cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e

Analysis

max time kernel
128s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e.exe
Size

924KB
MD5

04d7a67ff2bdacab4baf5a84a9478f22
SHA1

4c4f918aba7c8ca224cb8f0ee9790702aad11f65
SHA256

cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e
SHA512

f94bb43f4614fb5e1f673b4d2c82b6f4b88bf355751198132b659a6e68b2d22e8b014c2407d24dd169196bf4e97736c5fdf858bcf5339a55d4f299b5d527c742
SSDEEP

24576:h1OYdaOCfC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuXP:h1OsDMN6wdBh5N5Z4E8PuXP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

z9wWLYevW1jwaFb.exe

pid process

3252 z9wWLYevW1jwaFb.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

z9wWLYevW1jwaFb.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhmhcdidbkjealigahcdphamhlbdbam\2.0\manifest.json	z9wWLYevW1jwaFb.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhmhcdidbkjealigahcdphamhlbdbam\2.0\manifest.json	z9wWLYevW1jwaFb.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhmhcdidbkjealigahcdphamhlbdbam\2.0\manifest.json	z9wWLYevW1jwaFb.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhmhcdidbkjealigahcdphamhlbdbam\2.0\manifest.json	z9wWLYevW1jwaFb.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhmhcdidbkjealigahcdphamhlbdbam\2.0\manifest.json	z9wWLYevW1jwaFb.exe

Drops file in System32 directory 4 IoCs

Processes:

z9wWLYevW1jwaFb.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	z9wWLYevW1jwaFb.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	z9wWLYevW1jwaFb.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	z9wWLYevW1jwaFb.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	z9wWLYevW1jwaFb.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

z9wWLYevW1jwaFb.exe

pid	process
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe
3252	z9wWLYevW1jwaFb.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

z9wWLYevW1jwaFb.exe

description	pid	process
Token: SeDebugPrivilege	3252	z9wWLYevW1jwaFb.exe
Token: SeDebugPrivilege	3252	z9wWLYevW1jwaFb.exe
Token: SeDebugPrivilege	3252	z9wWLYevW1jwaFb.exe
Token: SeDebugPrivilege	3252	z9wWLYevW1jwaFb.exe
Token: SeDebugPrivilege	3252	z9wWLYevW1jwaFb.exe
Token: SeDebugPrivilege	3252	z9wWLYevW1jwaFb.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e.exe

description	pid	process	target process
PID 4764 wrote to memory of 3252	4764	cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e.exe	z9wWLYevW1jwaFb.exe
PID 4764 wrote to memory of 3252	4764	cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e.exe	z9wWLYevW1jwaFb.exe
PID 4764 wrote to memory of 3252	4764	cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e.exe	z9wWLYevW1jwaFb.exe

C:\Users\Admin\AppData\Local\Temp\cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e.exe
"C:\Users\Admin\AppData\Local\Temp\cbfbdf47238e6acbefdbe8ece64cc4f07c7f7c77519f9dedfffd06d5e097252e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764

C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\z9wWLYevW1jwaFb.exe
.\z9wWLYevW1jwaFb.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\cfhmhcdidbkjealigahcdphamhlbdbam\Z.js

Filesize
6KB

MD5
ced8a7b42e544895e70cc2edc7777748

SHA1
734dbcc3b64ecbfa55791d9ecbd492b8233687d1

SHA256
d9a1f61882d4c4975839763cc7361d135c52c5b7970799508290e7f86ef0a0ee

SHA512
36cef118c4ee2b27ed74f9d9dbde08e38cae59bf37499f5b2dcb582b7efb701ed6c7419ac346fc5d6732a33690840e229527562ba1c29852ce355fcc67e84256

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\cfhmhcdidbkjealigahcdphamhlbdbam\background.html

Filesize
138B

MD5
5b20647745785bcb1751ef5b08974d41

SHA1
06496283131d57474a01c5ff94016ed138a8acbe

SHA256
a7e45527765321b5943d2a3da8a9412965391e29d5615b51335cee9cb6b4dec5

SHA512
e43de57075993e79f6667b0d8cd29387337b02a11ed95434dbcc8e84f07153f588b0c4eec0072e4cb81e9be8613746b4d1e878055cc2afcb5a1f1c988637259b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\cfhmhcdidbkjealigahcdphamhlbdbam\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\cfhmhcdidbkjealigahcdphamhlbdbam\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\cfhmhcdidbkjealigahcdphamhlbdbam\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
0d5272b1884bbf845f4ac8b74cc3de41

SHA1
ab447f29736e2fb99615b1e187a925d749153eee

SHA256
73cf306d97912bab4d9e746837388bbb51baff3b55cdb11a3ad577a922eb39b7

SHA512
3310f9d689e12585f77e014d5d41ba463b8b5f675e8851f703a673bafd504553ffcd340cbf10f7877beb644256a84a0501bff083bf072012ac1e40747cbe274e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
e3c92011aacfb6caa1ec1bc88f29e995

SHA1
7d74370344bfca49cb85a7cbedc097a5b9e5d7be

SHA256
a50d25581791eeeb1e812c7b3209ee21c1762821c5dd2ed8db6aed3cf85e5229

SHA512
1ded68ca9daa28684c9a8e13b203d89eb2cb4b7dd839535084f67450836150c49b8d543e489f364776863e8e48588387a37ae97c1ccd280c5c8854379d76269a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\[email protected]\install.rdf

Filesize
598B

MD5
7952094294ea271addef27a787828e53

SHA1
0c62f8758267b42598163e4ed7fb2dd24f12f887

SHA256
10a54c1dbc11f35f0a83388d15c5df7b740d11ae0a4862b882f091017e9b516b

SHA512
d7e82c1fc9dd280e62f0bf6983edef8a875980e986d9e0f7e1e9df86004ecff17399adbbb5e90c501f8e8a8516515cd9c6be31ea88c852ebb8a4b84be50bbebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\z9wWLYevW1jwaFb.dat

Filesize
1KB

MD5
6139ffd94ffe65ea067986e17932d3a8

SHA1
4519aaeefbc3b8f9bf75d5aa5d698c4d2e3eeeac

SHA256
bbcd0d654fb758426752559248fad637d357dedd5b18aff64dff576929981981

SHA512
9a0735b70f7f7896e9195eb06b04750323caa4181bb5d1db2a77284b5907600d74feeb77870495b617a7d2e97d8cf38a07a894a1942c17ba91cb053fc0463892

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\z9wWLYevW1jwaFb.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF988.tmp\z9wWLYevW1jwaFb.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
memory/3252-132-0x0000000000000000-mapping.dmp

Download