Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe
-
Size
436KB
-
MD5
2174eebea69195d0713cf32f1f8f2fdc
-
SHA1
56003d633ae22dcb1a4736e88a263efea66763e2
-
SHA256
bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee
-
SHA512
dc4944988950c89473caefb3bb9a461d27fdeabc83af36a53733b1030cc802f84f5e98b413c6391a3deefa64c31216febbcd38871cdc64d178ca86da33b55364
-
SSDEEP
6144:DW0rvX/eSqjc3HsTaxoq3svM45ElHcahWWRRXU6llDVA9oL4:/X/eOyaiq3svMAEFcgWWRRX5ncM4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\7-Zip\7z.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\7-Zip\7zG.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1564 bfbb9ba7c6bb74a182f58f157c1c8c101bb298244cb2aba2472555b21bceb2ee.exe