564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90

Analysis

max time kernel
204s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90.exe
Size

993KB
MD5

d56eed9e5057862b80e329d0ec66ef53
SHA1

1564930ac078526def8c8e14370f317cd2f250e4
SHA256

564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90
SHA512

6cc8b5c35f4c675429f8ef00f08d4ddd4bd70ed4f2a46faff96e9d64695e76e715f0deb6cd57b040356a1877f0c4afb027961d62d5a8d11b5b76693ba1769f70
SSDEEP

24576:OHO1tcLf/EciX/TTq3yYHtRIM73bZsih:XGLfAqiEh

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

7DpH.exe

pid process

4264 7DpH.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4264	7DpH.exe

Drops Chrome extension 5 IoCs

Processes:

7DpH.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhlihbppmnfdbogjkpmgohjpfbcgokcc\2.0\manifest.json	7DpH.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhlihbppmnfdbogjkpmgohjpfbcgokcc\2.0\manifest.json	7DpH.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhlihbppmnfdbogjkpmgohjpfbcgokcc\2.0\manifest.json	7DpH.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhlihbppmnfdbogjkpmgohjpfbcgokcc\2.0\manifest.json	7DpH.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhlihbppmnfdbogjkpmgohjpfbcgokcc\2.0\manifest.json	7DpH.exe

Drops file in System32 directory 4 IoCs

Processes:

7DpH.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	7DpH.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	7DpH.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	7DpH.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	7DpH.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

7DpH.exe

pid process

4264 7DpH.exe
4264 7DpH.exe
4264 7DpH.exe
4264 7DpH.exe

pid	process
4264	7DpH.exe
4264	7DpH.exe
4264	7DpH.exe
4264	7DpH.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90.exe

description	pid	process	target process
PID 1524 wrote to memory of 4264	1524	564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90.exe	7DpH.exe
PID 1524 wrote to memory of 4264	1524	564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90.exe	7DpH.exe
PID 1524 wrote to memory of 4264	1524	564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90.exe	7DpH.exe

C:\Users\Admin\AppData\Local\Temp\564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90.exe
"C:\Users\Admin\AppData\Local\Temp\564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\64b275ac\7DpH.exe
"C:\Users\Admin\AppData\Local\Temp/64b275ac/7DpH.exe"
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\64b275ac\7DpH.dat

Filesize
1KB

MD5
c7b4758b8041f89e4b2b319696bad174

SHA1
b0f10e9d3afc8fa7f6b89222a1344caa38361714

SHA256
275fc4d9f722f49c745447b6fbd2eefe1f83a99c6aa96edee4275c8c51056cd3

SHA512
9a0071a51ccd392b994657593e7308dffad91de6d1fc0602db003062b58f74f0f599bc1d737d6c613eb789b6912100b95687eed98a46957f2f9b67ed005b3290

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\7DpH.exe

Filesize
636KB

MD5
98a20ae8aee50ed82c7f3c25578b698b

SHA1
75a9255d9cd26b5aff1f4ce8b95dfce117cfb0ee

SHA256
b7e5e696333f35bac6c1dd699dac653f9e9ed4c1678119b3d3db086d7fbec017

SHA512
8be1cf14a794bb6d88c58f4853e3ec3304cf8d9a483c0c42d035952b5bb398a29c228c16eec31a8d16e2b923217ae80fc471eb406eab036618bdb582925d2856

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\7DpH.exe

Filesize
636KB

MD5
98a20ae8aee50ed82c7f3c25578b698b

SHA1
75a9255d9cd26b5aff1f4ce8b95dfce117cfb0ee

SHA256
b7e5e696333f35bac6c1dd699dac653f9e9ed4c1678119b3d3db086d7fbec017

SHA512
8be1cf14a794bb6d88c58f4853e3ec3304cf8d9a483c0c42d035952b5bb398a29c228c16eec31a8d16e2b923217ae80fc471eb406eab036618bdb582925d2856

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\mhlihbppmnfdbogjkpmgohjpfbcgokcc\background.html

Filesize
138B

MD5
b972c42d19ad291355009b55d5a7f2d9

SHA1
753a8b02deffbb8a3ce02d47e2b9ff55432da49f

SHA256
99f1bb13cd5c18f8480fe9ab54eef6f5d75801c133e8bd5a260536cfbdf93f21

SHA512
b1a480f39a01c31434dc14f1b51976be8f0f0e5371c5600e4cf055eb58a530b7fa7f0ac83fc98beed3eea35ef933d5d0fe25c84f28c76212ca69bc4576434cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\mhlihbppmnfdbogjkpmgohjpfbcgokcc\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\mhlihbppmnfdbogjkpmgohjpfbcgokcc\e.js

Filesize
6KB

MD5
ad377c38266d6294ea6a445c3bb9b6bf

SHA1
06a983c0d46e21d0f1c29a0e3ddba3f07bd7477e

SHA256
2c3115b074739a40f7fed1f27113ab66cf9c7cff2944cd209ce7f39d4e17e539

SHA512
5055492895713f7d3c59d75a436042fba1b6932b8cba311b2875dd2529ddb017616b0c59f1713fb0e12e929d6ceaa55417e7ee69a600dbbe4e62367d873d1067

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\mhlihbppmnfdbogjkpmgohjpfbcgokcc\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\mhlihbppmnfdbogjkpmgohjpfbcgokcc\manifest.json

Filesize
499B

MD5
9ab7fff9f9835e96d693f50be6c718c1

SHA1
aa62433aa843dbedb095e4b32a0ad99e656119c5

SHA256
f283a02469301a791edbf56cb8a669889106a5561ef463901ccca63c8bc19044

SHA512
f1550485f9414a10c4062910e87425b89eb65c95c7245432b8f09b1d437324fb506dcef316c34d930945ec6b6699381fadd967fec7ffcec1b77cfa0d206a8b72

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\[email protected]\chrome.manifest

Filesize
24B

MD5
ddd11623526c0faa43d7585b615064b7

SHA1
3753a55cd0a45db16451b69cb8677fd93136e5ea

SHA256
278c182d18432827af4e76916ddcef3b6ef51a592df141fc8906b70d8d603a74

SHA512
a2e8a88d9dead31a20e5e06ec8c0a1c5cf4b3e5ffb5d599af6f2bd3e44a9da23e0feed7b25ee3d991d0e4c2244e96194d5aab042edb23f39d927b187c3299725

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\[email protected]\content\bg.js

Filesize
8KB

MD5
681235b19b6a0aff47460d6fb0d854bd

SHA1
33ec3e9d87c283953c00f17952b6662f7119813b

SHA256
acb4d240a72f6f4f122f00b309688f91fbbd09c78f3c961bf7cdf073bfea23d6

SHA512
ee884c62f2ca0684e6ff275b61bf597910a510c45d7f9a004f4b8a22e6f31009afe950f6e247cf6d69f47d68f5489377bc27e607df4742964cf93017a3bd244c

Download Submit
C:\Users\Admin\AppData\Local\Temp\64b275ac\[email protected]\install.rdf

Filesize
600B

MD5
26090eeb37b915d60daa00694b91bfd9

SHA1
d076ffa94ecca14128168d272dbea38afabf1c80

SHA256
d66b1eedd30cbc7b1a7fb199fdbcd967dc31bf2265810ce81a502ed2e08696e0

SHA512
fad9e4110cd5dd6606ea32fced7f0d65f88a2f3ce93f8e5f0efd8a463e8bc1575a100e5721a683bc9aba1d53dd0b277d3544d33b4f0ee9efa12d416d5471dd23

Download Submit
memory/4264-132-0x0000000000000000-mapping.dmp

Download