5e88e84aed8d0ff539376a0e33288ea1792049cc856a276705463677225e002a

Analysis

max time kernel
163s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e88e84aed8d0ff539376a0e33288ea1792049cc856a276705463677225e002a.exe
Size

924KB
MD5

f897dab24e8dcf3fa5446caee47b6a4a
SHA1

d2da9bb384b18890ce2f8b8791899f21a88d9b9c
SHA256

5e88e84aed8d0ff539376a0e33288ea1792049cc856a276705463677225e002a
SHA512

a82d199aedeba03e5519ebdc229307251e96a11db766ef04b5d6e890cfd8015cfa660bd2a63515eebe84f8453c424e6e28230e6fcec578a1ae555fc638ca7b8b
SSDEEP

24576:h1OYdaOhfC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuX2:h1OsEMN6wdBh5N5Z4E8PuX2

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4244	nhzsXDWEG7f6wbG.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bclbpokcpkafhjllceikhgendfobdoal\2.0\manifest.json	nhzsXDWEG7f6wbG.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bclbpokcpkafhjllceikhgendfobdoal\2.0\manifest.json	nhzsXDWEG7f6wbG.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bclbpokcpkafhjllceikhgendfobdoal\2.0\manifest.json	nhzsXDWEG7f6wbG.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bclbpokcpkafhjllceikhgendfobdoal\2.0\manifest.json	nhzsXDWEG7f6wbG.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bclbpokcpkafhjllceikhgendfobdoal\2.0\manifest.json	nhzsXDWEG7f6wbG.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	nhzsXDWEG7f6wbG.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	nhzsXDWEG7f6wbG.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	nhzsXDWEG7f6wbG.exe
File opened for modification	C:\Windows\System32\GroupPolicy	nhzsXDWEG7f6wbG.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe
4244	nhzsXDWEG7f6wbG.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	nhzsXDWEG7f6wbG.exe
Token: SeDebugPrivilege	4244	nhzsXDWEG7f6wbG.exe
Token: SeDebugPrivilege	4244	nhzsXDWEG7f6wbG.exe
Token: SeDebugPrivilege	4244	nhzsXDWEG7f6wbG.exe
Token: SeDebugPrivilege	4244	nhzsXDWEG7f6wbG.exe
Token: SeDebugPrivilege	4244	nhzsXDWEG7f6wbG.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4244	4368	5e88e84aed8d0ff539376a0e33288ea1792049cc856a276705463677225e002a.exe	83
PID 4368 wrote to memory of 4244	4368	5e88e84aed8d0ff539376a0e33288ea1792049cc856a276705463677225e002a.exe	83
PID 4368 wrote to memory of 4244	4368	5e88e84aed8d0ff539376a0e33288ea1792049cc856a276705463677225e002a.exe	83

C:\Users\Admin\AppData\Local\Temp\5e88e84aed8d0ff539376a0e33288ea1792049cc856a276705463677225e002a.exe
"C:\Users\Admin\AppData\Local\Temp\5e88e84aed8d0ff539376a0e33288ea1792049cc856a276705463677225e002a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\nhzsXDWEG7f6wbG.exe
  .\nhzsXDWEG7f6wbG.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\bclbpokcpkafhjllceikhgendfobdoal\background.html

Filesize
143B

MD5
a089440d56ac7f18fc8d6f09b1fcebd2

SHA1
b32bdb518c26b8fd986a00e868be924cab147263

SHA256
200f1453ef135e529d8c16468a6276dfbbdbb70a3929d66ba8c8a7be8a089c63

SHA512
08f4b8cd3e45081d503b5504328b53688f99255748a52f1fa0a3e9f11d64f68b6681caec27327535d4e5a8eda188813a6e24d5d27bdd5c058ae0aedad3364323

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\bclbpokcpkafhjllceikhgendfobdoal\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\bclbpokcpkafhjllceikhgendfobdoal\fVpr1I.js

Filesize
6KB

MD5
a326f5057ea45f767a5da20b9446be49

SHA1
18ee56ce98e04e61ddfdad1168119a543307a6d1

SHA256
065f85a30d364e8e2ff715869f5e07f9434b60a7f5a2048bb6c0c38921fa4d72

SHA512
8997298b0221b048a816668ec353e6a1658ba437a3cd94d1452a9388944e81be83815cd6d1cbf28c190b73f57847feeb83e0d551404891c9c5f5720344f851e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\bclbpokcpkafhjllceikhgendfobdoal\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\bclbpokcpkafhjllceikhgendfobdoal\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\nhzsXDWEG7f6wbG.dat

Filesize
1KB

MD5
175d71c0765087704fd0f34c10b642f3

SHA1
e0f3f572b3de663f8af024f6ce5533106d74d43e

SHA256
d0db3ad18537c18fe90f38cc4fc1e2d140dcffdbcf1c2e3b4752c17d1d6bc3b5

SHA512
9b14f6a9eaa0eab3d918c79cbecfe5098c981cab4efb6fa42a7b0c7ba7d5f9b72586c91d59522c0b885c69763ce70ce2d0be4bfa5b7f67bff5e8c4fb71062413

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\nhzsXDWEG7f6wbG.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\nhzsXDWEG7f6wbG.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
663206e9212e2dc34700f20f4c94131b

SHA1
aa9ffc0c15471b0fa5c8b64f0b0289d1ad4ba4a5

SHA256
6c656c38029f22baa4f4e728a4997e70a873893442816b0f11e41ab8a5b8f905

SHA512
0ffbec8bb2cf401ffeaab516efc1bbd6272e866b9a25e69852c4506004cb501325f157d55e4884bc097b94dff8dd5eeed14c2177f0f5b58ab8ca2c7d1f2904a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
dea816e04fd18816b86d3c51cd0ad824

SHA1
2127c7891cfa4429152efb024d56461c9d0c0fac

SHA256
caf417211e07f31abe952acde89708e8ff445add82260630c8055a47d8771fe7

SHA512
c7b99c3b758d90eb6f3da02517f2e31f2b9139ca6805e5c431f8b9431ad18e2d20e03f050e1cd50e1685f5404ec9588b350c95cd1fa89d9651ff1b31f3e21a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDAC.tmp\[email protected]\install.rdf

Filesize
596B

MD5
f2e7b44e7a224096550b5b4692354c5b

SHA1
d5d04977580bd54396767dbf81829414f6eac2b0

SHA256
2efac3b1c3cbe7488716267b75efb8d7c1cfffa32bc16d633552e9cdc340cc59

SHA512
6d3b547ff55907d3f3f1b8bcb8667cf13a7141c088647aebaedf103b2d5bbeb9bf6a8550e5489dc996197cd290b6c885209fb85a33248f21ea47ead38746fad3

Download Submit