59c995dd4d2e86e4fb4f34f353fd0b8a23f44a2774599a1e864514d0f74e6ae7

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UrlUpdate.exe
Size 152KB
Sample240620-pczehs1bpr
SHA256 94a6a81ad5c12aec33d7274e43ed8197cd476bb9680724995631fd971e8a3d86
MD5 df4c70adfe3ee8e7d0a7d396754681ea
SHA1 86d6bc8e6961a01aa689909d678512e0e3bc202c
SHA512 94e8fa6c92cbb30320b2067158549e6079be66489c4a2c8008ec7675d9135cddd477137b3c08fe7e7a41d2da6fcc3732d9ae10e8bc47226108938249fa33fa4e
SSDEEP 3072:T6npLFsb893Sn3dkJht04WD2spOL/KGKlhcpguZh5pXK1zZcsbAM:+0nNke4WdUL/KGKlhcpguZHpXK1z0M
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3104	urlupdate1.exe

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}	REG.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}	ntmurl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\NoExplorer	ntmurl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}	ntmurl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}\NoExplorer	ntmurl.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NSearcher.exe	ntmurl.exe
File opened for modification	C:\Windows\SysWOW64\NSearcher.exe	ntmurl.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Netimo\NSearcher\NSearcher.exe	ntmurl.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3612	sc.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{72CEEE43-C350-4932-B3DC-B6201F01EFCB}"	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Approved Extensions	REG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{D815AB8A-E840-4054-B37D-943893116452} = 51667a6c4c1d3b1b9ab706c47fbe3308ab73df7897532547	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}	REG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Explorer Bars	REG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\Codepage = "949"	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\DisplayName = "¾ßÈÄ"	ntmurl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{6A294C45-07CC-426C-9512-6742053E462C} = 51667a6c4c1d3b1b55503a76f3510b0a8d1c2c02017c0739	REG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "1000"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)\ = "res://C:\\Users\\Admin\\AppData\\Local\\Temp\\ntmurl.dll/SEARCH.HTM"	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}	REG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}\BarSize = dc00000000000000	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\SearchScopes	ntmurl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{67C41E9E-2EBF-4F2B-AF74-314F0D793172} = 51667a6c4c1d3b1b8e02d77b80784c07b77a7a0f093b7067	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\MAO Settings	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\URL = "http://search.netimo.net/ntmsearch.html?where=all&cp=ezsearch&adv=yahoo&type=forward&ssupply=1&q={searchTerms}"	ntmurl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{72CEEE43-C350-4932-B3DC-B6201F01EFCB} = 51667a6c4c1d3b1b53f2dd6e6f955501abd2fd601b43aede	REG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)\contexts = "48"	ntmurl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}	REG.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B07FABA-099B-4D62-9780-D254A04E32F5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A2B988C-5F30-47F7-97DA-0888B9FA0D15}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ntmurl.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CSideBar\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{044D0F63-C274-40B2-8F50-F09A06DCFBE1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D00D2AA-A077-4914-A046-62E2A7BA9C11}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A625F501-206F-4713-9DE1-DD3AF4AC4BF9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA8A473-BB88-4DDC-AB67-0EE6BF4788A9}\ProgID\ = "ntmURL.IInputObjectCallback"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{884DA533-61D6-43BD-AF00-BB3E961BFD29}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{323EDAF0-DD73-47E1-9C77-76261365F2A6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7BFE371-AB4F-48A9-8E4B-746CDC3377F0}\VERSION\ = "1045.4"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{884DA533-61D6-43BD-AF00-BB3E961BFD29}\Programmable	ntmurl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{044D0F63-C274-40B2-8F50-F09A06DCFBE1}\TypeLib\Version = "415.4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{149BD92F-B28E-4C04-8B4D-46CDD176B7E4}\Forward	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA8A473-BB88-4DDC-AB67-0EE6BF4788A9}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E72183BD-2FD6-4FEC-A806-BB3DE07A5E35}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{884DA533-61D6-43BD-AF00-BB3E961BFD29}\ = "ntmURL.CSideBar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.CSideBar	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E81505D-47A7-471B-B348-07BDA6159756}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD708967-6D59-4C25-90CE-22C6C7B1B9CE}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CSideBar\ = "efindersidebar.CSideBar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E9BF828-7362-4850-9FE7-59E26521AC34}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F16DB30-C562-41AD-A3B3-4D405BBBEFEE}\ = "_ISubclass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E72183BD-2FD6-4FEC-A806-BB3DE07A5E35}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{738A3C47-189C-4B96-8ACE-985DD34AFF17}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.GSubclass\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\efsbar.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C6E6B197-9348-449E-A149-384B208874B1}\415.4\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B07FABA-099B-4D62-9780-D254A04E32F5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD8BFC7F-4A69-4C23-B496-78B301B5193F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.CSBCriteria\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A2B988C-5F30-47F7-97DA-0888B9FA0D15}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\ = "efindersidebar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA496C82-EF15-498A-9281-71C17D2E83B1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{323EDAF0-DD73-47E1-9C77-76261365F2A6}\ProgID\ = "ntmURL.ISubclass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E72183BD-2FD6-4FEC-A806-BB3DE07A5E35}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F16DB30-C562-41AD-A3B3-4D405BBBEFEE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.CTimer\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E72183BD-2FD6-4FEC-A806-BB3DE07A5E35}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E72183BD-2FD6-4FEC-A806-BB3DE07A5E35}\ = "CHandler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{044D0F63-C274-40B2-8F50-F09A06DCFBE1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA496C82-EF15-498A-9281-71C17D2E83B1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E9BF828-7362-4850-9FE7-59E26521AC34}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ = "CSideBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F16DB30-C562-41AD-A3B3-4D405BBBEFEE}\ = "_ISubclass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F16DB30-C562-41AD-A3B3-4D405BBBEFEE}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{738A3C47-189C-4B96-8ACE-985DD34AFF17}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C6E6B197-9348-449E-A149-384B208874B1}\415.4\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F16DB30-C562-41AD-A3B3-4D405BBBEFEE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ = "_CSideBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\efsbar.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\ = "ezsearch"	ntmurl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD8BFC7F-4A69-4C23-B496-78B301B5193F}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E9BF828-7362-4850-9FE7-59E26521AC34}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A2B988C-5F30-47F7-97DA-0888B9FA0D15}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C36516DD-9577-4347-B0DC-D3641BDBEB36}\TypeLib\Version = "415.4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA496C82-EF15-498A-9281-71C17D2E83B1}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{323EDAF0-DD73-47E1-9C77-76261365F2A6}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
3104	urlupdate1.exe
2316	nnlogon.exe
2316	nnlogon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	nnlogon.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2908	UrlUpdate.exe
3104	urlupdate1.exe
1724	ntmurl.exe
3736	UrlUpdate.exe
2852	iewindow.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3104	2908	UrlUpdate.exe	83
PID 2908 wrote to memory of 3104	2908	UrlUpdate.exe	83
PID 2908 wrote to memory of 3104	2908	UrlUpdate.exe	83
PID 3104 wrote to memory of 1724	3104	urlupdate1.exe	87
PID 3104 wrote to memory of 1724	3104	urlupdate1.exe	87
PID 3104 wrote to memory of 1724	3104	urlupdate1.exe	87
PID 1724 wrote to memory of 4908	1724	ntmurl.exe	88
PID 1724 wrote to memory of 4908	1724	ntmurl.exe	88
PID 1724 wrote to memory of 4908	1724	ntmurl.exe	88
PID 1724 wrote to memory of 3924	1724	ntmurl.exe	89
PID 1724 wrote to memory of 3924	1724	ntmurl.exe	89
PID 1724 wrote to memory of 3924	1724	ntmurl.exe	89
PID 1724 wrote to memory of 3612	1724	ntmurl.exe	90
PID 1724 wrote to memory of 3612	1724	ntmurl.exe	90
PID 1724 wrote to memory of 3612	1724	ntmurl.exe	90
PID 1724 wrote to memory of 4896	1724	ntmurl.exe	91
PID 1724 wrote to memory of 4896	1724	ntmurl.exe	91
PID 1724 wrote to memory of 4896	1724	ntmurl.exe	91
PID 1724 wrote to memory of 556	1724	ntmurl.exe	94
PID 1724 wrote to memory of 556	1724	ntmurl.exe	94
PID 1724 wrote to memory of 556	1724	ntmurl.exe	94
PID 2316 wrote to memory of 3736	2316	nnlogon.exe	97
PID 2316 wrote to memory of 3736	2316	nnlogon.exe	97
PID 2316 wrote to memory of 3736	2316	nnlogon.exe	97
PID 1724 wrote to memory of 2504	1724	ntmurl.exe	98
PID 1724 wrote to memory of 2504	1724	ntmurl.exe	98
PID 1724 wrote to memory of 2504	1724	ntmurl.exe	98
PID 1724 wrote to memory of 2032	1724	ntmurl.exe	100
PID 1724 wrote to memory of 2032	1724	ntmurl.exe	100
PID 1724 wrote to memory of 2032	1724	ntmurl.exe	100
PID 1724 wrote to memory of 4288	1724	ntmurl.exe	102
PID 1724 wrote to memory of 4288	1724	ntmurl.exe	102
PID 1724 wrote to memory of 4288	1724	ntmurl.exe	102
PID 1724 wrote to memory of 2852	1724	ntmurl.exe	104
PID 1724 wrote to memory of 2852	1724	ntmurl.exe	104
PID 1724 wrote to memory of 2852	1724	ntmurl.exe	104

C:\Users\Admin\AppData\Local\Temp\UrlUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\UrlUpdate.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\urlupdate1.exe
  C:\Users\Admin\AppData\Local\Temp\urlupdate1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Users\Admin\AppData\Local\Temp\ntmurl.exe
    C:\Users\Admin\AppData\Local\Temp\ntmurl.exe install scope addressbar
    3⤵
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\ntmurl.dll"
      4⤵
      Modifies registry class
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\nnlogon.exe
      "C:\Users\Admin\AppData\Local\Temp\nnlogon.exe" -i
      4⤵
      PID:3924
  - - C:\Windows\SysWOW64\sc.exe
      sc start efinderservice
      4⤵
      Launches sc.exe
      PID:3612
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\efsbar.dll"
      4⤵
      Modifies registry class
      PID:4896
  - - C:\Windows\SysWOW64\REG.exe
      REG IMPORT "C:\Users\Admin\AppData\Local\Temp\sbinstall.reg"
      4⤵
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      PID:556
  - - C:\Windows\SysWOW64\REG.exe
      REG IMPORT "C:\Users\Admin\AppData\Local\Temp\sbinstall.reg"
      4⤵
      Modifies Internet Explorer settings
      PID:2504
  - - C:\Windows\SysWOW64\REG.exe
      REG IMPORT "C:\Users\Admin\AppData\Local\Temp\bbuninstall.reg"
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\REG.exe
      REG IMPORT "C:\Users\Admin\AppData\Local\Temp\appext.reg"
      4⤵
      Modifies Internet Explorer settings
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\iewindow.exe
      C:\Users\Admin\AppData\Local\Temp\iewindow.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2852

C:\Users\Admin\AppData\Local\Temp\nnlogon.exe
C:\Users\Admin\AppData\Local\Temp\nnlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\UrlUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\UrlUpdate.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

appext.reg

Path C:\Users\Admin\AppData\Local\Temp\appext.reg
Size 1KB
SHA256 c23dc16f219dc1c20150075a49484c443913e64b3b0f1dddf93a48e66af8d406
MD5 18f5649858c70154f4f36456ef43b52e
SHA1 77b105491d6e26949fb4f0a9218a5c4b684f342f
SHA512 1eec6f7f165d5daf8e58e8d20999f322889a65e5ef9947fbf61f3f4670c0172740a26d8b8eb7ad87bd3fdac292a75e42fab6c2b19a9ef08b1caffa9131ff7eee
MD5 SHA1 SHA512

Submit Download

autoup.ini

Path C:\Users\Admin\AppData\Local\Temp\autoup.ini
Size 754B
SHA256 c75f48b727d55d10b053ad1f0b11d1c02ae10f5ff7805241f985c4d7e7aa013c
MD5 3fe0b373f88e0f5f60e6c6638ed1d67a
SHA1 48145c7ae3e6016852faffd454db00a31ed0957e
SHA512 f0b992c20f72816442d95d52b62caff46e7b3c75b4fe79633602f6dd508aaa69c16c84fb7c5ec265d2d66632d48b54b990d1af6da181eede39c2dfa5aab646e2
MD5 SHA1 SHA512

