06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919

Analysis

max time kernel
214s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919.exe
Size

931KB
MD5

46e268b231bd09a50ec411a31657a29b
SHA1

65d6dce60b70fcf64451d4048f2d7315e8a032bb
SHA256

06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919
SHA512

829af296a7f25d262d89390bb75f02dfebce3c7079e48adef910815bc84619b22cda56794eb48365246391664001223f34aa1862a307e97f35ee5ba692071e13
SSDEEP

24576:h1OYdaOGMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfU:h1OsoMWyUQ+GUVFIcHPvpfU

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

kqXW1zmJ4fvIt7J.exe

pid process

3544 kqXW1zmJ4fvIt7J.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

kqXW1zmJ4fvIt7J.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpogcnceigdeokemipjijcknfngeickf\2.0\manifest.json	kqXW1zmJ4fvIt7J.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpogcnceigdeokemipjijcknfngeickf\2.0\manifest.json	kqXW1zmJ4fvIt7J.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpogcnceigdeokemipjijcknfngeickf\2.0\manifest.json	kqXW1zmJ4fvIt7J.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpogcnceigdeokemipjijcknfngeickf\2.0\manifest.json	kqXW1zmJ4fvIt7J.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpogcnceigdeokemipjijcknfngeickf\2.0\manifest.json	kqXW1zmJ4fvIt7J.exe

Drops file in System32 directory 4 IoCs

Processes:

kqXW1zmJ4fvIt7J.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	kqXW1zmJ4fvIt7J.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	kqXW1zmJ4fvIt7J.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	kqXW1zmJ4fvIt7J.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	kqXW1zmJ4fvIt7J.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

kqXW1zmJ4fvIt7J.exe

pid	process
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe
3544	kqXW1zmJ4fvIt7J.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

kqXW1zmJ4fvIt7J.exe

description	pid	process
Token: SeDebugPrivilege	3544	kqXW1zmJ4fvIt7J.exe
Token: SeDebugPrivilege	3544	kqXW1zmJ4fvIt7J.exe
Token: SeDebugPrivilege	3544	kqXW1zmJ4fvIt7J.exe
Token: SeDebugPrivilege	3544	kqXW1zmJ4fvIt7J.exe
Token: SeDebugPrivilege	3544	kqXW1zmJ4fvIt7J.exe
Token: SeDebugPrivilege	3544	kqXW1zmJ4fvIt7J.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919.exe

description	pid	process	target process
PID 220 wrote to memory of 3544	220	06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919.exe	kqXW1zmJ4fvIt7J.exe
PID 220 wrote to memory of 3544	220	06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919.exe	kqXW1zmJ4fvIt7J.exe
PID 220 wrote to memory of 3544	220	06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919.exe	kqXW1zmJ4fvIt7J.exe

C:\Users\Admin\AppData\Local\Temp\06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919.exe
"C:\Users\Admin\AppData\Local\Temp\06c7c6e2639f3b93e78d15a313e9bba162425935fea7ba742096be7bbf309919.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220

C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\kqXW1zmJ4fvIt7J.exe
.\kqXW1zmJ4fvIt7J.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
fe666a8bcce1aae0cf1d7e1f9cb90523

SHA1
ac78ad97a8ecd4b1f6be57e9ca5adba6647bfa1b

SHA256
dd74f0d0610748eedcc1a5f3119ebfe1291daf85635e5bd4101fb1e3c9cb5037

SHA512
575871f25931f8262483f41318a267883458415a5097df853cf763e2d5596fe3be2f45ef2308e2e5a3e24cfe4126ac56acec36beb390cffa7d199522376a6c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
fcbe0f8cde6f08c0016f3d84e0518f85

SHA1
7dc50b07631bca311498b4d763b8354922d0b4ee

SHA256
5d6a86b2a8737ee844f718751f854a64e897cf57b4661d1e2d9c085f53aa5465

SHA512
2b9bee479d316d3da1936cc95dea193ed3f80b06539f068dc9838ac87367b50e56f0a7f4f5b792edc9dc740804d3fc0c73d7434a724b5d647ee76728a00380be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\[email protected]\install.rdf
Filesize
596B

MD5
aa2637fed32ed4becaab4769b5fc9fb4

SHA1
9eefc28d030966e5e10358ceed824935e509f105

SHA256
0fdd1f353814059574daa0dcda50cbc1f5b11e4dbe2a2531d16fc5e2216e9039

SHA512
c063ecf1e79b702507561c82267edd2b69f4c8ee9ad4e673ff13e59050eef433417ec3abd7bc61b27c946d051f5fdcbb7162830d778b0945023a8f786b8d84c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\fpogcnceigdeokemipjijcknfngeickf\Fui.js
Filesize
6KB

MD5
4f611a14769c4a19c63a2b030fbbab45

SHA1
afa9c0bb23e7df61b7d9052ada790d0384c1ddc6

SHA256
5f8a15f8d7b5912b879d3b53f4a0fe626a4354989065f439ed7af92a915c9148

SHA512
c9356f860683d87627aad66de344a65fe07284956f2629eac47445e2254ab0de8553e90c4f00e8523b5ca2cc3ef9cf78bed87a2ccbf1c150c5e0ca062dd2572f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\fpogcnceigdeokemipjijcknfngeickf\background.html
Filesize
140B

MD5
d34f12720e17cec18b80a2794b695a3b

SHA1
cd192de934a6cfc75b98b403f35951b59901851b

SHA256
de1778208867a0ac475378da425edf3f2e7154161e3b794cb01e1ee97c4ee5ba

SHA512
bc8435a823cfc04e766754c7c0767b750896f275a988f05cbe8879ec24cbfb49ea45c51d63eeaf172651e414abb2edcf82017afb6050c921acbae8c05e397d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\fpogcnceigdeokemipjijcknfngeickf\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\fpogcnceigdeokemipjijcknfngeickf\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\fpogcnceigdeokemipjijcknfngeickf\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\kqXW1zmJ4fvIt7J.dat
Filesize
1KB

MD5
267b2da42d222d156d7ddfdb244bc27e

SHA1
0ac6b9fde342c2b1de640d542f732dfdf18d46d1

SHA256
ed17b85e60470d211bcd7cde04c39363099ca4d76857c82a19d796a63e6c1856

SHA512
5078ffe632f377cb893036c52d5a5d6f778d942bd28289ba5e811292ba051f6430b2e093fcbb98e52eb5b442019aded461163cb2b222b92466022b7894e832cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\kqXW1zmJ4fvIt7J.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F4F.tmp\kqXW1zmJ4fvIt7J.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/3544-132-0x0000000000000000-mapping.dmp

Download