Overview

overview

6

Static

static

1

SecuriteIn...54.exe

windows7-x64

6

SecuriteIn...54.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    146s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 01:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe

  • Size

    3.2MB

  • MD5

    2d083e880e7dc3554f2561bcf21cd23d

  • SHA1

    8aa9e9f69636a354722cf7e3fc391e9a510e19c9

  • SHA256

    6b3f1414d14cda0b582420ffe7f1484356882fcc21e7fb1a19ab86008ca57b70

  • SHA512

    7a390b76401823cef95dcab3a2c6ae21fc958f3a1dbb7384183ee4cd2698debf37a7c4802b8a56ae62a5c6924c3cb6b99d4cb4e07453633622d807e43d361379

  • SSDEEP

    49152:zqe3f6Rz4O5RLa6I8SwvMHDB+q0gabxS5xru87+DjqVX5rIJwI2J5PiH7nBGtm:uSiRz4iRPsA9f85xSLjgJLTiH7BUm

Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 15 IoCs
    evasionspywaretrojan
  • Script User-Agent 5 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Users\Admin\AppData\Local\Temp\is-NFJBK.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NFJBK.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp" /SL5="$30132,2484213,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg3NjksImRpc3RpbmN0X2lkIjoiMDYwNzkzQkMtOUVCMy00OEM4LUE4MzEtNjE3NEY3RkNENUVCIiwiZGVmYXVsdF9icm93c2VyIjoiIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImEiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Users\Admin\AppData\Local\Temp\is-38BAG.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-38BAG.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp" /SL5="$40172,2484213,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg3NjksImRpc3RpbmN0X2lkIjoiMDYwNzkzQkMtOUVCMy00OEM4LUE4MzEtNjE3NEY3RkNENUVCIiwiZGVmYXVsdF9icm93c2VyIjoiIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImEiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2756
          • C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe
            "C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg3NjksImRpc3RpbmN0X2lkIjoiMDYwNzkzQkMtOUVCMy00OEM4LUE4MzEtNjE3NEY3RkNENUVCIiwiZGVmYXVsdF9icm93c2VyIjoiIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImEiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2540
            • C:\Users\Admin\AppData\Local\Temp\is-M6BCH.tmp\OneLaunch Setup_.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-M6BCH.tmp\OneLaunch Setup_.tmp" /SL5="$2019E,105340057,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg3NjksImRpc3RpbmN0X2lkIjoiMDYwNzkzQkMtOUVCMy00OEM4LUE4MzEtNjE3NEY3RkNENUVCIiwiZGVmYXVsdF9icm93c2VyIjoiIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImEiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system certificate store
              • Suspicious behavior: GetForegroundWindowSpam
              PID:2604

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    001e8415fab99e0bc7275a96dd497d90

    SHA1

    62f09eb71a0b447b0f8a69d644facc8b8a6eb2fe

    SHA256

    de5fe24b3107e61f6466c3cf6c70f49482026e4699135d9bcb93f0ca28d87532

    SHA512

    c26f1937b35bba7ef8e38c07b6e4bc83cf6a640f4469c8a391c1fbb74b1c2eeea6275c89956935c08535c6ecac525cffb373c1ba90242071a8aa21fa4b8853b2

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    ed7398a12059f18dd1c1d087cbe9e1dd

    SHA1

    f5c40b9cfb537d7cf2f42dd4c32fcc1481cd92ce

    SHA256

    7f0418d0faf4d720374341461273aca5226c72ba3e68d31e5aa55dcddc21195a

    SHA512

    62e0e12ad98e5221795e11e6f3f452bb999b179f186dfb2256df611580feb34a58db2d11cd01428b203eaa61778975af0a9173fe16f084b17588b07af5f63d97

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    f8f002c255aae767b50b84f633383b58

    SHA1

    72f5c2b8e93c4d8fa527aa08722fd4464de12c1d

    SHA256

    20e9de3f062a4b1d291452e26ed3e72965c98dce92a2fbb29c641ad083624806

    SHA512

    565a91a9e8cca08f1b58d721a747d8a9aadd76f2fcca505a64bfdb563e9e6dbd76308f7fedf6135c24a120689e7cd9bb69995ba3b2a95910640aa58aff5453e7

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    5e964287aaefdf693e267018a48c0bbe

    SHA1

    307fd5edad4b497b723025ff09d26fb5fc3a20cd

    SHA256

    31ee6036159d978385d45a86804759c370e4dcf359fc4b01f49300c5d999f8f4

    SHA512

    bfd4c4266ae14c6a65e553c7bd0ceb92a92d9c4918be044a7cae3d73281eb8becaca18dd56c103ac2bc9dc0c04df1cffafa1ce298a403d895195a7e7be144796

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Cab11ED.tmp
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Tar124E.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-1HT7A.tmp\onelaunch.png
    Filesize

    70KB

    MD5

    d3110fb775ee7fd24426503d67840c25

    SHA1

    54f649c8bf3af2ad3a4d92cd8b1397bad1a49a75

    SHA256

    f8392390dc81756e79ec5f359dbdcac3b4bd219b5188a429b814fc51aabb6e36

    SHA512

    f6b79f728be17c9060edb2df2dac2b0f59a4dffd8c416e7e957bc3fa4696f4237e5969647309f5425a6297f189e351e20c99c642f90d1476050285929657c32f

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-HNFR2.tmp\checkmark-10-dark.png
    Filesize

    371B

    MD5

    33b22a3b44ff331d3eb0f34ccef86a79

    SHA1

    bbc863377473df98400def44a5a95ef7dde6ce2d

    SHA256

    902e9ddc6078297f7034ed362649bff39de484c9616507b336e2d721cd2e9b2c

    SHA512

    2ae6a520a5771adf29f212d3f05f7ce5d8db0189fc2016d959649b4257cef4249eb64dac9b2645f895d2e8c597007cc8412577aef85ad783f6124c9b7a5a65c0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-HNFR2.tmp\min-10-dark.png
    Filesize

    5KB

    MD5

    14ca04108e5ac6a1b8c7a2b689382e44

    SHA1

    f961882b5e83f5fa89b41ba6022723f212a5dbc5

    SHA256

    9cb22401a923dfecafc5f51dacef5cbae440b53b9932217c6bc4626f04920929

    SHA512

    3cdbbaed156b7a3b425a1942691cd76a56700d6429bc3f9a1fe53d74a0c5b43d4089974ef485b3329bfbbab60c573cf09c7acaff3fc3c6ffd0f476414c1262a5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-HNFR2.tmp\min-rest.bmp
    Filesize

    24KB

    MD5

    c32bfc11f1a32bab6a1ed327c8a89e0e

    SHA1

    ad754d278df04ffd70c9f56df0c29a55e2a3a136

    SHA256

    24bee6d5da65dc8a65eb639e3c189f257bc4b231940bd078bbea23ba985eabb5

    SHA512

    1e399845043018a7bbb712683ec445a0d6ac9ba4a16c73d4b5244ecd2a8fb37e98401395d112efd7d5c823dd9bd0d871a1f1282f082084513bbc96c1c6a711c5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-HNFR2.tmp\onelaunch.bmp
    Filesize

    725KB

    MD5

    6a360d71735931f6deed2f1fc0d1e0a0

    SHA1

    3fc9e13a1f8ce21f322fff6df7442153f4d2cb77

    SHA256

    98f2c973df13a6b642274e76f9df0e5c04d213958bddb0693a7c4f689c64dfcb

    SHA512

    6622e09549c9b4ee42a17aa6e819a4be0e7d0d5ab4015336cbb89b1ed5f2ec745c8fa8efec22bc8e948ce5e29640a6609ed693bf8954a0e33e124725dbc3aa7e

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-1HT7A.tmp\Win32Library.dll
    Filesize

    46KB

    MD5

    f801d3a6f441e1475342906bae8b73e8

    SHA1

    e2a5a128afda6b2bfe7ff4c4225b28bf5b0e2aec

    SHA256

    dadb7c8637d9b9d6f0f36b110d324bbeb80e3ccffd8e376235857a0162de090c

    SHA512

    ce893b13b55078059ac7e5898393e14321966a54ee660b29b916baa3de0cfb99aa7d296b26ae566e2ce4321c57a8b2fa38f5a2d567c49a95e363e08705ddbf2a

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-M6BCH.tmp\OneLaunch Setup_.tmp
    Filesize

    3.0MB

    MD5

    81f40127b8567ea5f7d94059751951d7

    SHA1

    750d2616e7f3068171f06f610b2a239b56fa9ad7

    SHA256

    90d52bc27d2fb921014664fe4ae774436d382ae58037a0d58f25bce33b5b551a

    SHA512

    68bb44476c950a37dc90786911c3fa4a28c5bf6af9416ad06e050a421c7e52f68f5b1ebe24d9dea7ca1a5ddbc45632962c9a2133c0aef00b07f063c4ea193bbc

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-NFJBK.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.22854.tmp
    Filesize

    3.0MB

    MD5

    c0e3f092b137ef1604c7e1b31a755e06

    SHA1

    c09c89a30537d2d5f1fe21f46ec1459ec2479a00

    SHA256

    1829c12b58954d0d71389acd73da79d13e2571acd1eeae3cf48273ceaba98d31

    SHA512

    2a1301d966a89b017d8f32084d9061df25bcf7d8a7ebc6da47664c784fd8e523f80b63d2830429b37bab94dcf5337cf689b823fa24280a9a125ab6ddf366e5d1

    Download Submit
  • memory/2272-281-0x0000000003850000-0x0000000003990000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2272-376-0x0000000003850000-0x0000000003990000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2272-318-0x0000000003850000-0x0000000003990000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2272-385-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2272-280-0x0000000003850000-0x0000000003990000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2272-279-0x0000000003850000-0x0000000003990000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2272-263-0x0000000074160000-0x0000000074174000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2272-262-0x0000000004290000-0x00000000042A4000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2272-14-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2408-0-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2408-337-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2408-2-0x0000000000401000-0x00000000004B7000-memory.dmp
    Filesize

    728KB

    Download
  • memory/2408-586-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2540-589-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2540-416-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2604-531-0x0000000070430000-0x0000000070444000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2604-530-0x00000000051D0000-0x00000000051E4000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2604-521-0x0000000003780000-0x00000000038C0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2604-520-0x0000000003780000-0x00000000038C0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2604-590-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2736-587-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2736-380-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2756-588-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download