Overview

overview

6

Static

static

1

SecuriteIn...59.exe

windows7-x64

6

SecuriteIn...59.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 01:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe

  • Size

    3.2MB

  • MD5

    2d083e880e7dc3554f2561bcf21cd23d

  • SHA1

    8aa9e9f69636a354722cf7e3fc391e9a510e19c9

  • SHA256

    6b3f1414d14cda0b582420ffe7f1484356882fcc21e7fb1a19ab86008ca57b70

  • SHA512

    7a390b76401823cef95dcab3a2c6ae21fc958f3a1dbb7384183ee4cd2698debf37a7c4802b8a56ae62a5c6924c3cb6b99d4cb4e07453633622d807e43d361379

  • SSDEEP

    49152:zqe3f6Rz4O5RLa6I8SwvMHDB+q0gabxS5xru87+DjqVX5rIJwI2J5PiH7nBGtm:uSiRz4iRPsA9f85xSLjgJLTiH7BUm

Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 15 IoCs
    evasionspywaretrojan
  • Script User-Agent 5 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\is-UJ4JI.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UJ4JI.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp" /SL5="$5014E,2484213,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg4MjYsImRpc3RpbmN0X2lkIjoiMUE4NTg4MUItQkUyQy00QzUxLTk4RjgtQTREOERCQjRCMjY5IiwiZGVmYXVsdF9icm93c2VyIjoiIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImEiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1456
        • C:\Users\Admin\AppData\Local\Temp\is-6TNJI.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-6TNJI.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp" /SL5="$201D8,2484213,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg4MjYsImRpc3RpbmN0X2lkIjoiMUE4NTg4MUItQkUyQy00QzUxLTk4RjgtQTREOERCQjRCMjY5IiwiZGVmYXVsdF9icm93c2VyIjoiIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImEiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe
            "C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg4MjYsImRpc3RpbmN0X2lkIjoiMUE4NTg4MUItQkUyQy00QzUxLTk4RjgtQTREOERCQjRCMjY5IiwiZGVmYXVsdF9icm93c2VyIjoiIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImEiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2844
            • C:\Users\Admin\AppData\Local\Temp\is-ODU08.tmp\OneLaunch Setup_.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-ODU08.tmp\OneLaunch Setup_.tmp" /SL5="$2019C,105340057,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTY0Mjg4MjYsImRpc3RpbmN0X2lkIjoiMUE4NTg4MUItQkUyQy00QzUxLTk4RjgtQTREOERCQjRCMjY5IiwiZGVmYXVsdF9icm93c2VyIjoiIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuMy4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImEiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system certificate store
              • Suspicious behavior: GetForegroundWindowSpam
              PID:2756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    f512c65f65f14708e50c0a81e5afb9e9

    SHA1

    6086cd20ad8427b16c2ec9b16ed601da935ec7ff

    SHA256

    2a455ec198893dd3cdd0a207da11150c4f075aa4c3dbd8168a8daedfbfc8d45a

    SHA512

    b9f55d15973795fbc2536723079497d11489b161ed55fe9c2fe1c0dc8d3c35306312d5345a016c8547d91eb01c989db45f2f437cec986a6a86c4de11c001bb54

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    9eee8f00396cf5719e048db6ae21c79b

    SHA1

    29da2e7c52800ae6abd23328e4613971465c7f2f

    SHA256

    231ac5cfbf233efe8fd7cd7b30992e80722750c9f3ef28baa51dcf82efe03272

    SHA512

    3620121c15bbd5c59953d56192cf9590591c99cdff64e412f8f27d7edda3cba399ebd93a7d7f0cfb55c10cf2daac2215a64793cd9a757d9098f7a244b348a44d

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    448954e8b0ceb20eeacde83fe878e2f7

    SHA1

    baf36647890b233dfd26b2558c8196d7fe0bd581

    SHA256

    4211434d63ded53b1218ea039f8e2e4759b465095646ad505a101575f1186704

    SHA512

    d68318e53a1f6e99a9561ae2b4cedd5578267a82ea0df9669279f35cad24667691e60e7ce935e7cfb137cce3ed23af328560b1463544255208378a6f8275db19

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    80430a6d793afc9a1cab763524711edf

    SHA1

    06ffeece216d00be5133bbffef6ba1f6b5f8d4bc

    SHA256

    c8c9c3137055f07cda99ffddfa020df9a19032048407e747fcf4595a16c13b9f

    SHA512

    a4cbda1a3ca75ef5340a8f06f629d68647da6a7767e124ca54d9dcfd08ab48d6f5b8846bb9c9c350d558f0d0bb529a9b8ffe0c56d5392b515578efb2f4690fc1

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    73a3df2539f793400e0535d00477cd9a

    SHA1

    b3bb1e66a8d994d22d8c6f29b91036e027ad75bf

    SHA256

    da76f75593948a846f14a00affed245f44f2c801521458b29de6729ad1997999

    SHA512

    8b10b363a981414c2486e14b3b507a0827ad18553ccc85cbe1d0a2308239e8cfa594b6cbabc942c51e230256834b4e5c1ca9e0292e7ecdcc8e70dec60abcceb3

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Cab24C2.tmp
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Tar2513.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-84686.tmp\onelaunch.png
    Filesize

    70KB

    MD5

    d3110fb775ee7fd24426503d67840c25

    SHA1

    54f649c8bf3af2ad3a4d92cd8b1397bad1a49a75

    SHA256

    f8392390dc81756e79ec5f359dbdcac3b4bd219b5188a429b814fc51aabb6e36

    SHA512

    f6b79f728be17c9060edb2df2dac2b0f59a4dffd8c416e7e957bc3fa4696f4237e5969647309f5425a6297f189e351e20c99c642f90d1476050285929657c32f

