6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29

General

Target

6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe
Size

1.9MB
MD5

c9e2cfabc90b852ebaa9d6fdfa42f3a1
SHA1

de4d9757fdb11bc11fadb3075db9be8070c385b9
SHA256

6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29
SHA512

9a26678e7e79ca26d1e2d9a6682a407e8b29104d2fdcd49b146ac7f9694b157a5bf8150cd8a56ebdfbc5b36936386b5fcabf335f31dc1d672a6cfdffc1269e0f
SSDEEP

49152:dvSzkJnOyQpABa+VsNbwzPBT/afN9L7jRf0uzkf:dqzkbkbhwzAfNN

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
888	NFWCHK.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\MuiCached	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1688	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe
1688	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 888	1688	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe	31
PID 1688 wrote to memory of 888	1688	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe	31
PID 1688 wrote to memory of 888	1688	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe	31
PID 1688 wrote to memory of 888	1688	6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe	31

C:\Users\Admin\AppData\Local\Temp\6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe
"C:\Users\Admin\AppData\Local\Temp\6ea8fe08c69758c8ac557a64eb5766d712b4d33d28172219d25d2cebbcf7dd29.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  2⤵
  - Executes dropped EXE
  PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Filesize
738B

MD5
15b300b96970dff6e06718e0d7d4984b

SHA1
b280fd9e860141b7aa45153fcedff9e17a85dcb2

SHA256
9cdbc084d26dface45e3a797b64c6333aec5d081715663a8a4631ffba1a4b0b0

SHA512
24f5c421d64893aee0468039eb103868594c62f0524f3fe8468f8dcc8539304b6f47ba13edbb378c5dae76bcc23b07fb66a2394afb5b2c6063ede8de11fbf3e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
1KB

MD5
60315859c708e80cc0d8b4e51c927984

SHA1
f21bcc1a620d560913ffd5d51b3e453f02bf8aea

SHA256
1aaa6943fa148adbead92e895f7fef2c7cf2b91f608d1d1f4dc44895e735e895

SHA512
f2882e2a501f7282f7292147322da6d212870bce8745dd8479b92c8342b9f87f9ba8ce9969e3f7bca3ab5a636c79f5c6635ce8472d31c4f31758c3b572d3bdc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
1KB

MD5
161d0ddd423e43beafc34c31a75decee

SHA1
f0f02d361ea0372cdaf2dc00537a5b68af4e0c05

SHA256
e969e6e59d3ebaf02a625751f81afbf00d7697d84500129d90420ef11bf3d7cd

SHA512
41b5cb2a3d1b3eb36fcff63a0ca5fee96f721c1291fb6eac0ce28b83cf9bac4dc1c9ca0620d2a9e04b971750508f75f01bc23fa40a2572f4f8410e4cdb7f949a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
2KB

MD5
705f7db6ffc77e709251333df3a34e18

SHA1
4c718146a020c8b7d61e6304e230d1f13026d20d

SHA256
62f1ecb837e19b0bccf3f388f72bc305143cc26f13fbee31fec580a0d2d1a9d0

SHA512
adaad93238f3651dc00dc28cc4964cbf702418d8b2104fd1ffed348022d54b699150e617a8cc6dbda09527b0c38d1f950e93798e69babb9feaf321b84ce4116b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
59KB

MD5
c73c96aabfa33a7836c5f5f215ef203b

SHA1
9cb1fb3e3e1361bf70135bb7f180205bc87b4f7c

SHA256
4a6df05edd24091b89756e606fbae684a95c1204e4163f34c640b46b09fe9dd2

SHA512
a2dbfc92ae9c5a06c842d53968bb5aa2bd93ae7e01e4f6099668fff2852c14893611098734ae40a8d67127524b8b2bb54586973e7cafc8904d87a3c8ebe15a5b

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Filesize
223B

MD5
5babf2a106c883a8e216f768db99ad51

SHA1
f39e84a226dbf563ba983c6f352e68d561523c8e

SHA256
9e676a617eb0d0535ac05a67c0ae0c0e12d4e998ab55ac786a031bfc25e28300

SHA512
d4596b0aafe03673083eef12f01413b139940269255d10256cf535853225348752499325a5def803fa1189e639f4a2966a0fbb18e32fe8d27e11c81c9e19a0bb

Download Submit
\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit

Analysis

Sharing