606b7c29afc5a1d0db755214d0bce093fe4da283747e35fc0dd4665345d59040

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

606b7c29afc5a1d0db755214d0bce093fe4da283747e35fc0dd4665345d59040.exe
Size

923KB
MD5

7a32c3a271de2f3a004fcfe918868766
SHA1

44dcb4e083b38e7295d3e578b1f3f2da29fb0618
SHA256

606b7c29afc5a1d0db755214d0bce093fe4da283747e35fc0dd4665345d59040
SHA512

2a3c5e5e4fcd676c26d6677e4d267e37b9d89f706a244cc58134e3e6559340cdc922437d97334d40fb85aad4f96696dcc5c351448fd4a75bd487af970af77a8e
SSDEEP

24576:h1OYdaOX4BQGx2jUReefMaGeOPw8Y7H3b+QO:h1Os54BQ02o4efMz68Y/+QO

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
408	LWCo0QYY307Tt4E.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdjlbhkohhbenfnjplpimnhgklllpkhe\2.0\manifest.json	LWCo0QYY307Tt4E.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdjlbhkohhbenfnjplpimnhgklllpkhe\2.0\manifest.json	LWCo0QYY307Tt4E.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdjlbhkohhbenfnjplpimnhgklllpkhe\2.0\manifest.json	LWCo0QYY307Tt4E.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdjlbhkohhbenfnjplpimnhgklllpkhe\2.0\manifest.json	LWCo0QYY307Tt4E.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdjlbhkohhbenfnjplpimnhgklllpkhe\2.0\manifest.json	LWCo0QYY307Tt4E.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	LWCo0QYY307Tt4E.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	LWCo0QYY307Tt4E.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	LWCo0QYY307Tt4E.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	LWCo0QYY307Tt4E.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe
408	LWCo0QYY307Tt4E.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	408	LWCo0QYY307Tt4E.exe
Token: SeDebugPrivilege	408	LWCo0QYY307Tt4E.exe
Token: SeDebugPrivilege	408	LWCo0QYY307Tt4E.exe
Token: SeDebugPrivilege	408	LWCo0QYY307Tt4E.exe
Token: SeDebugPrivilege	408	LWCo0QYY307Tt4E.exe
Token: SeDebugPrivilege	408	LWCo0QYY307Tt4E.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 408	2516	606b7c29afc5a1d0db755214d0bce093fe4da283747e35fc0dd4665345d59040.exe	86
PID 2516 wrote to memory of 408	2516	606b7c29afc5a1d0db755214d0bce093fe4da283747e35fc0dd4665345d59040.exe	86
PID 2516 wrote to memory of 408	2516	606b7c29afc5a1d0db755214d0bce093fe4da283747e35fc0dd4665345d59040.exe	86

C:\Users\Admin\AppData\Local\Temp\606b7c29afc5a1d0db755214d0bce093fe4da283747e35fc0dd4665345d59040.exe
"C:\Users\Admin\AppData\Local\Temp\606b7c29afc5a1d0db755214d0bce093fe4da283747e35fc0dd4665345d59040.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\LWCo0QYY307Tt4E.exe
  .\LWCo0QYY307Tt4E.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\LWCo0QYY307Tt4E.dat

Filesize
1KB

MD5
204b67fca1986fe0668a023ac323e3ac

SHA1
34474a36ed6628058e9e2c937215b3b9ac953324

SHA256
cb1df959aea027288a50e20b3e6db48d124bb60da6e9f5d38bf4b64325acdf71

SHA512
5e15df557eed7cc05388b5e5b506c2962cf81e6c9d18ad6460a0ad3756916a34033b00ba3d317e282bb4588359b66452010238c90a898bddaed2c952c6cee49d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\LWCo0QYY307Tt4E.exe

Filesize
766KB

MD5
98bb6d71947f05029c05bf6475839ce5

SHA1
9caad62d2dcb2f3d72e068643b4266cae20e2870

SHA256
0455048865ea330b772bf2586abc91f7ddeda4f7d6ef9f2de89576554fa7b3c1

SHA512
0ec35056c52cca408bfb5024226194f9727eaba5c415c3ccbe6acb0785774e43d4ddf65818c127a8770c9b05d40658479b34ffab4e4a475ed8ad142bc61bbaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\LWCo0QYY307Tt4E.exe

Filesize
766KB

MD5
98bb6d71947f05029c05bf6475839ce5

SHA1
9caad62d2dcb2f3d72e068643b4266cae20e2870

SHA256
0455048865ea330b772bf2586abc91f7ddeda4f7d6ef9f2de89576554fa7b3c1

SHA512
0ec35056c52cca408bfb5024226194f9727eaba5c415c3ccbe6acb0785774e43d4ddf65818c127a8770c9b05d40658479b34ffab4e4a475ed8ad142bc61bbaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\jdjlbhkohhbenfnjplpimnhgklllpkhe\SHwyBnSXs.js

Filesize
5KB

MD5
30f05967184ec95f49bff3df454b54c6

SHA1
ebdde0446dae1dcbbc6b57c13391749933607d56

SHA256
37ef23917a1900b143870682bac007abd159dc5f175b226433a748011a4f5651

SHA512
cac5d53586e061399ffff5afaf59ac2684966c248e808680b92967f50729aaeaa024ea13fce49e3d748603f3e217f8b07dd960a96b9cb89aba2996e20d713eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\jdjlbhkohhbenfnjplpimnhgklllpkhe\background.html

Filesize
146B

MD5
ee08a2b336bf305dd93c401e5bc2ce57

SHA1
0a0a0c39b029c88c6584b324d735b4764ca5fa84

SHA256
952fc36728376acfb6c9e6caf5fba1dbd9314c02e1cc6c7ac9ec20013fe22349

SHA512
345c09f37123df4b7c76eea6f8f81111ffda64f809abd1be90ed00aae7d26865f40416ae48a88a192bfe31a0b12f93c3d9f8e348054836cc5328d3abb599a49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\jdjlbhkohhbenfnjplpimnhgklllpkhe\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\jdjlbhkohhbenfnjplpimnhgklllpkhe\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\jdjlbhkohhbenfnjplpimnhgklllpkhe\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
46e3ad81305246079d86049ceba0b43a

SHA1
70b44be012560cd2bb14e8800fac8928fe10c59b

SHA256
1383972b3be323237c8ba0fac99043824fb0be5d4b7cba7cc95bf1c640a8759c

SHA512
ae369a865b9220d565c3a6413c74402e9a33d47819a66d119f63c2d47f34d4679dd45686f4d1dc0e9b58fd38309b85041130f92cf23f451fb3a568ae597c6654

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
bd75586c0402d3c608242bd426abed41

SHA1
dd19613e65ff4dbd234755c703dfb1218c08a35d

SHA256
78384739c25ed2979d0ec7cd5f80825ccbd703de1ce34ff64c84d2013b591ed5

SHA512
03e42ef08ebd05a4c8dccbca6ff3fbb1ad04a63c3b27fca1609628a314507f49cbd5e42bbd08a4e8e6125d1d1376a073112b495778dd1f47a929380ba068ea15

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7786.tmp\[email protected]\install.rdf

Filesize
595B

MD5
9230b78a68522199f2d045e0a21f7950

SHA1
f527eb9da39a77c6cbb19d3224eef5ab237186a0

SHA256
769bd3677e361ebe47f45986f583dbc31b71e188ecd18e22b932831154d18928

SHA512
f1e92ae0618ebecc8f4870ef2091593705e8064a89b5e5361bf515b5dcec87a4bdfcfe9359e943dcba03d26a78c951607e9c0f2c42da88971e5b86e71f6e108b

Download Submit