77188a70901723c3769871ec39800f1f0dddb5b9af3cdd79204f8d467eac1bec

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IEProt/IEProt2.exe
Size

3.5MB
MD5

809c1ecb6083ef23ff20db94847a07c4
SHA1

d55a8365d108473ce85d3be5edd9e612ffc13260
SHA256

df1934a39fd03c0fd48343e752d8583d8fe75b6705d3d60e88dec1672c65d13d
SHA512

5410f5b08ef9bf608e4f2a0ebf6d1d7812865cd45016dbb4a25532080025580c0436df89c8311afcc10264ffee60aa4a3f1c7ed0ee4774c3495d9230e4c05215
SSDEEP

12288:kx1uTyXTnXJntnFPAxdmMF5qBmkhTdWghkXATZXs:k7OyD1t3MFEh4SXs

Score

6^/10

adware discovery stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IEProt2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEProt2.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	IEProt2.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEProt2.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions	IEProt2.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MenuExt	IEProt2.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	IEProt2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	IEProt2.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2100	IEProt2.exe
2100	IEProt2.exe
2100	IEProt2.exe
2100	IEProt2.exe
2100	IEProt2.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	IEProt2.exe

C:\Users\Admin\AppData\Local\Temp\IEProt\IEProt2.exe
"C:\Users\Admin\AppData\Local\Temp\IEProt\IEProt2.exe"
1⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\srprot2\myadpage.htm

Filesize
3KB

MD5
2ec072b38ec6cf294c024b757d2247a5

SHA1
3f9a7fa7701f851af9341b59d0295e31acc9d417

SHA256
a600fffe844a05e70f27be5df2db481325776bbaaf3a64aeec29f6117b424443

SHA512
4957749ad8e09a997c0d99b86137d00fc1d8d23dbc58d9b928ef5caa85a605f76bb7bbb7da02d89a03e2f195f22ffbdbeed539ed82cbfc1326e927b5d93b02ed

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads