Overview

overview

10

Static

static

3

616bf95fe0...0N.exe

windows7-x64

10

616bf95fe0...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/08/2024, 09:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    616bf95fe0f8ef817bbfd88a4122b3c0N.exe

  • Size

    260KB

  • MD5

    616bf95fe0f8ef817bbfd88a4122b3c0

  • SHA1

    2049e90d1f10e58862c47cf253268c010eaa7318

  • SHA256

    0e5f9593166a9dd14c097be31a34c1e154436b37bde539921dde57e261ac70b6

  • SHA512

    833349879d3b7157d89b6497f58d62b6c71f5cc46839bd20213d0e420ff2ce2b027a5fb2655c31ad296cf3d445b46d468c683800a7a2aaa0f1a76ca5d0027595

  • SSDEEP

    6144:RyZcAuFcCf38XolyxnDFJ6VNeVt7OUYfjOkT+Ekkr+fOyN1TUMDh:YTOcCf6yVQIdL41f9IWh

Score
10/10
adwarediscoveryevasionpersistencestealertrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\616bf95fe0f8ef817bbfd88a4122b3c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\616bf95fe0f8ef817bbfd88a4122b3c0N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\mooom.msi" /q
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4148
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A0D3BAB866E94D375339E086F3C5DD84
      2⤵
      • UAC bypass
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Program Files (x86)\Internet Explorer\Internet Explorer\Localizar.exe
        "C:\Program Files (x86)\Internet Explorer\Internet Explorer\Localizar.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1016
      • C:\Program Files (x86)\Internet Explorer\Internet Explorer\Localizar.exe
        "C:\Program Files (x86)\Internet Explorer\Internet Explorer\Localizar.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1928
    • C:\Windows\syswow64\MsiExec.exe
      "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Internet Explorer\Internet Explorer\cylx.ocx"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Browser Extensions

1
T1176

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e5780fa.rbs
    Filesize

    12KB

    MD5

    bb4190d1af092431198063431c8bb2dd

    SHA1

    fd0db2e7af4762ff90f2aaa0817817fd0f264e6d

    SHA256

    dd762ab6a32dc96dc670fd630c4f07e4b3a703a955136c31be5e68944cd23cc5

    SHA512

    6c91d72fd7f85ff3f1f7b47ec74fc1ed4bc3fcbd6227b560b984c04a7998ea0669eafa8f14fa2bcd074f067e9b09fca9ceaef4d89b35bfcc888d7f3cd8677904

    Download Submit

  • C:\Program Files (x86)\Internet Explorer\Internet Explorer\Localizar.exe
    Filesize

    20KB

    MD5

    5e20672477949ca5d09a7469755ebefd

    SHA1

    6c8fd50ef41e7a2137fe7fe850b979fe51d37e0b

    SHA256

    8456d79f725956a647d91ac15bd07ff2f3fd59ce304a01e1a725e1539f1a4ff4

    SHA512

    0794562416b504e65c998f19b11820f1f01afef90949ec4dae3c73da0f357c94fb04097130cc1340ac3fd1b68f38fe8d477d129d71e70d439e8b221c1548b7a0

    Download Submit

  • C:\Program Files (x86)\Internet Explorer\Internet Explorer\cylx.ocx
    Filesize

    32KB

    MD5

    1a2a7e92d75005ef141d2574e31325ea

    SHA1

    e77a7f9fece1048fc2cdb264c20d345a4154ef5d

    SHA256

    8e8eb6b3ab2301131ff91d398061ee0ee272cad48b795a3fecfe9357481bd9c7

    SHA512

    0d770c59e56ca6610da9ff74007776ed48bf501a74006ad5e2984fadac563e3a483ba8c929183302df83c12f401a16834e950210abb3fa24c195ac279331ea0f

    Download Submit

  • C:\Program Files (x86)\Internet Explorer\Internet Explorer\fridde.dll
    Filesize

    20KB

    MD5

    9a8338d008a6fa61aed335bcd8e25a74

    SHA1

    9e85dcc46fa5e15f903239426b1b94789c6d7cd9

    SHA256

    35ddb720a070b9bf18119edf612ae0bfa18202cdab35b47e06f33a26613a9652

    SHA512

    fc57ca3197ca4ce1d88d4c101a8adf8c4c03d82385bfe517417050c148e329d52c9423b4392d6d8b3bdd676b6bdbd5d485d03321223bdd2127a271c40b5d937b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\mooom.msi
    Filesize

    387KB

    MD5

    b96b3f7337b054df810a95bd43caa383

    SHA1

    40ca4141189ca7983ad7461253df8906d6dcf5a1

    SHA256

    853ec3662878ad7b77c2f879edaab8296b8b2a4ecde252cc8a0d5d3e3f27276a

    SHA512

    9962fd3d3de4a12eec7b2818b58f3bda349f12fc2786c12da1e0ac06bcac67c354b85a12a224afb1df6aa032f097d9d498f58e80117b79ca3f5a51303027a2cf

    Download Submit

  • C:\Windows\Installer\MSI8174.tmp
    Filesize

    209KB

    MD5

    f6a25d999d9d84f6675e1756da57f3f0

    SHA1

    1a33d32feb96730824996b59d5ba38446ae5d609

    SHA256

    21100a197e3674e9f68a5dd92ed14a15c1b86611bf7003021cb35beaacf23032

    SHA512

    b2fa4013eecd0747e6f7575058140e95a0755030b58156c9c3246cddb62ff141342872b900ba01e4b2551a6f495f414410dc24ff32ed2e7109c21f038a9dbfa0

    Download Submit

  • C:\Windows\Installer\MSI83E8.tmp
    Filesize

    63KB

    MD5

    67cf69315774a0d416a320a3c809bda7

    SHA1

    3fd19a4444f7c649c1714c4f1273be9d6ce6a7b7

    SHA256

    588dd2168b1f16b8af094282ccb9f59304d658d3f10d1f3a9c2f2d045e0d8f38

    SHA512

    546c0a559eaec6de1322ec992deb63eab6865931ce4584610e684c8aa6e3cfcfe0b542c507933ba847d00893eddf443a2fff5a05d112c88f0fdbd2f003afb00b

    Download Submit