Submit Download

bbuninstall.reg

Path C:\Users\Admin\AppData\Local\Temp\bbuninstall.reg
Size 442B
SHA256 3f0c9bf08a9cdcdb96c2401271dc2bf0316adc6d4b01dde12c0d9da32594690d
MD5 d1b9ce8ba9d227e61b8200e837a791da
SHA1 5ae250f8c2191376d9a07d80c356cedf976a7575
SHA512 265d60be34fa0457e7a7073ccfacf7748b8bddf003589cc53e6e9f2d055a0b442fe21521b78d2e2321faeab7f401eeca7d7f32b3ba65c8d64fdaa521b243965c
MD5 SHA1 SHA512

Submit Download

nautoup.log

Path C:\Users\Admin\AppData\Local\Temp\nautoup.log
Size 584B
SHA256 6059c8e64f71e5ebe3d8fbb6197ef01091095e3bd1ab065ae726616b793cf290
MD5 1303ac8bf4e4c57a3d31423b74f36fcc
SHA1 a4e5203f33fe6861f0719a38adbd53e973d2f244
SHA512 758666500bd628e8795d9ac4ff994ba69c515669614321226ffdf1c15e12ef08daf7c83dd823c36fd7de9fb1923a480133d37a3fb3b98d54df52a9f5b820ca09
MD5 SHA1 SHA512

Submit Download

nnlogon.ini

Path C:\Users\Admin\AppData\Local\Temp\nnlogon.ini
Size 324B
SHA256 3447a237c8d3c323476c6546a6fa915c12e6dc09741428c4f0062412cabedd7d
MD5 538db3509cc0579e39a151e618cc0cdd
SHA1 382d4259c2ec86e5ad33b94a5d9601007383aa4e
SHA512 c64cedb604536a6390b5a79529fd85227288d00340e528e5cde5bf1c978d57ad8701171dfe90c2eb9286e9f25a8e9675c47ff44f064bcee421d258835289ebf1
MD5 SHA1 SHA512

Submit Download

nnlogon.log

Path C:\Users\Admin\AppData\Local\Temp\nnlogon.log
Size 382B
SHA256 59675f2e6c13a7cb80ff3f7f1a14a35b5d5a7639740cb03b3a09c78922225db5
MD5 79a12fafd892542046b300ffcff70aa1
SHA1 999b132d2d7005b5bc5d7911e1f5cf2277e28bff
SHA512 786d2703bebd10453efb0ebed6b14fc40d4aeb080240e85516300eb01db3dbbee6e2bb5c88ee396de3dcdc4d45c8a40d4a5bd59516da6578124e062cbd2e3687
MD5 SHA1 SHA512

Submit Download

nnlogon.log

Path C:\Users\Admin\AppData\Local\Temp\nnlogon.log
Size 623B
SHA256 ce77b91cf729e56499153f1f67ecd4837fc1c5300b7c08ad7907c3840ce87086
MD5 171920d4bd5e13fd006a69afdc293138
SHA1 1ed15c38c61f9e2173af446fab10e80947b6b6da
SHA512 2de6f95a3bce21fcc1f3595c4cb44d1829c880ee77b5778b61b9ca6e6d70be1c27032cf70aee9aecc76ed11e08b5c46634b88b1cc887eb687ab7cdcc757d80f5
MD5 SHA1 SHA512

Submit Download

nnlogon.log

Path C:\Users\Admin\AppData\Local\Temp\nnlogon.log
Size 902B
SHA256 426eaac2896eb60b60c197c3f519a271cc3966a18ac000fb037f0e5281a3f8cf
MD5 6a6d2982402304044100e0c1351f3873
SHA1 66851b002d3f615b7ce99e18afa68a2dc952ca1f
SHA512 53f86275325ced89947723d9947f278ec5eb3ef3e48389c6886d28b6eda63653be23e62edfeb94f200ffb6ffdfb4ef060e441d2fb43d80d1ae4b9ce021c698ab
MD5 SHA1 SHA512

Submit Download

sbinstall.reg

Path C:\Users\Admin\AppData\Local\Temp\sbinstall.reg
Size 830B
SHA256 a89c9dcc2775d7b98f177fd55c553e5b00d1800a59322e1e1e854a79620868ae
MD5 99efeac3859992432d0973cbac6e9b30
SHA1 6f987006f2fe72031084bb86e18ed2f7ba4807e6
SHA512 42c441aade296c8acce5d424b919e14476d0da84a552dba118c7487415540020687fe290849214dc8067fdbc35a7a6002cd687faf048d7d2e495fd476b3788e3
MD5 SHA1 SHA512

Submit Download

sbinstall.reg

Path C:\Users\Admin\AppData\Local\Temp\sbinstall.reg
Size 324B
SHA256 2e58e8a351d814537317d27c339272ec69e611daa63c7df80a3dc8666096fc98
MD5 058f2758bb8063271a5c5c6257ea9cd2
SHA1 6928513ee55a2a32871c08f1a3aa890c6147b074
SHA512 0bc4a847b8aaf00f596ef97a9942882a224397b5af52628417695724d4b9dec07547f48003c902493e71832c1622305736d7119e5a278822ab55cfccef1df1a7
MD5 SHA1 SHA512

Submit Download

tags.mdb

Path C:\Users\Admin\AppData\Local\Temp\tags.mdb
Size 232KB
SHA256 c6e3f64ebaf43964a00c98796522b085343dfe2529b0dfe1bc36fd5756a39d0a
MD5 a4ea7e4d9a755fd0c573acc55155e535
SHA1 9725c3d410ac1d57985f74b72ae7dbbfc9f14bc2
SHA512 a5b8c3537368a358816cd0e72257e0955988ea36f631b270433c0d01393ae03be8a192767c7b743873d3f9c833821043f0a4860453d7a35118e72ef2aae62e54
SSDEEP 384:wHFLz6Wrd8VyXQR2fbPrWpd9Xj5cFFDXFBE6W:wlXQR2wyDXfE6W
MD5 SHA1 SHA512 SSDEEP

Submit Download

urlupdate1.exe

Path C:\Users\Admin\AppData\Local\Temp\urlupdate1.exe
Size 152KB
SHA256 94a6a81ad5c12aec33d7274e43ed8197cd476bb9680724995631fd971e8a3d86
MD5 df4c70adfe3ee8e7d0a7d396754681ea
SHA1 86d6bc8e6961a01aa689909d678512e0e3bc202c
SHA512 94e8fa6c92cbb30320b2067158549e6079be66489c4a2c8008ec7675d9135cddd477137b3c08fe7e7a41d2da6fcc3732d9ae10e8bc47226108938249fa33fa4e
SSDEEP 3072:T6npLFsb893Sn3dkJht04WD2spOL/KGKlhcpguZh5pXK1zZcsbAM:+0nNke4WdUL/KGKlhcpguZHpXK1z0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

nautoup.log

Path C:\nautoup.log
Size 218B
SHA256 7b2fe12a63aa0b255d7a8b03f1985c62aa6ff5b440bb60e29841b5cecebaae73
MD5 66c232297228c6b49651f0d79c732afc
SHA1 d016ab811977819ffddfaf804abaf12339ccd6cc
SHA512 5133c95724d63018d6bfb41834fa7849e3aec3a979628ed83628a241671635bd27fee379e17926b6b6e3b61e7c72b664762f83c2a72acb657d9f5d4dee579cba
MD5 SHA1 SHA512

Submit Download

nautoup.log

Path C:\nautoup.log
Size 265B
SHA256 f06defcb1a491b48e22bf9b56a165b39a3b8274e11c0049edf73487bb42ae13e
MD5 454e56db327463a0f6228977a1967ee5
SHA1 574eff1eb129ddb239abb1551246ab1a99871037
SHA512 08dcd3a370b39bfbd655ba65358e808b0564b8ce590b31758ce278f07e015282c4a8d5425e3b5b7c018fd79a569ea8c6c684de7de4b5607e580a347f40253d10
MD5 SHA1 SHA512

Submit Download