01902c9f0201c3a74b7400324558cf9580057e202c73c097a240bdb90998c7a2

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_5_.dll
Size

736KB
MD5

ce7f66ea290d710a5971e9d56ca774cc
SHA1

89fd53cddeadeef8434baf815378313d0a626969
SHA256

d53b7c1fdd8fab8aec1556692ba0cb41b4812d0f5fc6d45b4028d487c3b4a3aa
SHA512

5cfb58981ede4ce97c2f353a4bb55900b01ad84ce26b470f98719e3141a98b486bc6a03e6cc86ac32f98c232bf8263e23840f455835b5242167a6c9d1aece9dc
SSDEEP

12288:L/dYsPEG5wChJOaIm11fp0Z6bJJ+yTX4aa5t5Y7/fBDbgrqmt6l0/Z9zRZzRf+Up:pYP9ChAa311x46bJVbJut+lDcrl7ZbZr

Score

6^/10

adware discovery persistence stealer

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ucyslegxzsittqvch = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\$_5_.dll\""	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2D00856-8633-4CE6-DE4F-079DCC54818E}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D2D00856-8633-4CE6-DE4F-079DCC54818E}\NoExplorer = "1"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0089E2F1-81BC-11EF-A5CD-E699F793024F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434144861"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D00856-8633-4CE6-DE4F-079DCC54818E}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D00856-8633-4CE6-DE4F-079DCC54818E}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D00856-8633-4CE6-DE4F-079DCC54818E}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$_5_.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D00856-8633-4CE6-DE4F-079DCC54818E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2D00856-8633-4CE6-DE4F-079DCC54818E}\ = "brincome browser plug-in"	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2944	1344	regsvr32.exe	28
PID 1344 wrote to memory of 2944	1344	regsvr32.exe	28
PID 1344 wrote to memory of 2944	1344	regsvr32.exe	28
PID 1344 wrote to memory of 2944	1344	regsvr32.exe	28
PID 1344 wrote to memory of 2944	1344	regsvr32.exe	28
PID 1344 wrote to memory of 2944	1344	regsvr32.exe	28
PID 1344 wrote to memory of 2944	1344	regsvr32.exe	28
PID 3036 wrote to memory of 2848	3036	iexplore.exe	30
PID 3036 wrote to memory of 2848	3036	iexplore.exe	30
PID 3036 wrote to memory of 2848	3036	iexplore.exe	30
PID 3036 wrote to memory of 2848	3036	iexplore.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_5_.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$_5_.dll
  2⤵
  - Adds Run key to start application
  - Installs/modifies Browser Helper Object
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2944

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
914f6f60d53a7f949182238880252fde

SHA1
48d0c3f153948dacd45b696db482a2beefb4cdd9

SHA256
fc31ad6053aab25cd9053801a023adda7dc107d9671a01166f32d10e1d62f426

SHA512
56ede2e1576e02d1466b1303f22c33214767f7ff787d6782b4baaad37acd907b79ae365403b41cfecdb524effffa49e88032e7a1c017268515404449bb2b8812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b61ac32b8ee32feb2cae071e7859ca8

SHA1
834652a6d9017555e5b008e985017b6812a467f8

SHA256
86fdf41c77f90e9a1561ccb9df7661ec715f5551c0d26a63ea8d0bdc0126478b

SHA512
9323a84ac16c4990adbcd11eebf73fac461b3bd04c1fcc21fd3803c46fc38fb6ca523fe2a661aedad544625c9b4ec30d2c12707b10b0eb459a83c31bf51c0a1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
583ed54239bc250f5cba4a38e76dc35c

SHA1
6a7fc75faf2717e70d1747d7f94c6bbc449e4a8a

SHA256
e2bd25635faf8c200831a20cf63b884f5045ec6e663c7b0ec67405163d5f3f85

SHA512
dfc3fdba24a98c4639e0b4aae5b5bb8a50a1cb2cb600ef4a880aab12299f2017ef411dacf6eb7b846dde3b0f467f870c49a853eb31113cf2428884b44778b476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3c92a21e7f87767d595b3df76314a14

SHA1
56dc1209a535ade8c34fe56e5da273a03854a3fa

SHA256
afd10d3e60a51b4e188be36e7c18ac3f163e4e46b239a7f0fa4e582c8c19e363

SHA512
53c0dfb9be27ee77d873bf301f5155db551097a661fcaca29a1245e77ba23018e28b1991a5b7785cb380858bcfa8c5275e24b4a5299a27f389eb072db10fb138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0025cbc204fcf474b3450485e82c7834

SHA1
a373cdb69a67dca05d2c3d83476111787ef0684f

SHA256
d0ea347c7bbfcadd2c2218293effd19444a23d69fb20efc220abeeefd3c7bfba

SHA512
db493ec538d5b92bae62a2a64912616e38ea7b5731d90c6a39ba7ed548b9a957777f847bb69808ddcbc8f18edfb14176206877a128f89ca7ad98b53ef98ba894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eed9586007f8d78b94396ee831c76357

SHA1
5435c7b04c149fdb711ececc744eaaadf44aa009

SHA256
f27a1ef9960fbfc5910208709c2efa849a0e6d9c6719c53d27eb80e146d08f61

SHA512
fcda0d3363bf5f7fd4e045f64a55b477a1c66a007be5733532c74b871be51117382b48a621b0bd2ff1a11b86440dffbd1570f0a270ccf1017958cd3c26c2398d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff030e78e4ead7eeef44ce58db7b325c

SHA1
218182ad1618ba79b061105ae8c52d95b67c964e

SHA256
945af2438f82c1fc8d11f35bd9f67fb60f06239918690e93c555d92dbda1678e

SHA512
ed33e62c7936934cb8a0755a68f21fc6fd8d58a50ff1dd70110f2b7578c22e81608e88ec44db3e168735a7e7815faac4795f72ff0ade94afa6d07f52fb11b745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eda2d87c2ef7c36ff87ee99472da45b5

SHA1
e228dd2679524afe60946858e9f0359157038b88

SHA256
111c770453c87c46498f988def53b812bbe816a185b80255a9fa9f1e0c8eb8c2

SHA512
f77c4015fda722a9b7804886bcab4eb8bcdd0d374d6b6d7e0c2f2db0408e90fdbef013282f6ce9cf1c6d72a7a4b2aba3780c695aa901f1e3553d1cdf4f3eb933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f63be4e2e5c9127a74db651923da866

SHA1
79206f3f24891a6e0aa858c67b6e3f701f2d7882

SHA256
851143e47ad4ae37b4be763499090553fb954736f9c57b8383b5ef85b19cf59f

SHA512
1f270e2a1140e5a4c1217f3ae79cf795a26b0baed5ab995a1abc4a73ad71eaa7cb1dd5c9ebb156d383980f12e8ff87fe0cfffbea7d47b4628c9d43bc07b70c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47EB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48C8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2944-0-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads