96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a

Analysis

max time kernel
144s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe
Size 504KB
Sample240508-ad1awaaf29
SHA256 96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a
MD5 267fd307346a2b7ad69a93475c76a947
SHA1 9dd96f63ba5169fc5dfe00f843f6d1a544895134
SHA512 caf5e8bab2ba0c2a7770a9d93fd5dae122e966e59767c192c86f3358a10d34d088d7ec52597856c86a5839f6abf394608e4f806b8b007081de09ae9b5d489462
SSDEEP 12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

adware stealer upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral2/memory/4476-0-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/4476-3-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/4476-4-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/4476-14-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/936-21-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/files/0x0010000000023a55-20.dat	UPX
behavioral2/memory/936-27-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/936-39-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/936-36-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/936-33-0x0000000000400000-0x000000000049C000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
936	Explorrer.exe
3984	Explorrer.exe
4380	Explorrer.exe

Loads dropped DLL 2 IoCs

pid	Process
4076	regsvr32.exe
5000	regsvr32.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4476-0-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4476-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4476-4-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4476-14-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/936-21-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/files/0x0010000000023a55-20.dat	upx
behavioral2/memory/936-27-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/936-39-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/936-36-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/936-33-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 936 set thread context of 3984	936	Explorrer.exe	101
PID 936 set thread context of 4380	936	Explorrer.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
4588	948	WerFault.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
948	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Software\Microsoft\Internet Explorer\Approved Extensions	Explorrer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{3543619C-D563-43f7-95EA-4DA7E1CC396A} = 51667a6c4c1d3b1b003ad2d87fc9ac0780c431c2a3933e7f	Explorrer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\ = "IE MANAGER"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\IE\\bho.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe
540	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe
936	Explorrer.exe
3984	Explorrer.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 4476 wrote to memory of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 4476 wrote to memory of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 4476 wrote to memory of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 4476 wrote to memory of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 4476 wrote to memory of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 4476 wrote to memory of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 4476 wrote to memory of 540	4476	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	97
PID 540 wrote to memory of 936	540	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	98
PID 540 wrote to memory of 936	540	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	98
PID 540 wrote to memory of 936	540	96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe	98
PID 936 wrote to memory of 3984	936	Explorrer.exe	101
PID 936 wrote to memory of 3984	936	Explorrer.exe	101
PID 936 wrote to memory of 3984	936	Explorrer.exe	101
PID 936 wrote to memory of 3984	936	Explorrer.exe	101
PID 936 wrote to memory of 3984	936	Explorrer.exe	101
PID 936 wrote to memory of 3984	936	Explorrer.exe	101
PID 936 wrote to memory of 3984	936	Explorrer.exe	101
PID 936 wrote to memory of 3984	936	Explorrer.exe	101
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 936 wrote to memory of 4380	936	Explorrer.exe	102
PID 3984 wrote to memory of 948	3984	Explorrer.exe	103
PID 3984 wrote to memory of 948	3984	Explorrer.exe	103
PID 3984 wrote to memory of 948	3984	Explorrer.exe	103
PID 3984 wrote to memory of 948	3984	Explorrer.exe	103
PID 3984 wrote to memory of 948	3984	Explorrer.exe	103
PID 4380 wrote to memory of 4076	4380	Explorrer.exe	108
PID 4380 wrote to memory of 4076	4380	Explorrer.exe	108
PID 4380 wrote to memory of 4076	4380	Explorrer.exe	108
PID 4380 wrote to memory of 5000	4380	Explorrer.exe	109
PID 4380 wrote to memory of 5000	4380	Explorrer.exe	109
PID 4380 wrote to memory of 5000	4380	Explorrer.exe	109

C:\Users\Admin\AppData\Local\Temp\96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe
"C:\Users\Admin\AppData\Local\Temp\96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe
  "C:\Users\Admin\AppData\Local\Temp\96516750a7c8bbcbbca7d78dc3575bda1ad974ec4c1401b1ed6764e65670115a.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
    C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
      "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3984
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        5⤵
        Gathers network information
        
        PID:948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 272
        6⤵
        Program crash
        
        PID:4588
  - - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
      "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /u /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
        5⤵
        Loads dropped DLL
        
        PID:4076
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
        5⤵
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Modifies registry class
        
        PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 948 -ip 948
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Explorrer.exe

Path C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
Size 504KB
SHA256 fce5fc6196d3406d86213cdced4b902db32419b75bd3684947e414c39eaffe3b
MD5 9fb49cb4d7a6460112ae02d1d2b48bd6
SHA1 01c7d74bd82238be571b56870c73abf438157890
SHA512 aa69f341529c6f0ed927ab88fc72e04252d63f6be24474b5a13a365a295b618bfa4eef9d8fbb515a57084ed6a81191108e8bd9466964990c0c5dd60e3f6cbc70
SSDEEP 12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bho.dll

Path C:\Users\Admin\AppData\Roaming\IE\bho.dll
Size 87KB
SHA256 976540cf1b4d04d80be1f1af8ea0f050c3f03a0a8c4e339589b7bb9180fc07f5
MD5 49a92a33d1775b45b3bd45f8bec24585
SHA1 ea404af50bbdad5cbc9f95f4068bdc30c9fceff6
SHA512 7d5c4ea5c6f950a41bff386289df88b3f6d78444d7eeaa8a426569ce7698c2dfa916ae02d321af2be839c20e53b2ba9b3bb6a1573cad3b578733b082f0dc292f
SSDEEP 1536:ETw4mDklLqIaqhQ2MQXDn0Nzy8XTgUYV6uSXyV29fS1SWeITo:EmCLHaqWQXDn0NzutNtV29fS1HeITo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-24-0x0000000000410000-0x00000000004D9000-memory.dmp

Download

memory/540-7-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/540-9-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/540-26-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/936-33-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/936-36-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/936-39-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/936-27-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/936-21-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3984-60-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4380-98-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-91-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-171-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-38-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-40-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-50-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-48-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-47-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-46-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-45-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-44-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-43-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-42-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-63-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-37-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-64-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-53-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-34-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-65-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-90-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-99-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-67-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-97-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-66-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-96-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-95-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-94-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-93-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-92-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-68-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-89-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-88-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-87-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-86-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-84-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-85-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-83-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-82-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-81-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-80-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-79-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-78-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-77-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-76-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-75-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-74-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-73-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-72-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-71-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-70-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4380-69-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4476-14-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4476-6-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/4476-0-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4476-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4476-4-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4476-11-0x0000000002C60000-0x0000000002C61000-memory.dmp

Download

memory/4476-3-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4476-10-0x0000000002C50000-0x0000000002C51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads