Overview

overview

7

Static

static

3

05df8d890e...18.exe

windows7-x64

7

05df8d890e...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$R0.dll

windows7-x64

1

$R0.dll

windows10-2004-x64

1

$R2/NSIS.L...2_.exe

windows7-x64

1

$R2/NSIS.L...2_.exe

windows10-2004-x64

1

$SYSDIR/DWSHK80.dll

windows7-x64

1

$SYSDIR/DWSHK80.dll

windows10-2004-x64

1

$SYSDIR/MSVBVM60.dll

windows7-x64

1

$SYSDIR/MSVBVM60.dll

windows10-2004-x64

1

$SYSDIR/VB6KO.dll

windows7-x64

1

$SYSDIR/VB6KO.dll

windows10-2004-x64

1

$SYSDIR/dwsbc80.dll

windows7-x64

1

$SYSDIR/dwsbc80.dll

windows10-2004-x64

1

$SYSDIR/dw...80.dll

windows7-x64

1

$SYSDIR/dw...80.dll

windows10-2004-x64

1

UrlUpdate.exe

windows7-x64

7

UrlUpdate.exe

windows10-2004-x64

7

efbbar.dll

windows7-x64

1

efbbar.dll

windows10-2004-x64

1

efsbar.dll

windows7-x64

1

efsbar.dll

windows10-2004-x64

1

iewindow.exe

windows7-x64

1

iewindow.exe

windows10-2004-x64

1

nnlogon.exe

windows7-x64

1

nnlogon.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 12:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UrlUpdate.exe
  • Size 152KB
  • Sample240620-pczehs1bpr
  • SHA256 94a6a81ad5c12aec33d7274e43ed8197cd476bb9680724995631fd971e8a3d86
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UrlUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\UrlUpdate.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\urlupdate1.exe
      C:\Users\Admin\AppData\Local\Temp\urlupdate1.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Users\Admin\AppData\Local\Temp\ntmurl.exe
        C:\Users\Admin\AppData\Local\Temp\ntmurl.exe install scope addressbar
        3⤵
        • Installs/modifies Browser Helper Object
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\ntmurl.dll"
          4⤵
          • Modifies registry class
          PID:2596
        • C:\Users\Admin\AppData\Local\Temp\nnlogon.exe
          "C:\Users\Admin\AppData\Local\Temp\nnlogon.exe" -i
          4⤵
            PID:3024
          • C:\Windows\SysWOW64\sc.exe
            sc start efinderservice
            4⤵
            • Launches sc.exe
            PID:2360
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\efsbar.dll"
            4⤵
            • Modifies registry class
            PID:2172
          • C:\Windows\SysWOW64\REG.exe
            REG IMPORT "C:\Users\Admin\AppData\Local\Temp\sbinstall.reg"
            4⤵
            • Installs/modifies Browser Helper Object
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:2876
          • C:\Windows\SysWOW64\REG.exe
            REG IMPORT "C:\Users\Admin\AppData\Local\Temp\sbinstall.reg"
            4⤵
            • Modifies Internet Explorer settings
            PID:1772
          • C:\Windows\SysWOW64\REG.exe
            REG IMPORT "C:\Users\Admin\AppData\Local\Temp\bbuninstall.reg"
            4⤵
              PID:1652
            • C:\Windows\SysWOW64\REG.exe
              REG IMPORT "C:\Users\Admin\AppData\Local\Temp\appext.reg"
              4⤵
              • Modifies Internet Explorer settings
              PID:2740
            • C:\Users\Admin\AppData\Local\Temp\iewindow.exe
              C:\Users\Admin\AppData\Local\Temp\iewindow.exe
              4⤵
              • Suspicious use of SetWindowsHookEx
              PID:1904
      • C:\Users\Admin\AppData\Local\Temp\nnlogon.exe
        C:\Users\Admin\AppData\Local\Temp\nnlogon.exe
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2916
        • C:\Users\Admin\AppData\Local\Temp\UrlUpdate.exe
          C:\Users\Admin\AppData\Local\Temp\UrlUpdate.exe
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:2016

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            appext.reg
            • Path C:\Users\Admin\AppData\Local\Temp\appext.reg
            • Size 1KB
            • SHA256 c23dc16f219dc1c20150075a49484c443913e64b3b0f1dddf93a48e66af8d406
            • MD5 SHA1 SHA512
            Submit Download

            autoup.ini
            • Path C:\Users\Admin\AppData\Local\Temp\autoup.ini
            • Size 727B
            • SHA256 abc682beb1729c68f77000520ad450e2886d56c2a18f17c8b2a010288b1256d2
            • MD5 SHA1 SHA512
            Submit Download

            bbuninstall.reg
            • Path C:\Users\Admin\AppData\Local\Temp\bbuninstall.reg
            • Size 442B
            • SHA256 3f0c9bf08a9cdcdb96c2401271dc2bf0316adc6d4b01dde12c0d9da32594690d
            • MD5 SHA1 SHA512
            Submit Download

            nautoup.log
            • Path C:\Users\Admin\AppData\Local\Temp\nautoup.log
            • Size 371B
            • SHA256 04d97cb853916cbd0235a8ddb4e207ae0cb0271ec594901e1b8b663cc4c88109
            • MD5 SHA1 SHA512
            Submit Download

            nnlogon.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nnlogon.ini
            • Size 324B
            • SHA256 3447a237c8d3c323476c6546a6fa915c12e6dc09741428c4f0062412cabedd7d
            • MD5 SHA1 SHA512
            Submit Download

            nnlogon.log
            • Path C:\Users\Admin\AppData\Local\Temp\nnlogon.log
            • Size 293B
            • SHA256 4ff2c4d3c693930d1ce3629a0c1bc9c3241884ce57a6c7be1898f7302dfbcd83
            • MD5 SHA1 SHA512
            Submit Download

            nnlogon.log
            • Path C:\Users\Admin\AppData\Local\Temp\nnlogon.log
            • Size 382B
            • SHA256 eaddce9e4c2abe79d40a6c1ea16839a26323682af77a3cee9a1a02ee23d89639
            • MD5 SHA1 SHA512
            Submit Download

            nnlogon.log
            • Path C:\Users\Admin\AppData\Local\Temp\nnlogon.log
            • Size 623B
            • SHA256 13377b17e49c0b116cb613b362b95d140aae26a7a56398a15646157f17870cfa
            • MD5 SHA1 SHA512
            Submit Download

            sbinstall.reg
            • Path C:\Users\Admin\AppData\Local\Temp\sbinstall.reg
            • Size 830B
            • SHA256 a89c9dcc2775d7b98f177fd55c553e5b00d1800a59322e1e1e854a79620868ae
            • MD5 SHA1 SHA512
            Submit Download

            sbinstall.reg
            • Path C:\Users\Admin\AppData\Local\Temp\sbinstall.reg
            • Size 324B
            • SHA256 2e58e8a351d814537317d27c339272ec69e611daa63c7df80a3dc8666096fc98
            • MD5 SHA1 SHA512
            Submit Download

            tags.mdb
            • Path C:\Users\Admin\AppData\Local\Temp\tags.mdb
            • Size 232KB
            • SHA256 f959a3fdeacd36bf0a17d78d62639a7d61bda852a572dc508e7eaa5e6c41d1bc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            nautoup.log
            • Path C:\nautoup.log
            • Size 218B
            • SHA256 7e02696b44a9d70e8b672b195fa6c46cf98cb7603c720cd6ef0fc3de0dd41471
            • MD5 SHA1 SHA512
            Submit Download

            nautoup.log
            • Path C:\nautoup.log
            • Size 265B
            • SHA256 0ac1bc2d998caac2463df895fd8ed223be63de79dfba9899a561353104abaada
            • MD5 SHA1 SHA512
            Submit Download

            urlupdate1.exe
            • Path \Users\Admin\AppData\Local\Temp\urlupdate1.exe
            • Size 152KB
            • SHA256 94a6a81ad5c12aec33d7274e43ed8197cd476bb9680724995631fd971e8a3d86
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download