a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Size

421KB
MD5

d300a6a8cca90b6f44e9116dc0b26032
SHA1

317eac1e750ff8d12227239b59de3d7800297621
SHA256

a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6
SHA512

c89da5616f2e82633ba23dacf6cb86bf9ec2c65d499bee937525043dfc58a58877ac5aca87b16d9e3fd99c5367b171669610aa73d2fcaf65cb7f1391372fbb06
SSDEEP

6144:z1ilFhJmWT4flAkLd+yu/UOEFeqjhTmWvQtQhqaQ/bnebUd:1WT4dAkoyu/i7jhTNjqaQ/bn

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2492	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
2492	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iconhandle.dll	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
File created	C:\Windows\SysWOW64\web.dat	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
File opened for modification	C:\Windows\SysWOW64\web.dat	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
File created	C:\Windows\SysWOW64\winweb.exe	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
File created	C:\Windows\SysWOW64\webad.dll	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}\1.0\FLAGS	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iconhandle.seticon\CLSID	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72397142-9352-4A45-99AD-2EF143072AC0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEFA7E78-CF7E-4550-829F-2C786A0070BF}	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shellEx\IconHandler\ = "{AEFA7E78-CF7E-4550-829F-2C786A0070BF}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\iconhandle.DLL	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ad.h\CLSID	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ad.DLL	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DD0AD1D0-6C36-4894-B38E-9E5D3392114D}\ = "iconhandle"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEFA7E78-CF7E-4550-829F-2C786A0070BF}\VersionIndependentProgID\ = "iconhandle.seticon"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ad.h\CurVer\ = "ad.h.1"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}\1.0\ = "iconhandle 1.0 ÀàÐÍ¿â"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}\1.0\FLAGS\ = "0"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEFA7E78-CF7E-4550-829F-2C786A0070BF}\InprocServer32	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\iconhandle.dll"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45-99AD-2EF143072AC0}\ = "Iseticon"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iconhandle.seticon.1\CLSID\ = "{AEFA7E78-CF7E-4550-829F-2C786A0070BF}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ad.h\CurVer	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}\ProgID	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}\TypeLib	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72397142-9352-4A45-99AD-2EF143072AC0}	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ad.h.1\CLSID\ = "{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}\1.0	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ad.h.1	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}\TypeLib\ = "{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iconhandle.seticon	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ad.h\CLSID\ = "{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\webad.dll"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEFA7E78-CF7E-4550-829F-2C786A0070BF}\TypeLib\ = "{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72397142-9352-4A45-99AD-2EF143072AC0}\TypeLib\Version = "1.0"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ad.h.1\ = "h Class"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}\1.0\0\win32	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iconhandle.seticon.1\CLSID	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}\1.0\0	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}\Programmable	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}\1.0\FLAGS	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shellEx	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shellEx\IconHandler	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}\1.0\FLAGS\ = "0"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ad.h\ = "h Class"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}\ = "h Class"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}\TypeLib\ = "{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}\TypeLib\ = "{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F6136F5A-4C58-40C7-8DFC-945F5570CB79}\ = "ad"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEFA7E78-CF7E-4550-829F-2C786A0070BF}\TypeLib	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}\1.0\ = "ad 1.0 ÀàÐÍ¿â"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}\ProxyStubClsid32	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iconhandle.seticon\CLSID\ = "{AEFA7E78-CF7E-4550-829F-2C786A0070BF}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72397142-9352-4A45-99AD-2EF143072AC0}\TypeLib\ = "{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45-99AD-2EF143072AC0}\ProxyStubClsid32	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}\InprocServer32\ThreadingModel = "Apartment"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}\TypeLib\Version = "1.0"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iconhandle.seticon\CurVer	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45-99AD-2EF143072AC0}\TypeLib\ = "{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}\InprocServer32\ = "C:\\Windows\\SysWow64\\webad.dll"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}\1.0\HELPDIR\ = "C:\\Windows\\system32"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}\ = "Ih"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}\TypeLib	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{78D814F1-9774-4F37-B7F9-CD8F88558B53}\TypeLib\Version = "1.0"	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe

C:\Users\Admin\AppData\Local\Temp\a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe
"C:\Users\Admin\AppData\Local\Temp\a9696f7da45cc4294f3fe613af999ca7cd60134690885244372a62dd20567ad6.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\iconhandle.dll

Filesize
89KB

MD5
ff5e351935f68327176317557d39d148

SHA1
782af9b27d5fe6ab8b77e648c0e106024ddfad49

SHA256
beccf49b42d153047e4912aa0d00202a5ef9d94f57dfe2a7ce7f43afa338e5bf

SHA512
45ebef101a0e0e1630828d4e8dda46523e015b5074009a2ba8fa8a9ab62853f48f49b6bdad2a158ab0f377e6597c905501acf5391ffa74c9768e71f2599fe6cb

Download Submit
\Windows\SysWOW64\webad.dll

Filesize
92KB

MD5
34804338d229cd5d610d2035e31f2bcc

SHA1
10c1293ac1f32556af1741ae68751e8c7755a558

SHA256
d76bb94b09aa6e982077bc6f8d27687f9948976f1359b21633fffe550e8fa57c

SHA512
d50f0fbfcde21ce9ea624cb4925af0bec85d36af10784a598478168daed0dfc748e8260ac37f92a6a95d9b1c85e048f2a29e7c91c5f66a42d08879e57d17e31b

Download Submit
memory/2492-0-0x0000000000DE0000-0x0000000000E56000-memory.dmp

Filesize
472KB

Download
memory/2492-13-0x0000000000DE0000-0x0000000000E56000-memory.dmp

Filesize
472KB

Download