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-DIFKU.tmp\checkmark-10-dark.png
    Filesize

    371B

    MD5

    33b22a3b44ff331d3eb0f34ccef86a79

    SHA1

    bbc863377473df98400def44a5a95ef7dde6ce2d

    SHA256

    902e9ddc6078297f7034ed362649bff39de484c9616507b336e2d721cd2e9b2c

    SHA512

    2ae6a520a5771adf29f212d3f05f7ce5d8db0189fc2016d959649b4257cef4249eb64dac9b2645f895d2e8c597007cc8412577aef85ad783f6124c9b7a5a65c0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-DIFKU.tmp\min-10-dark.png
    Filesize

    5KB

    MD5

    14ca04108e5ac6a1b8c7a2b689382e44

    SHA1

    f961882b5e83f5fa89b41ba6022723f212a5dbc5

    SHA256

    9cb22401a923dfecafc5f51dacef5cbae440b53b9932217c6bc4626f04920929

    SHA512

    3cdbbaed156b7a3b425a1942691cd76a56700d6429bc3f9a1fe53d74a0c5b43d4089974ef485b3329bfbbab60c573cf09c7acaff3fc3c6ffd0f476414c1262a5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-DIFKU.tmp\min-rest.bmp
    Filesize

    24KB

    MD5

    c32bfc11f1a32bab6a1ed327c8a89e0e

    SHA1

    ad754d278df04ffd70c9f56df0c29a55e2a3a136

    SHA256

    24bee6d5da65dc8a65eb639e3c189f257bc4b231940bd078bbea23ba985eabb5

    SHA512

    1e399845043018a7bbb712683ec445a0d6ac9ba4a16c73d4b5244ecd2a8fb37e98401395d112efd7d5c823dd9bd0d871a1f1282f082084513bbc96c1c6a711c5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-DIFKU.tmp\onelaunch.bmp
    Filesize

    725KB

    MD5

    6a360d71735931f6deed2f1fc0d1e0a0

    SHA1

    3fc9e13a1f8ce21f322fff6df7442153f4d2cb77

    SHA256

    98f2c973df13a6b642274e76f9df0e5c04d213958bddb0693a7c4f689c64dfcb

    SHA512

    6622e09549c9b4ee42a17aa6e819a4be0e7d0d5ab4015336cbb89b1ed5f2ec745c8fa8efec22bc8e948ce5e29640a6609ed693bf8954a0e33e124725dbc3aa7e

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-84686.tmp\Win32Library.dll
    Filesize

    46KB

    MD5

    f801d3a6f441e1475342906bae8b73e8

    SHA1

    e2a5a128afda6b2bfe7ff4c4225b28bf5b0e2aec

    SHA256

    dadb7c8637d9b9d6f0f36b110d324bbeb80e3ccffd8e376235857a0162de090c

    SHA512

    ce893b13b55078059ac7e5898393e14321966a54ee660b29b916baa3de0cfb99aa7d296b26ae566e2ce4321c57a8b2fa38f5a2d567c49a95e363e08705ddbf2a

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-ODU08.tmp\OneLaunch Setup_.tmp
    Filesize

    3.0MB

    MD5

    81f40127b8567ea5f7d94059751951d7

    SHA1

    750d2616e7f3068171f06f610b2a239b56fa9ad7

    SHA256

    90d52bc27d2fb921014664fe4ae774436d382ae58037a0d58f25bce33b5b551a

    SHA512

    68bb44476c950a37dc90786911c3fa4a28c5bf6af9416ad06e050a421c7e52f68f5b1ebe24d9dea7ca1a5ddbc45632962c9a2133c0aef00b07f063c4ea193bbc

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-UJ4JI.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.31359.tmp
    Filesize

    3.0MB

    MD5

    c0e3f092b137ef1604c7e1b31a755e06

    SHA1

    c09c89a30537d2d5f1fe21f46ec1459ec2479a00

    SHA256

    1829c12b58954d0d71389acd73da79d13e2571acd1eeae3cf48273ceaba98d31

    SHA512

    2a1301d966a89b017d8f32084d9061df25bcf7d8a7ebc6da47664c784fd8e523f80b63d2830429b37bab94dcf5337cf689b823fa24280a9a125ab6ddf366e5d1

    Download Submit
  • memory/1456-569-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/1456-361-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/1980-568-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/1980-2-0x0000000000401000-0x00000000004B7000-memory.dmp
    Filesize

    728KB

    Download
  • memory/1980-317-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/1980-0-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2068-318-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2068-242-0x0000000005070000-0x0000000005084000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2068-357-0x00000000029A0000-0x0000000002AE0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2068-298-0x00000000029A0000-0x0000000002AE0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2068-465-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2068-8-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2068-243-0x0000000074430000-0x0000000074444000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2068-259-0x00000000029A0000-0x0000000002AE0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2068-260-0x00000000029A0000-0x0000000002AE0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2068-261-0x00000000029A0000-0x0000000002AE0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2108-570-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2756-512-0x00000000045A0000-0x00000000045B4000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2756-513-0x0000000070700000-0x0000000070714000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2756-503-0x00000000029A0000-0x0000000002AE0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2756-502-0x00000000029A0000-0x0000000002AE0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2756-572-0x0000000000400000-0x000000000070A000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2844-396-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/2844-571-0x0000000000400000-0x00000000004E8000-memory.dmp
    Filesize

    928KB

    Download