4dc4d89571f5e03ba5858e07ae40b5c847ff4cd613c6c7ca0c8b2ab654b5b0bf

Analysis

max time kernel
139s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dc4d89571f5e03ba5858e07ae40b5c847ff4cd613c6c7ca0c8b2ab654b5b0bf.exe
Size

2.1MB
MD5

bb4d24aee4a8c309575ab65e0901712e
SHA1

9a96f8bbd4720e7130f96598702818a56fc59483
SHA256

4dc4d89571f5e03ba5858e07ae40b5c847ff4cd613c6c7ca0c8b2ab654b5b0bf
SHA512

c06c701d25f8d6cf6b8217c60f7c9f3ade5efb672663b3b252140ad6ae495563f3887097bd5203c09866ba85321c81307115b0cf6835ee8c0af0eedf3341f376
SSDEEP

49152:h1Osqr4lSVHMdhSEM+5Rz8yH+zzBuTivFn:h1OtxchSEP7jMzkivx

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1512	fyq28lK8QEafL51.exe

Loads dropped DLL 3 IoCs

pid	Process
1512	fyq28lK8QEafL51.exe
3640	regsvr32.exe
4424	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofafanbiamhigjocemkadgnafcckknli\2.0\manifest.json	fyq28lK8QEafL51.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofafanbiamhigjocemkadgnafcckknli\2.0\manifest.json	fyq28lK8QEafL51.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofafanbiamhigjocemkadgnafcckknli\2.0\manifest.json	fyq28lK8QEafL51.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofafanbiamhigjocemkadgnafcckknli\2.0\manifest.json	fyq28lK8QEafL51.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofafanbiamhigjocemkadgnafcckknli\2.0\manifest.json	fyq28lK8QEafL51.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	fyq28lK8QEafL51.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	fyq28lK8QEafL51.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	fyq28lK8QEafL51.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	fyq28lK8QEafL51.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.tlb	fyq28lK8QEafL51.exe
File created	C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.dat	fyq28lK8QEafL51.exe
File opened for modification	C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.dat	fyq28lK8QEafL51.exe
File created	C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.x64.dll	fyq28lK8QEafL51.exe
File opened for modification	C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.x64.dll	fyq28lK8QEafL51.exe
File created	C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.dll	fyq28lK8QEafL51.exe
File opened for modification	C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.dll	fyq28lK8QEafL51.exe
File created	C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.tlb	fyq28lK8QEafL51.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1512	2288	4dc4d89571f5e03ba5858e07ae40b5c847ff4cd613c6c7ca0c8b2ab654b5b0bf.exe	76
PID 2288 wrote to memory of 1512	2288	4dc4d89571f5e03ba5858e07ae40b5c847ff4cd613c6c7ca0c8b2ab654b5b0bf.exe	76
PID 2288 wrote to memory of 1512	2288	4dc4d89571f5e03ba5858e07ae40b5c847ff4cd613c6c7ca0c8b2ab654b5b0bf.exe	76
PID 1512 wrote to memory of 3640	1512	fyq28lK8QEafL51.exe	77
PID 1512 wrote to memory of 3640	1512	fyq28lK8QEafL51.exe	77
PID 1512 wrote to memory of 3640	1512	fyq28lK8QEafL51.exe	77
PID 3640 wrote to memory of 4424	3640	regsvr32.exe	78
PID 3640 wrote to memory of 4424	3640	regsvr32.exe	78

C:\Users\Admin\AppData\Local\Temp\4dc4d89571f5e03ba5858e07ae40b5c847ff4cd613c6c7ca0c8b2ab654b5b0bf.exe
"C:\Users\Admin\AppData\Local\Temp\4dc4d89571f5e03ba5858e07ae40b5c847ff4cd613c6c7ca0c8b2ab654b5b0bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\fyq28lK8QEafL51.exe
  .\fyq28lK8QEafL51.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:4424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.dat

Filesize
6KB

MD5
f8cea405c514595fa8dd2e18a1f2889e

SHA1
bd960f291cb1ae13c9b4731ab90b93605194fb33

SHA256
048f6ca79348bf857b8232c1550f19ea5e236829dc0abb06e2f3a272c2c3fb50

SHA512
939e5d8cf0844eff8f913033edb3bc2f3053f5c2967a7c9b66128fde1f1c9f4ba04e82e2e5c52ccce0cee805909a73e3b3b88170f498a3defc73210afbf322b2

Download Submit
C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.dll

Filesize
616KB

MD5
e9332601d3a49395156fc2a68bc9e0fc

SHA1
93d0a64766f13c64961cc095e29265c141277a5e

SHA256
2f1487ddd10c7ae59ed3abeb50382e5733a6aed9def3f227f2e5641f0ede7da0

SHA512
5c70de3057f145db98c007ee0b4b9e6cec57ef81c660c85ed5fb39384a8dbdae665eb1ba34c486a648f5d93e526c850e7e2dfa496c5471ff710dd7d559c46ad6

Download Submit
C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.x64.dll

Filesize
695KB

MD5
132599fbce10c08be6ebec9473a27d9e

SHA1
03932abc447bdee8dc565f28a05ff0d37352c761

SHA256
3933d02d30adfac55b4505e50a1a484a3a4c1cd6413496b4973befaef2aab2a9

SHA512
f150803390cd35dffb1cfbf9fd703d845598dd3d029b5ced7cbd2d60cfbe2a467f0e3585b592549796724238b40a7b0251c38f351e6e10b3384a452da323f89b

Download Submit
C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.x64.dll

Filesize
695KB

MD5
132599fbce10c08be6ebec9473a27d9e

SHA1
03932abc447bdee8dc565f28a05ff0d37352c761

SHA256
3933d02d30adfac55b4505e50a1a484a3a4c1cd6413496b4973befaef2aab2a9

SHA512
f150803390cd35dffb1cfbf9fd703d845598dd3d029b5ced7cbd2d60cfbe2a467f0e3585b592549796724238b40a7b0251c38f351e6e10b3384a452da323f89b

Download Submit
C:\Program Files (x86)\GoSavve\CxMWhk2k4exHJn.x64.dll

Filesize
695KB

MD5
132599fbce10c08be6ebec9473a27d9e

SHA1
03932abc447bdee8dc565f28a05ff0d37352c761

SHA256
3933d02d30adfac55b4505e50a1a484a3a4c1cd6413496b4973befaef2aab2a9

SHA512
f150803390cd35dffb1cfbf9fd703d845598dd3d029b5ced7cbd2d60cfbe2a467f0e3585b592549796724238b40a7b0251c38f351e6e10b3384a452da323f89b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\CxMWhk2k4exHJn.dll

Filesize
616KB

MD5
e9332601d3a49395156fc2a68bc9e0fc

SHA1
93d0a64766f13c64961cc095e29265c141277a5e

SHA256
2f1487ddd10c7ae59ed3abeb50382e5733a6aed9def3f227f2e5641f0ede7da0

SHA512
5c70de3057f145db98c007ee0b4b9e6cec57ef81c660c85ed5fb39384a8dbdae665eb1ba34c486a648f5d93e526c850e7e2dfa496c5471ff710dd7d559c46ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\CxMWhk2k4exHJn.tlb

Filesize
3KB

MD5
eec93149067789c941497138f5422741

SHA1
aad1991b9b8f568255707de7a0d101115dc65501

SHA256
63f49ab03606822625fec5331ed40e271577b245b720e22d051212d6936d7d55

SHA512
969517f1d3e4360787a9919c0a78694a932bfc911127959ac345864faf77d5526e3ddf8ebb31d56f9b2a859f45eae192f274f68374267c1eb6c64368d204f4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\CxMWhk2k4exHJn.x64.dll

Filesize
695KB

MD5
132599fbce10c08be6ebec9473a27d9e

SHA1
03932abc447bdee8dc565f28a05ff0d37352c761

SHA256
3933d02d30adfac55b4505e50a1a484a3a4c1cd6413496b4973befaef2aab2a9

SHA512
f150803390cd35dffb1cfbf9fd703d845598dd3d029b5ced7cbd2d60cfbe2a467f0e3585b592549796724238b40a7b0251c38f351e6e10b3384a452da323f89b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
098cb7c00b81fff22e4bbccab620fdb3

SHA1
6a25293d19fe4d40ef40985c54ff7370e6750ff3

SHA256
eec5e0667f63460387ff3a56c31620df8ef01ca772bb8e52756637d0b2f4baa9

SHA512
967e2c0fdd8ccc16be1b75e0758bf8c7e44b579aec781533550d9ffdc7e78410943d41c2d9098dcdba4ef7318cc3c91795332ea8e16cf7c326f69d212e97a5ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
84e8c205ab29527fd87448d13668a7f2

SHA1
3787db3cccea69812281f3e12ded0d480fcc4c55

SHA256
09ca99b3b5fc5a61c69f9dba815d760871c6afc13bd6502d1c287641e45f633f

SHA512
34944cc81c020b5d0a2f32e0e614f3d92feff33da29b1143783912f0a14c3524c4dd5cedaed024bebc9d0589c1214d0106759f79f948c8551f4c21471b94d5e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\[email protected]\install.rdf

Filesize
594B

MD5
f4090492685aa6e692edc858b276f97e

SHA1
3c9299336d4315d1aac4ff25a77d84825a96c9cd

SHA256
4666680b106e5f18811c40c815731031c361c3a2c8175a94ad66ef5103b0b42a

SHA512
088cb26f33aa34855250ced0a81385f5a38d167e4614b07d22f1a735c8ae62204d12301b1918aaf7a1c055e8436360c9d24174d6fa4c4c55b1a6bba7a2ae9065

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\fyq28lK8QEafL51.dat

Filesize
6KB

MD5
f8cea405c514595fa8dd2e18a1f2889e

SHA1
bd960f291cb1ae13c9b4731ab90b93605194fb33

SHA256
048f6ca79348bf857b8232c1550f19ea5e236829dc0abb06e2f3a272c2c3fb50

SHA512
939e5d8cf0844eff8f913033edb3bc2f3053f5c2967a7c9b66128fde1f1c9f4ba04e82e2e5c52ccce0cee805909a73e3b3b88170f498a3defc73210afbf322b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\fyq28lK8QEafL51.exe

Filesize
623KB

MD5
84732b41d5fc6660d9a30a43ad4398c2

SHA1
0afe25c3651aa0da868df654a39c0e34c909090a

SHA256
83d4d9d37a153b742deaf66cf7e628abb8ea592c8fb2b0ba5eaf669dcbe5c688

SHA512
6216a8a3428c7eadf49eee6204d1294a15fb4801b22dceb982f2feb3ced249a02ce9945001cab2b19012133228ac276bf02526953b75ecb3e3731c8bec4ff3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\fyq28lK8QEafL51.exe

Filesize
623KB

MD5
84732b41d5fc6660d9a30a43ad4398c2

SHA1
0afe25c3651aa0da868df654a39c0e34c909090a

SHA256
83d4d9d37a153b742deaf66cf7e628abb8ea592c8fb2b0ba5eaf669dcbe5c688

SHA512
6216a8a3428c7eadf49eee6204d1294a15fb4801b22dceb982f2feb3ced249a02ce9945001cab2b19012133228ac276bf02526953b75ecb3e3731c8bec4ff3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\ofafanbiamhigjocemkadgnafcckknli\ZBs0X.js

Filesize
5KB

MD5
032cde8445cdef7d1191c06e4ef7a504

SHA1
e07b28949bcfc290eae9afdcfdeaf5c42ea16554

SHA256
c5d5448a77bf0450eb3a3f74e518efe27a20f8c3f8a74b58d50e8638be54dc07

SHA512
8ede7d4cc97be54d11763fd25caf7a58c5edafd8466a37aa62e0aa92f671d7e835e7be1fac43a55f620751638af64c8df41c47c80c51a70a7fb9688d5f06aa95

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\ofafanbiamhigjocemkadgnafcckknli\background.html

Filesize
142B

MD5
0837c3df5de751a9aeb2160f1901c706

SHA1
bdf4f8ba9259a91b13810c541b9716ef43c10899

SHA256
7a251eb4515a70a6a51db1baab67aa04ee914dc296d5e64598e0fe9a8b537010

SHA512
2042e53a7f7d3f51aa157170f37a95f53c51a2b5c6108aa35d82c80f4a6e66cc0680698c012ebd04c257cb31c0cda51f87c70c95395fa8e3a9642a20f376f4d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\ofafanbiamhigjocemkadgnafcckknli\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\ofafanbiamhigjocemkadgnafcckknli\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA86A.tmp\ofafanbiamhigjocemkadgnafcckknli\manifest.json

Filesize
499B

MD5
34cbb7a42a4d4fa7dc5e1f4eda753b3d

SHA1
dee13c6e73ce655be020d3b1ac71b592f5ee9802

SHA256
fee0fa4968e75c48d7e9147cc3f33baca5b2598a48c7d3b20b508605ab00ec66

SHA512
b4d725bd94b5c64c37324ad1ecc29d0ff365fd267c5bd8e9552dd98c3697905e484e1887eeb356c248dd94bddf08e9e780f4c84f49a55916a11b2c5158bc3d4f

Download Submit