bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53

Analysis

max time kernel
125s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53.exe
Size

931KB
MD5

c55252faad3a3830e62bfa787b83d406
SHA1

4f9aa5166a5e29d141043686a3b3c6c4e2ded063
SHA256

bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53
SHA512

e7e73a0ba524e1cde7c23ae557331adeef05d75e82e26b7e90bd72316376476e456cfdbe50cd6963c1bb7b2b164b2cbd4dcdc894df25af44a446cf197b485293
SSDEEP

24576:h1OYdaOGyhyrMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfM:h1OsMMWyUQ+GUVFIcHPvpfM

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

PiHgh8CZzMttuh5.exe

pid process

4636 PiHgh8CZzMttuh5.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

PiHgh8CZzMttuh5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdpikbjeficlanclcjgknlihcafipkng\2.0\manifest.json	PiHgh8CZzMttuh5.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdpikbjeficlanclcjgknlihcafipkng\2.0\manifest.json	PiHgh8CZzMttuh5.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdpikbjeficlanclcjgknlihcafipkng\2.0\manifest.json	PiHgh8CZzMttuh5.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdpikbjeficlanclcjgknlihcafipkng\2.0\manifest.json	PiHgh8CZzMttuh5.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdpikbjeficlanclcjgknlihcafipkng\2.0\manifest.json	PiHgh8CZzMttuh5.exe

Drops file in System32 directory 4 IoCs

Processes:

PiHgh8CZzMttuh5.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	PiHgh8CZzMttuh5.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	PiHgh8CZzMttuh5.exe
File opened for modification	C:\Windows\System32\GroupPolicy	PiHgh8CZzMttuh5.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	PiHgh8CZzMttuh5.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

PiHgh8CZzMttuh5.exe

pid	process
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe
4636	PiHgh8CZzMttuh5.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

PiHgh8CZzMttuh5.exe

description	pid	process
Token: SeDebugPrivilege	4636	PiHgh8CZzMttuh5.exe
Token: SeDebugPrivilege	4636	PiHgh8CZzMttuh5.exe
Token: SeDebugPrivilege	4636	PiHgh8CZzMttuh5.exe
Token: SeDebugPrivilege	4636	PiHgh8CZzMttuh5.exe
Token: SeDebugPrivilege	4636	PiHgh8CZzMttuh5.exe
Token: SeDebugPrivilege	4636	PiHgh8CZzMttuh5.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53.exe

description	pid	process	target process
PID 2200 wrote to memory of 4636	2200	bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53.exe	PiHgh8CZzMttuh5.exe
PID 2200 wrote to memory of 4636	2200	bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53.exe	PiHgh8CZzMttuh5.exe
PID 2200 wrote to memory of 4636	2200	bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53.exe	PiHgh8CZzMttuh5.exe

C:\Users\Admin\AppData\Local\Temp\bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53.exe
"C:\Users\Admin\AppData\Local\Temp\bee433b1a86447ac8277ff5f740b89c7daadda807dbebdfc343ca0d877a0cb53.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\PiHgh8CZzMttuh5.exe
.\PiHgh8CZzMttuh5.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\PiHgh8CZzMttuh5.dat

Filesize
1KB

MD5
0a17f7d19d0dec3cc94c3414197b314a

SHA1
7a4af377fa39447563075c2df002542db15c7aee

SHA256
e88df7972099b02b444c1cb100ae1fdb11ae1afd0615e3dab3df0115b3cd49c6

SHA512
2225721862b4e7e2f09ad183f9a80d9b9846a529e43aa1dad51aa7dda2923071954c166b7e9b96c033c9956523013eebd24e364c717c0e30fe9dfb5f5fc4aaf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\PiHgh8CZzMttuh5.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\PiHgh8CZzMttuh5.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
717eaa3ec5ee98d121328de41f5d57e1

SHA1
972e820726ab6cbc1c72eb1ed9aa4112fc34e304

SHA256
499df314c327c8b1a52871b9ceb83f5ffa4997f73e1c7c1a0a9b59e330121d9c

SHA512
add59faf4ac3941c8fc4f1ea7f39f8c6b23d00f8e04a6ea7ce63f5a0a07f01fd71968b366e56f33ddf405db0557fbbb43c0c4b53faf4400abe7ab9e24f9e08e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
2ba1ac7a8b66014785dd48f014ab7dc8

SHA1
82a79d0b48889bb5cc5a193c7903fc7065c16f4e

SHA256
ba688a036ae325046aa6ea180ff40615f04f81273ced11de097cb99e5ff07f57

SHA512
8f76c01e0063ff817fbfa5ea741918da5b4e6042ed11f0ed12bf3362bd7ab59fc7566f46b3bdc7c988b905315b5dac5c91b08c843141664028e92abe70ae5d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\[email protected]\install.rdf

Filesize
598B

MD5
1cfdc5cdc15bcbaf80cca26d2d146f0f

SHA1
46b86f0ff33abe9fe32858a298301adbddd8c5c6

SHA256
dd0e010b410182d951db2270440d4697869f4b20ee98384e2c83ba94d9ae03a2

SHA512
59852bc499fc70325c26f920adb078181bb769dc6f3fc4c047263cc28e13ba8b8e3de0d69c462afb677562aef32442163d241077b74a381382755d6512ee3383

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\bdpikbjeficlanclcjgknlihcafipkng\Mcrn.js

Filesize
6KB

MD5
e920d6dfdc463e1f64a24c11eeb49106

SHA1
8d97404452afc95d5198ffb7d5b8c332366dc44c

SHA256
ceee7a0ed00697f9b9af435f44678d0aa6fa276dcb80efda34484f10cf758feb

SHA512
40f1618163f338e24c3c31720b78665750b98e5d6f058faff01d311aed4892c2e66b70508715246ddf7faf8b7eb1ddacc9c0e86dfc76908aaa5ec42f0f2ed96c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\bdpikbjeficlanclcjgknlihcafipkng\background.html

Filesize
141B

MD5
962096ad8282a457e4cf151b187c4c67

SHA1
c2c4e96364e0484022111ffb26fdcaac7e6cd086

SHA256
d882a4240abf4418fc3469a577c37a504305a13998fcbf2e80ceaaf702138bbc

SHA512
c6888d2e5585edbda42f001fb311e853efa1ed5f32c55ea10488171d59dc7d00732031c9f76b7dfd9333308d5ffbad7b6f537bfed6ae772efe1d105507279b6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\bdpikbjeficlanclcjgknlihcafipkng\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\bdpikbjeficlanclcjgknlihcafipkng\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCCBB.tmp\bdpikbjeficlanclcjgknlihcafipkng\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4636-132-0x0000000000000000-mapping.dmp

Download