87fc09b454005ef756ac108b7e55564be2a2983a1197f2609b315fce9ae5909e

Analysis

max time kernel
325s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87fc09b454005ef756ac108b7e55564be2a2983a1197f2609b315fce9ae5909e.exe
Size

931KB
MD5

7027829a9b13a5bcf561ce2290ad61c1
SHA1

5b8360719c1faf51fe5708337e83b73d76d6d329
SHA256

87fc09b454005ef756ac108b7e55564be2a2983a1197f2609b315fce9ae5909e
SHA512

4960469e0ebddd07a081dec2d04d37b4386e9f53c8d9a0699b73b018684d8bfb6b48849becddbe775b5970a3d60557df5752063cf11a7b01fe17e376a7909b61
SSDEEP

24576:h1OYdaOeIcpIcMMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfL:h1OsfMWyUQ+GUVFIcHPvpfL

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2884	iWDK905OEtU99WW.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgbpodnakcljchmnccmbhoocjajchdpn\2.0\manifest.json	iWDK905OEtU99WW.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgbpodnakcljchmnccmbhoocjajchdpn\2.0\manifest.json	iWDK905OEtU99WW.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgbpodnakcljchmnccmbhoocjajchdpn\2.0\manifest.json	iWDK905OEtU99WW.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgbpodnakcljchmnccmbhoocjajchdpn\2.0\manifest.json	iWDK905OEtU99WW.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgbpodnakcljchmnccmbhoocjajchdpn\2.0\manifest.json	iWDK905OEtU99WW.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	iWDK905OEtU99WW.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	iWDK905OEtU99WW.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	iWDK905OEtU99WW.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	iWDK905OEtU99WW.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe
2884	iWDK905OEtU99WW.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	iWDK905OEtU99WW.exe
Token: SeDebugPrivilege	2884	iWDK905OEtU99WW.exe
Token: SeDebugPrivilege	2884	iWDK905OEtU99WW.exe
Token: SeDebugPrivilege	2884	iWDK905OEtU99WW.exe
Token: SeDebugPrivilege	2884	iWDK905OEtU99WW.exe
Token: SeDebugPrivilege	2884	iWDK905OEtU99WW.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 2884	3488	87fc09b454005ef756ac108b7e55564be2a2983a1197f2609b315fce9ae5909e.exe	80
PID 3488 wrote to memory of 2884	3488	87fc09b454005ef756ac108b7e55564be2a2983a1197f2609b315fce9ae5909e.exe	80
PID 3488 wrote to memory of 2884	3488	87fc09b454005ef756ac108b7e55564be2a2983a1197f2609b315fce9ae5909e.exe	80

C:\Users\Admin\AppData\Local\Temp\87fc09b454005ef756ac108b7e55564be2a2983a1197f2609b315fce9ae5909e.exe
"C:\Users\Admin\AppData\Local\Temp\87fc09b454005ef756ac108b7e55564be2a2983a1197f2609b315fce9ae5909e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\iWDK905OEtU99WW.exe
  .\iWDK905OEtU99WW.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
df2c55ca5a3237752eae7e3c74d9e201

SHA1
0cd258c62cfc91ce8130e1c32cc16d80b0cc49ff

SHA256
4be841d6d7d79a5f2d083715205f5f9d9f194c83598ca155ba60157b7c9618bb

SHA512
3011a3bb5340d1fe92a64909aca277eaf6ac1d850fc38db609ae459469478dbc5580135a97bfc3f6effc8e2ff072dd48dac7cb4bbca38519d7b2f9c20b77a9df

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
8602e308171dfcde75a9dda7b381a8b8

SHA1
2c3a0af4b1f540806bede4877e7af2a9761590a3

SHA256
ecc2d84977dcf1c09080e01d2cc3c1eb2ae7b0a43ef53e2d3a4dd0bc302d8b10

SHA512
be48ff0e5c89bb2e3f5515e40d15fb15577050dc7fca68d0ddcb56e306c9f9d59e4fb0df41aceb2beca61ef0cba44c0d19db2b60c755976326fabf62b6d80837

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\[email protected]\install.rdf

Filesize
593B

MD5
dbb903fe8790384b8ef1c4882ec06a56

SHA1
f20f54f6b927b5d458caef87f1cecd3578bc9eac

SHA256
a78cffed65a1fbddc75e81758ed23b0a04e0b4114e852aa790bca063d73e126d

SHA512
920467c2fb33ed19c1c4d85440d76edffa54e4949f766f0cb6d359048cbe4514731cd17a7e897c7fd7365aeb5ac057e523962a91bb25992d2ac0abf9436fb8e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\hgbpodnakcljchmnccmbhoocjajchdpn\Yf.js

Filesize
6KB

MD5
3654147d18d585af447b24d22411e3b6

SHA1
347474dff0de874ee71a63ceb579b5d76e17dc4e

SHA256
552f535529ec604b838728cd15cb3a7f06642a910acba67367241c84fda02279

SHA512
cf5d5081770f7074bb9077bbb2b8a7da40f1d2a8cc387f51d147c0138d8bd814abf72d9ce5f4b5d352f081e7bfb52ad16cfa3d429bb6eb68c9fd52bdcf8c2fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\hgbpodnakcljchmnccmbhoocjajchdpn\background.html

Filesize
139B

MD5
16279e88c4ad3f6137e89e3d504396ff

SHA1
5d04cb873f34cee3c1d05e962135e416b7727b5e

SHA256
d563261a9d6754c83a69b6168b9dffec8b2b4ad611e5b0bda31ab67048fe5cfa

SHA512
2ba9e5fbca800611eed8b252e4fd8065964cbd7700aba4ae9e4429075e9e91a5bf093b0a8624acd70b5e03fb3ef61dcc6f18424aab59c91bd8fde4558b1fd19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\hgbpodnakcljchmnccmbhoocjajchdpn\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\hgbpodnakcljchmnccmbhoocjajchdpn\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\hgbpodnakcljchmnccmbhoocjajchdpn\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\iWDK905OEtU99WW.dat

Filesize
1KB

MD5
c54d95b7f316457dec27062a6387195e

SHA1
e45c302c9fec5f62e16ede532daf2e372727908f

SHA256
920ee4402c4c3fa7e8f8178cc33ccea39a3e38ba702f871a49e1a2ebf51ce0ad

SHA512
a906ab6f180f596a062144073b8c93b6c6094a682799b5cceb8bf4f4705cf7dd235fea2142b4b4c9364a23f661c2f33671d43b1d2e7ceca9608897153b80e374

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\iWDK905OEtU99WW.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS30BB.tmp\iWDK905OEtU99WW.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit