Overview
overview
7Static
static
3upgrade.exe
windows7-x64
7upgrade.exe
windows10-2004-x64
7$0/browserseek.dll
windows7-x64
1$0/browserseek.dll
windows10-2004-x64
1$0/browserseek.exe
windows7-x64
1$0/browserseek.exe
windows10-2004-x64
1$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 21:30
Static task
static1
Behavioral task
behavioral1
Sample
upgrade.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
upgrade.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$0/browserseek.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$0/browserseek.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$0/browserseek.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
$0/browserseek.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
General
-
Target
upgrade.exe
-
Size
656KB
-
MD5
9072c7ab788ae840d16e5d1669029a97
-
SHA1
7672619eb461756a7e1353e350ec57e9bdafce7c
-
SHA256
3f62c010d1806625a8e2e099d76143ff8d0ef6a09fc02034a022e0ef3b336148
-
SHA512
0fb2b4011759e575831e356d13a6f1208d901c971f04e0e5b8ad99b3a58935784cda18ed7fd03ca9c49dfd59437d7ac960578d03a0da2575236a75017d1b6c4a
-
SSDEEP
12288:5qHsGleIjHQIXLRqomJ8JioWzmNG2APCYSZVrC1iHYuVgVus2zYtZ:5UwKf8omJ8JiPNPCjZVKiHiVhhZ
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1920 browserseek.exe 2004 browserseek.exe 2576 browserseek177.exe 2452 browserseek.exe -
Loads dropped DLL 9 IoCs
pid Process 2384 upgrade.exe 2384 upgrade.exe 2384 upgrade.exe 2384 upgrade.exe 2004 browserseek.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2452 browserseek.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat browserseek177.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V0OHXXQ2.htm browserseek177.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\BrowserSeek\browserseek.dll browserseek.exe File opened for modification C:\Program Files (x86)\BrowserSeek\browserseek.dll browserseek.exe File created C:\Program Files (x86)\BrowserSeek\browserseek.exe browserseek.exe File created C:\Program Files (x86)\BrowserSeek\uninstall.exe upgrade.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x0007000000015cb2-46.dat nsis_installer_1 -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" browserseek177.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" browserseek177.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\WpadDecision = "0" browserseek177.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-e3-83-0f-ea-0b\WpadDecisionReason = "1" browserseek177.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad browserseek177.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02} browserseek177.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\WpadDecisionReason = "1" browserseek177.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\WpadDecisionTime = 70884e2702ccda01 browserseek177.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-e3-83-0f-ea-0b browserseek177.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\86-e3-83-0f-ea-0b browserseek177.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings browserseek177.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 browserseek177.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-e3-83-0f-ea-0b\WpadDecision = "0" browserseek177.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 browserseek177.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-e3-83-0f-ea-0b\WpadDecisionTime = 70884e2702ccda01 browserseek177.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" browserseek177.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" browserseek177.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings browserseek177.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" browserseek177.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F6BF5F85-1140-4F75-9343-6FEE53099C02}\WpadNetworkName = "Network 3" browserseek177.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ browserseek177.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix browserseek177.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections browserseek177.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 browserseek177.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe 2576 browserseek177.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2452 browserseek.exe 2452 browserseek.exe 2452 browserseek.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2384 wrote to memory of 1920 2384 upgrade.exe 28 PID 2384 wrote to memory of 1920 2384 upgrade.exe 28 PID 2384 wrote to memory of 1920 2384 upgrade.exe 28 PID 2384 wrote to memory of 1920 2384 upgrade.exe 28 PID 2384 wrote to memory of 2004 2384 upgrade.exe 29 PID 2384 wrote to memory of 2004 2384 upgrade.exe 29 PID 2384 wrote to memory of 2004 2384 upgrade.exe 29 PID 2384 wrote to memory of 2004 2384 upgrade.exe 29 PID 2576 wrote to memory of 2452 2576 browserseek177.exe 31 PID 2576 wrote to memory of 2452 2576 browserseek177.exe 31 PID 2576 wrote to memory of 2452 2576 browserseek177.exe 31 PID 2576 wrote to memory of 2452 2576 browserseek177.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\upgrade.exe"C:\Users\Admin\AppData\Local\Temp\upgrade.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\nsd6089.tmp\browserseek.exe"C:\Users\Admin\AppData\Local\Temp\nsd6089.tmp\browserseek.exe" "C:\Users\Admin\AppData\Local\Temp\nsd6089.tmp\browserseek.dll" 38266838202⤵
- Executes dropped EXE
PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\nsd6089.tmp\browserseek.exe"C:\Users\Admin\AppData\Local\Temp\nsd6089.tmp\browserseek.exe" "C:\Users\Admin\AppData\Local\Temp\nsd6089.tmp\browserseek.dll" larezobit "" yipopuriba2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2004
-
-
C:\ProgramData\BrowserSeek\browserseek177.exe"C:\ProgramData\BrowserSeek\browserseek177.exe" "C:\Program Files (x86)\BrowserSeek\browserseek.dll" kimupuyi givefokimu1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Program Files (x86)\BrowserSeek\browserseek.exe"C:\Program Files (x86)\BrowserSeek\browserseek.exe" "C:\Program Files (x86)\BrowserSeek\browserseek.dll" puribavape wolizamev2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
560KB
MD583bc9313c669ed8d9a61714a8e0efb10
SHA11b52cdfe847a55ae069df6e64506f7b661271ab2
SHA25673e773968ce0b69521efbfae93376fc0ab96560a9d51f5ff0b5568951f7038a2
SHA5120a5d199b2190fd41d2787deb29532ba9315869c9f9116c6f19739ce0c3ce1e3d2d48f0b113a7255f63185dc3ab9e3ed24e2f8b5260fe8c13a4ec2dc08995332a
-
Filesize
82KB
MD53f0967dccc27c0b022dd6be6a98fa390
SHA1c57846d9800a9cf8c6a39170a6a045dc80d8dd29
SHA2569834d7bfea7dc27409d0cebd59175c00a0ee51b64b558abb26c66fed50bc9825
SHA5121d0bebf9a484ba7727c288156420be9f853537ceebb8d17450646f5e501f2f44d533f31df83c574c0bc8f13c0fe77980d95188a5f5a920cecaf24df8579887f0
-
Filesize
560KB
MD54c0b9b55f9bf6a132ec8e8486e45c951
SHA1d0d90d1a2217d0baa15b45a28a870dac782c3526
SHA256bae5ecfb745db693c801a235ff138da28c3dba149bca29f3c1d35836d8c11d98
SHA5120d4dce0481a1cdffb9f6630ce2a163f100b163cd58d7e3426ca83513ffe0b90aa0373928b2bc1af00aa739843fa740a283ff5df8eea19b3754c0834091fc618d
-
Filesize
48KB
MD5e6f88bb87363c318c22c44d9be58a49d
SHA1fcfb85dec82ccb50d021a5d1f7db04344d9dacbd
SHA25659d9c9197b20786d7ac363ea2dc02c4072ffcc2903fed9ce522149b384fbb890
SHA512d6bc1821c8222304b1a398d7ce514b22a160f4a66cd013dcedd3e0a05cb445b87e883f7115be442e55dd0cba1579cec6413e2c853d6748fbdc17d0b6f3f0b75f