308dc0ade542084c5f405bf2e5a5ee55b23bd3810d065b89f371de7e8ed7a944

General

Target

715def28a44ff76b4f4328ebb0befe60.exe
Size

39KB
MD5

715def28a44ff76b4f4328ebb0befe60
SHA1

9a9ec1abe6e58a57c786c7e392075d315d3a1759
SHA256

308dc0ade542084c5f405bf2e5a5ee55b23bd3810d065b89f371de7e8ed7a944
SHA512

8b9523fae2df5c4217e546b70a952007ab51e1c53d969b6132993f6fc3e795c4c6cf2bb11812a4ae0b98ecd830a92a470a912bbb9ccbe3cc69eb6243b27b3ff9
SSDEEP

768:sHyHc4qO+ZZF4FwktC6VIsH3ABrggoLkgSSqr/Fg0BxFn0j/zx:37+ZD4FDM67HQVgL9qjFgKKd

Score

7^/10

adware defense_evasion discovery stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0005000000011c2f-2.dat	acprotect

Deletes itself 1 IoCs

pid	Process
2772	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2776	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000011c2f-2.dat	upx
behavioral1/memory/2776-4-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}	715def28a44ff76b4f4328ebb0befe60.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	715def28a44ff76b4f4328ebb0befe60.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\stfa.dll	715def28a44ff76b4f4328ebb0befe60.exe
File created	C:\Windows\SysWOW64\sft.res	715def28a44ff76b4f4328ebb0befe60.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	715def28a44ff76b4f4328ebb0befe60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	715def28a44ff76b4f4328ebb0befe60.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	715def28a44ff76b4f4328ebb0befe60.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	715def28a44ff76b4f4328ebb0befe60.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	715def28a44ff76b4f4328ebb0befe60.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}	715def28a44ff76b4f4328ebb0befe60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}\ = "Microsoft copyright"	715def28a44ff76b4f4328ebb0befe60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}\InprocServer32	715def28a44ff76b4f4328ebb0befe60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}\InprocServer32\ = "stfa.dll"	715def28a44ff76b4f4328ebb0befe60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}\ProgID	715def28a44ff76b4f4328ebb0befe60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}\ProgID\ = "MS"	715def28a44ff76b4f4328ebb0befe60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}\TypeLib	715def28a44ff76b4f4328ebb0befe60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}\InprocServer32\ThreadingModel = "Apartment"	715def28a44ff76b4f4328ebb0befe60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}\TypeLib\ = "{962D5849-454A-42f9-929D-4CB957385178}"	715def28a44ff76b4f4328ebb0befe60.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2776	2664	715def28a44ff76b4f4328ebb0befe60.exe	30
PID 2664 wrote to memory of 2776	2664	715def28a44ff76b4f4328ebb0befe60.exe	30
PID 2664 wrote to memory of 2776	2664	715def28a44ff76b4f4328ebb0befe60.exe	30
PID 2664 wrote to memory of 2776	2664	715def28a44ff76b4f4328ebb0befe60.exe	30
PID 2664 wrote to memory of 2776	2664	715def28a44ff76b4f4328ebb0befe60.exe	30
PID 2664 wrote to memory of 2776	2664	715def28a44ff76b4f4328ebb0befe60.exe	30
PID 2664 wrote to memory of 2776	2664	715def28a44ff76b4f4328ebb0befe60.exe	30
PID 2664 wrote to memory of 2772	2664	715def28a44ff76b4f4328ebb0befe60.exe	31
PID 2664 wrote to memory of 2772	2664	715def28a44ff76b4f4328ebb0befe60.exe	31
PID 2664 wrote to memory of 2772	2664	715def28a44ff76b4f4328ebb0befe60.exe	31
PID 2664 wrote to memory of 2772	2664	715def28a44ff76b4f4328ebb0befe60.exe	31

C:\Users\Admin\AppData\Local\Temp\715def28a44ff76b4f4328ebb0befe60.exe
"C:\Users\Admin\AppData\Local\Temp\715def28a44ff76b4f4328ebb0befe60.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s stfa.dll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\715DEF~1.EXE >> NUL
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\stfa.dll

Filesize
28KB

MD5
8d68faa86d4d5247a9835f79d0244731

SHA1
9104fc9f4a76b784322ebeb2419899ba31eff0c3

SHA256
cf91173c394a96c3ea26bef3d50e1129a410aa3dfb181dc45cba1422fb219556

SHA512
60a6ad885975c02ba7b331ca9e0a97407ea5d3b47be76b862a21820ebe9b2437c9bcc322b63a76b282d22094a99c02ea6d164852a02095891bef177102ff9835

Download Submit
memory/2776-4-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads