaeb
MD5 e04b154e039e6433c090498ff977a1a8
SHA1 de2d834fdc3157e533a33419b3fe6abf43c487ef
SHA512 6c891f7a5e991c6fb42dbc84eb1037a9ac6429bf1a9a7dda107b23c46a0a2743cfee6c9e41f25f50465595c2d2bec6118fda8880871d1569278b04df9ad0f054
SSDEEP 384:w0G0lCc06rn4NQxvhX/IU/c036FKxKSmHifLhZpjKaPbRpt0V:wX0cJg4CxeLK6F43hRvR0V
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1204	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\ = "cj helper"	regsvr32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\IE Extensions\cj.v4.dll	e04b154e039e6433c090498ff977a1a8.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ = "Icjmgr"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib\ = "{E63648F7-3933-440E-B4F6-A8584DD7B7EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr.1\ = "cjmgr Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib\ = "{E63648F7-3933-440E-B4F6-A8584DD7B7EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr\CurVer\ = "CJ.cjmgr.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\ProgID\ = "CJ.cjmgr.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\ = "cj 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0\win32\ = "C:\\Program Files (x86)\\IE Extensions\\cj.v4.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\IE Extensions"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\TypeLib\ = "{E63648F7-3933-440E-B4F6-A8584DD7B7EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr.1\CLSID\ = "{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\InprocServer32\ = "C:\\Program Files (x86)\\IE Extensions\\cj.v4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr\ = "cjmgr Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CJ.cjmgr\CLSID\ = "{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\ = "cjmgr Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}\VersionIndependentProgID\ = "CJ.cjmgr"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ = "Icjmgr"	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1204	5060	e04b154e039e6433c090498ff977a1a8.exe	87
PID 5060 wrote to memory of 1204	5060	e04b154e039e6433c090498ff977a1a8.exe	87
PID 5060 wrote to memory of 1204	5060	e04b154e039e6433c090498ff977a1a8.exe	87
PID 5060 wrote to memory of 1676	5060	e04b154e039e6433c090498ff977a1a8.exe	89
PID 5060 wrote to memory of 1676	5060	e04b154e039e6433c090498ff977a1a8.exe	89
PID 5060 wrote to memory of 1676	5060	e04b154e039e6433c090498ff977a1a8.exe	89

C:\Users\Admin\AppData\Local\Temp\e04b154e039e6433c090498ff977a1a8.exe
"C:\Users\Admin\AppData\Local\Temp\e04b154e039e6433c090498ff977a1a8.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Program Files (x86)\IE Extensions\cj.v4.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\temp.bat
  2⤵
  PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cj.v4.dll

Path C:\Program Files (x86)\IE Extensions\cj.v4.dll
Size 17KB
SHA256 7520bb5ba2fc1431e926d2a8b655aecc7982cee5334e7d03fbc82086e6b2ea59
MD5 442d546ef255923d71fc31fb473281a6
SHA1 1e7289ad82d8792b9e49a213c373106c00b6ad6b
SHA512 11b8d29ead3dd6b26d8ed8d7993d3094db3997e32a2e146caa0bc3e0b0fc3aceab82544df29c8d83e654276a9642ad783ce6c621c9e0aa54414742064656d21d
SSDEEP 384:Wm2s6ueQih8d2sxsLVZD3ZZu+uZMzqG+9O7R:JnneaiVd9i/9U
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.bat

Path \??\c:\temp.bat
Size 204B
SHA256 5c5253a4e135213f2085b41232c8132c4ade858ad61bca72c6b28bf7f9b81b17
MD5 3af7e265ed156f1a1d04af0956e6219a
SHA1 bcf2734256842cd699aaba75cdedfb0fb897f74f
SHA512 a1d1ae8b91fef0359f7d3e7a8fc924f16a38774d047639fbc67305305ec9da1f313079e43f4d1f924fc12292d4bc9863e413a12cfcd447e832bbba03ba16030b
MD5 SHA1 SHA512

Submit Download

memory/1204-5-0x0000000010000000-0x000000001000D000-memory.dmp

Download

memory/1204-6-0x0000000000510000-0x0000000000520000-memory.dmp

Download

memory/5060-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5060-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/5060-9-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads