5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61

Analysis

max time kernel
173s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61.exe
Size

931KB
MD5

2d3ef5e3cd27ec2b184f2c251c8978fb
SHA1

8ec285fe5d1ad9918613f485d8c5cbf501909cfe
SHA256

5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61
SHA512

89cf82fd07f9c225303540856cce41b8456b613a5b2a45e64c603d6ff89f2e8fd2aaad7dd252e63a953d685eae921284f477e32663a83502caaf543262a4832c
SSDEEP

24576:h1OYdaO2MWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfP:h1OsUMWyUQ+GUVFIcHPvpfP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

wgkSUq7UxfXhdsS.exe

pid process

5004 wgkSUq7UxfXhdsS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

wgkSUq7UxfXhdsS.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcimdfmilahcehomlcpahdelkablaomj\2.0\manifest.json	wgkSUq7UxfXhdsS.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcimdfmilahcehomlcpahdelkablaomj\2.0\manifest.json	wgkSUq7UxfXhdsS.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcimdfmilahcehomlcpahdelkablaomj\2.0\manifest.json	wgkSUq7UxfXhdsS.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcimdfmilahcehomlcpahdelkablaomj\2.0\manifest.json	wgkSUq7UxfXhdsS.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcimdfmilahcehomlcpahdelkablaomj\2.0\manifest.json	wgkSUq7UxfXhdsS.exe

Drops file in System32 directory 4 IoCs

Processes:

wgkSUq7UxfXhdsS.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	wgkSUq7UxfXhdsS.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	wgkSUq7UxfXhdsS.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	wgkSUq7UxfXhdsS.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	wgkSUq7UxfXhdsS.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

wgkSUq7UxfXhdsS.exe

pid	process
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe
5004	wgkSUq7UxfXhdsS.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

wgkSUq7UxfXhdsS.exe

description	pid	process
Token: SeDebugPrivilege	5004	wgkSUq7UxfXhdsS.exe
Token: SeDebugPrivilege	5004	wgkSUq7UxfXhdsS.exe
Token: SeDebugPrivilege	5004	wgkSUq7UxfXhdsS.exe
Token: SeDebugPrivilege	5004	wgkSUq7UxfXhdsS.exe
Token: SeDebugPrivilege	5004	wgkSUq7UxfXhdsS.exe
Token: SeDebugPrivilege	5004	wgkSUq7UxfXhdsS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61.exe

description	pid	process	target process
PID 1208 wrote to memory of 5004	1208	5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61.exe	wgkSUq7UxfXhdsS.exe
PID 1208 wrote to memory of 5004	1208	5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61.exe	wgkSUq7UxfXhdsS.exe
PID 1208 wrote to memory of 5004	1208	5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61.exe	wgkSUq7UxfXhdsS.exe

C:\Users\Admin\AppData\Local\Temp\5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61.exe
"C:\Users\Admin\AppData\Local\Temp\5a997a34376df80d1eeb66c8ab54e89b7e0e4ef9f45aa1a925cd44c4d0ba9f61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\wgkSUq7UxfXhdsS.exe
.\wgkSUq7UxfXhdsS.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
96bf919b50b106d1d9677d44b74d4414

SHA1
ec6369ab597e3e41528c3da8c668782626525363

SHA256
33ba65fccf08906163a612beb53d8da841b3a643405f27519fbf1b71c51841ef

SHA512
55c2e53e6c9def1cb1696ab2f24e34d5b6ce618bb0e8b7b3b1a0bcc9cd8ddebbf7fa6de2531bc47255d97ecf931b485df9bf53b190ade386986739002cd3af4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
a86faa5692e8cbdb4713b55ab9e05cde

SHA1
359d001b26e9d79b2aac32e0fe0dac4740195f9e

SHA256
20a4f5a54e24cbb6104a01187c086680d2c8ac3294dd384e9b88537c4560d2c0

SHA512
a802f1a630e779ee2ef79901e5ee5cdf433d6abd4a46aaf1f1c7f81839aa808245890582186a9ce1acbcf4cbe263dd1270156aadca2dc85110d34ec763e3d9b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\[email protected]\install.rdf

Filesize
592B

MD5
23093903393ef7c9eba030bd577294fa

SHA1
a853431351f8e106d5ee292b11f79a5370b24f0f

SHA256
3b374a2ec3d2858c8712e96632842d0ae5ea45caa3a78766bf71d15e170c421b

SHA512
9bf26b27cc6736a287a769b166d5f3ca2f358cafcb096d4d25774e0677d6276fb863d2969684b583afd8d7cea340cec7fb47c37fea3c0d550aa5d0953d77108a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\kcimdfmilahcehomlcpahdelkablaomj\background.html

Filesize
141B

MD5
c1a7aa8a3f33c5ba2d132075013e39d3

SHA1
9d5addb85be8464538a9de98f84f269b62af4ca5

SHA256
abb50b1a5be638e9f038e734c656980f61609b6731553dc80d148000707eaa9d

SHA512
e1d74a6036969f9b8d7a18446ec9b921c839e15116e115674bfbf1f18762c98a0c35047d9b31a5c9503c23d4fb8bee8de7c3551a4dd565d91b095b66df8f7ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\kcimdfmilahcehomlcpahdelkablaomj\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\kcimdfmilahcehomlcpahdelkablaomj\kMM4.js

Filesize
6KB

MD5
075f1f8f6891dae85ac8ee9cf049e399

SHA1
9e18214daec68d96dc7fa6ab59a6f2e30873d58d

SHA256
0f170adb445009990cec8f80d4865e16443539594905923d0b256348817c365f

SHA512
17107fe803e315a01d6a6751cc23e33331e2daec35cfa084297bcdef073224b268de471acc809da54e8c59eb0a77a7ea9ada15718a3bf256b4d06e12b566c40f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\kcimdfmilahcehomlcpahdelkablaomj\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\kcimdfmilahcehomlcpahdelkablaomj\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\wgkSUq7UxfXhdsS.dat

Filesize
1KB

MD5
c3813357ca35bf8ca614f93fd8a92784

SHA1
0146488a9a1f755e3947c0e7074e3e6476799a5d

SHA256
c9c6e177f808d34cf0bcd6d1347eb0007c7cd68b50827268b4e1ce554bb98044

SHA512
66ac2ed8f7666dde65cad1e486bfb797456f366d0b7fe1f7fc491641464659000d2c5f9249eb6ab88b8854a03d73e5dd69db9bca3bd8e428e4dde382580f9f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\wgkSUq7UxfXhdsS.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE3BD.tmp\wgkSUq7UxfXhdsS.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/5004-132-0x0000000000000000-mapping.dmp

Download