68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3

Analysis

max time kernel
134s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe
Size

924KB
MD5

c9ac571ce0221dfd503d8cf6cbcf89d5
SHA1

adcd2e32d13bbd4d2a11de03f0d4c3bb317ab0e7
SHA256

68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3
SHA512

5ee849eaa738b53b12d15cea8dc8d3dc4be6c44ef5445f0995fad5ce0bc3fa3ab3b51b3bf4c26470b23525f088817c798a00c38534005b95e72d3ae31c1b7f2f
SSDEEP

24576:h1OYdaOffC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuXc:h1OsSMN6wdBh5N5Z4E8PuXc

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4808	aTHqwgbsywEloEM.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhbnpocbjicmppjeejafgpildnemmoa\2.0\manifest.json	aTHqwgbsywEloEM.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhbnpocbjicmppjeejafgpildnemmoa\2.0\manifest.json	aTHqwgbsywEloEM.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhbnpocbjicmppjeejafgpildnemmoa\2.0\manifest.json	aTHqwgbsywEloEM.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhbnpocbjicmppjeejafgpildnemmoa\2.0\manifest.json	aTHqwgbsywEloEM.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhbnpocbjicmppjeejafgpildnemmoa\2.0\manifest.json	aTHqwgbsywEloEM.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	aTHqwgbsywEloEM.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	aTHqwgbsywEloEM.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	aTHqwgbsywEloEM.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	aTHqwgbsywEloEM.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe
4808	aTHqwgbsywEloEM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	aTHqwgbsywEloEM.exe
Token: SeDebugPrivilege	4808	aTHqwgbsywEloEM.exe
Token: SeDebugPrivilege	4808	aTHqwgbsywEloEM.exe
Token: SeDebugPrivilege	4808	aTHqwgbsywEloEM.exe
Token: SeDebugPrivilege	4808	aTHqwgbsywEloEM.exe
Token: SeDebugPrivilege	4808	aTHqwgbsywEloEM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 4808	960	68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe	80
PID 960 wrote to memory of 4808	960	68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe	80
PID 960 wrote to memory of 4808	960	68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe	80

C:\Users\Admin\AppData\Local\Temp\68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe
"C:\Users\Admin\AppData\Local\Temp\68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\aTHqwgbsywEloEM.exe
  .\aTHqwgbsywEloEM.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
6d446e171167dd5547d6640dd6ac7927

SHA1
1d09cb12ddb35648ddcdddcbadca750b987373fe

SHA256
54378ae4dff19035a8e821247e477fff17408035f5ea719c5a9a124e33f65abb

SHA512
9e68edac177ae61e95820595d696b1abb8a9fa2981bf541a0ce6a572382610a7214ed76c58c945f6d0a6d2457fd6ee62357c68dc55d8ad5dc1b50053489134e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
8bc49420068350baa64fd0cae887c99e

SHA1
2aaf9333f2df865985d0a290ebbaa98ab6d31f5c

SHA256
79cc94878980e38a1767d4b05895afd1f068ffbc5f2ee8762b260dac1400405c

SHA512
505711403b36e99cf65470893d5d46a77e0b781f493173d085a6a44b5349c3e2421a90e03bad7f0cdaa70f2e673d6fc62e7e0d67e1e80856c3c46db272167124

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\[email protected]\install.rdf

Filesize
594B

MD5
453e9e5975f3c67b4b14f05ea101a20e

SHA1
aeaa30e1ef4ff36fd5c209510ae4e4f1894600bc

SHA256
893d4b9bbfa8f8d526099097ec4bb557590b4230a58303d01ab5c7f0a32b2564

SHA512
bac11246d2181662c3512289a350f68fa5d0055f7ed011f5adc7e9165bcd014b3c56154025a0e30a3460b2b1072c167d3b13338a5a8148a03475d7c5a8524c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\aTHqwgbsywEloEM.dat

Filesize
1KB

MD5
288d9d2aecacf7d77cf2427c3ff15760

SHA1
598b17c5c200237f2129c34a904e408f9234b38b

SHA256
8c93ffe158f2c513a70a50900dea74b0ae99765d168ecace259fe5ce56d739bf

SHA512
8ab4df36faf294c33e9eb0002d9386edcaf913554325b3b023fe38e51bef801e963317ff01a0969848dc450a7c5bd140fb9ba4c8cf7200dfd41379e87f8849ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\aTHqwgbsywEloEM.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\aTHqwgbsywEloEM.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\obhbnpocbjicmppjeejafgpildnemmoa\O2gf5eC0.js

Filesize
6KB

MD5
6157fe6d35ac071d8648f923f3185e32

SHA1
9184d39bfd656efaedafdfa2c5e096467b3ee1c4

SHA256
f251455be0533b609cb038e1183cf39aa44347c6fc8d978a7b6a82267459abc5

SHA512
b96fde7e392c5023593c19bfc1d71b9a6ceda60665e5c112c3726dd276ecb130768fba0b5bb539b3d5f252082bb78894842218506e18b23747f40b2f625788d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\obhbnpocbjicmppjeejafgpildnemmoa\background.html

Filesize
145B

MD5
5b0f872151e7f50d6ec1e65c934f05d3

SHA1
911b64c9823f3591861771c2bcdbcb302414bd75

SHA256
34f6a1c485dff37f789214382a3cf6970f2f63d678c4a0621f720904733450e7

SHA512
cbb60062eebf37632fdb3dc2a7d0b634e14ec8018fc908f56be593cd6e7f470badb591173f11f54a0d8dc2dbc12c26fb539e844ea83271e3cc80aa4b217d2cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\obhbnpocbjicmppjeejafgpildnemmoa\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\obhbnpocbjicmppjeejafgpildnemmoa\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4DB.tmp\obhbnpocbjicmppjeejafgpildnemmoa\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit