7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 23:10

Target

7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe
Size

2.6MB
MD5

8d985d7ec961e6a746ab3eee6ce32517
SHA1

9555defc109af984434a99844d5d1ece75e59055
SHA256

7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3
SHA512

6a8aef3e32c1cced25e1bcbea5aa25008b936f215a17aca606787201b51aafd1e01093b376a3e94f4deb0179d9f3c88d6be0b59e3d627c7839751643f2ac254f
SSDEEP

49152:qL1J765jXAdZyLDyKeVkjV8km1eT4OpPvdHuk73ajqyT+Y41:qH73dZyQA8LOpP1Hukzaj2

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiehighkflnphpdegiocnliandceljk\2.0\manifest.json	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiehighkflnphpdegiocnliandceljk\2.0\manifest.json	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiehighkflnphpdegiocnliandceljk\2.0\manifest.json	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1588	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe
1588	7570d943d9292fae141baa054e71782c43fa6c7c14057d55ad73b23c53e375b3.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1588-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1588-55-0x00000000008D0000-0x0000000000971000-memory.dmp

Filesize
644KB

Download