1c23e8cc65f7d2e330f3b4021ef691397beda36b6ab9cba7bea091b0b6f30565

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/AskSearchAsst.exe
Size

168KB
MD5

b1b571e9f1c9078c57774f1d059f800b
SHA1

9d60fe104e2eefcec6f0bfdc32dd92d1e9afd72b
SHA256

218d7ea77b068b105fb07e82d51f76365cd8d28327cd72f6ca9a90c0fc6f66bf
SHA512

237fdbed017bbd2ea4abbdab208931377cfc8f26cd44156f3972b0c66391107faac9634318674600e67335847cfe5f0a3bece81e9e3c79beb1f12fcf18eccd45
SSDEEP

3072:SYL0xqfjyDymJRbB4EoJ+YbAEhO5EBqodxm/yejgzWhhYGZHEj:SoB4BhokYUEwGBqodxqyogihYG6j

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
2112	AskSearchAsst.exe
2112	AskSearchAsst.exe
2112	AskSearchAsst.exe
2112	AskSearchAsst.exe
2112	AskSearchAsst.exe
2112	AskSearchAsst.exe
2112	AskSearchAsst.exe
2112	AskSearchAsst.exe
2112	AskSearchAsst.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ask Search Assistant\Install.asa.log	AskSearchAsst.exe
File created	C:\Program Files (x86)\Ask Search Assistant\Install.asa.log	AskSearchAsst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AskSearchAsst.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AskSearchAsst.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AskSearchAsst.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst6780.tmp\InstallOptions.dll

Filesize
14KB

MD5
0285eac59530ff5cc91fe2634b4ed78e

SHA1
241c12aefca0740e776362f30aa1edffd66d6bdc

SHA256
44c822afaa4cc7cb95390eaa0ada076d280d3455870569f0cde03637257d9899

SHA512
1007fbfb82d4e6c04bd5fefb32cd81f4406022ceef4d409eda0f0ddeb8b1f124a2baec86498bc119778e0c241fc41b0c2440d8a8f6731a63ede936be94f81297

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst6780.tmp\LogEx.dll

Filesize
44KB

MD5
f76acc04f2978a3877cc71e484da5dd3

SHA1
6132b886481a8e0cbc5201f3437041acda3a95a2

SHA256
069c7013fab2b54660bbc77a107ab02c60584dfd371edd1c9d833cd004a35fa6

SHA512
3810f1ae41706d2db04c1537a252de32f0f73de626f45b2f7195d05a2fdb4dd42dc8b88e9a2ece6283b71866e68c606463032f7de9c2629b95c918dcb6e83f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst6780.tmp\System.dll

Filesize
11KB

MD5
68edaafef887c72f0d85d4d64b6cbf52

SHA1
77c1fb3301d6eea2e882bc387af1a017678c58da

SHA256
7d8ce82f2b89f544ed90cc8febfcfa57b32d2c8600bb77f79bc8d8980f0f7477

SHA512
e1e6b45fd47553d8e72cf15faa8572d6cf3f0a5495a34f7cb63a2307502282e69d482db42f8a760feaa890a0dc9539e9661fea8179e4d6e18e1c90092b06d4b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst6780.tmp\UserInfo.dll

Filesize
4KB

MD5
6e19727f285dc3cf837e3ac855163c91

SHA1
bdcd7132f6530818ff899002dc2c1dbaebcef9c3

SHA256
e3a5ddc9a085af0b964960dbd67362319bc0582a6e972185536822934d6833c7

SHA512
b66c90490123e7dea9afcb157150d9d7278b67a6371a4cb203b319871627bc31a38b503308bf061201d85abbe52d469b7debc31e33f3b7875256637177450591

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst6780.tmp\ioSpecial.ini

Filesize
728B

MD5
d211d0b348724aa62c446e4d55ff698c

SHA1
030e14246b354364e429bc789b84ca5f5f3b1deb

SHA256
a3339db7240edad765bf588e23c15a400f7474b33bb6a5d07cebc72a40c96b65

SHA512
8c2feb6149932bba0ce999be669f581346273a966f9ade124c9cd727ff727adc059c116b2142a1da4e824b21d52e975655ebf782e05eba00ffba689e59ff3845

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst6780.tmp\time.dll

Filesize
10KB

MD5
38977533750fe69979b2c2ac801f96e6

SHA1
74643c30cda909e649722ed0c7f267903558e92a

SHA256
b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

SHA512
e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

Download Submit
memory/2112-24-0x0000000002720000-0x000000000272C000-memory.dmp

Filesize
48KB

Download