4d8cf7fbc02c5b9870f99e01d5f4772f4da27a119b7666750a4b3b57f17ffbc2

Analysis

max time kernel
126s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d8cf7fbc02c5b9870f99e01d5f4772f4da27a119b7666750a4b3b57f17ffbc2.exe
Size

924KB
MD5

549ae5da0692412f969750c3a1649306
SHA1

3cf7b223500b52ade8a3f5c3049f7bd720c4a480
SHA256

4d8cf7fbc02c5b9870f99e01d5f4772f4da27a119b7666750a4b3b57f17ffbc2
SHA512

547664babe32d85b4fdc71287436a17f1eb7df0c5b74c58ed5ea1355cd7c34628706008d48d9cbb4df4693ea6dddb064ce88acd0ca48e4d1365f69856e860ab9
SSDEEP

24576:h1OYdaOyfC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuXM:h1OsjMN6wdBh5N5Z4E8PuXM

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4964	hLbg18SBnsqd5jz.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfbjkpchhejcfajolooigglfjcpnefoo\2.0\manifest.json	hLbg18SBnsqd5jz.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfbjkpchhejcfajolooigglfjcpnefoo\2.0\manifest.json	hLbg18SBnsqd5jz.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfbjkpchhejcfajolooigglfjcpnefoo\2.0\manifest.json	hLbg18SBnsqd5jz.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfbjkpchhejcfajolooigglfjcpnefoo\2.0\manifest.json	hLbg18SBnsqd5jz.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfbjkpchhejcfajolooigglfjcpnefoo\2.0\manifest.json	hLbg18SBnsqd5jz.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	hLbg18SBnsqd5jz.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	hLbg18SBnsqd5jz.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	hLbg18SBnsqd5jz.exe
File opened for modification	C:\Windows\System32\GroupPolicy	hLbg18SBnsqd5jz.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe
4964	hLbg18SBnsqd5jz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	hLbg18SBnsqd5jz.exe
Token: SeDebugPrivilege	4964	hLbg18SBnsqd5jz.exe
Token: SeDebugPrivilege	4964	hLbg18SBnsqd5jz.exe
Token: SeDebugPrivilege	4964	hLbg18SBnsqd5jz.exe
Token: SeDebugPrivilege	4964	hLbg18SBnsqd5jz.exe
Token: SeDebugPrivilege	4964	hLbg18SBnsqd5jz.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4964	3564	4d8cf7fbc02c5b9870f99e01d5f4772f4da27a119b7666750a4b3b57f17ffbc2.exe	80
PID 3564 wrote to memory of 4964	3564	4d8cf7fbc02c5b9870f99e01d5f4772f4da27a119b7666750a4b3b57f17ffbc2.exe	80
PID 3564 wrote to memory of 4964	3564	4d8cf7fbc02c5b9870f99e01d5f4772f4da27a119b7666750a4b3b57f17ffbc2.exe	80

C:\Users\Admin\AppData\Local\Temp\4d8cf7fbc02c5b9870f99e01d5f4772f4da27a119b7666750a4b3b57f17ffbc2.exe
"C:\Users\Admin\AppData\Local\Temp\4d8cf7fbc02c5b9870f99e01d5f4772f4da27a119b7666750a4b3b57f17ffbc2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\hLbg18SBnsqd5jz.exe
  .\hLbg18SBnsqd5jz.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
d8136d6fdc777f1109ea29ca33295461

SHA1
0678575533038e86756bcdb35da40101368176dd

SHA256
283e0649558818252946e2a0dee8ccd7ffecf177714d15d6d15868138cf31f73

SHA512
1a79e468e2c4f660f97ee38f3798de8c815f8b359b2e04c87c59aa823f00f1ee1e05ef86a5301cac635e6adf30f526789efbbb07eea3d9f0f4facd4dc8850348

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
2a3defb07de2a29d262496e9518481e9

SHA1
e8c2a427f2ae56d94acc95a06ea20347bc2cacac

SHA256
d2030b8f635779b903d680c9924ad3d983a591a8e59d319eb3cd0c13d165314c

SHA512
afd2152ec171d96248586a352d6b9138b16881b9701f3bb47cc5e8ca637462c31c8004d0c2844e398af1e2e1fa248c86c210e89e28480289ee0d7263c9f1cc38

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\[email protected]\install.rdf

Filesize
591B

MD5
d88373f744d3cf415ec620ef9521c90e

SHA1
abf62435c2d0b021b95e01310fd5592ef0f03589

SHA256
ce713d10f74df94c6a5b5d3363ea65cfc2aeb3e6a01b95172b08774bb549c498

SHA512
2d86b34576512c30295fc2931db5610ee3342d1346364fdefa84c8c3e1ff6ee182ac89d060b6e2bc4d4fc05c9e4db5b8e153b817c65ee8c0a422bd1dd75b7458

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\hLbg18SBnsqd5jz.dat

Filesize
1KB

MD5
e7b5000bde6a36ff6c588892e8397246

SHA1
e3fa450e09477ea09f4d597177e3a7526d6e8dc2

SHA256
e8ce7f1183c5061f3fd6ab6a8f6d2aa62c8f49052431c78349a6d3a6a281b979

SHA512
fce2e07bbed65a739acc46fe99df468981ec14b186533d8e03cd732abcaa1176931daaacf16ec53461adf5514078b6a907e2574d443e1ae98827596c4912a921

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\hLbg18SBnsqd5jz.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\hLbg18SBnsqd5jz.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\pfbjkpchhejcfajolooigglfjcpnefoo\background.html

Filesize
139B

MD5
db05d53e18a08162afe1e799e4fdc17a

SHA1
98221d534e054c9db25ea1f9fc7ef2240e9f43cc

SHA256
5c1b4dd840cd5e50abbcfc3fe27bc2cbd6f8fb97f82d54b09cf6369047bc2c23

SHA512
91437fff3e925f0946988c8ecdea919cb138f08fe752369dff51684d3ca98b25e8a477ea412aa11e9083f426b55c2468c39f29436b9b6d1bec5b99d1c7820847

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\pfbjkpchhejcfajolooigglfjcpnefoo\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\pfbjkpchhejcfajolooigglfjcpnefoo\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\pfbjkpchhejcfajolooigglfjcpnefoo\mZ.js

Filesize
6KB

MD5
dcfd78dcda93f3935337baf6efd17204

SHA1
60291a4cd50bfdf81327a468b97a1d93aac1a81f

SHA256
f652d05a489464690bdd224e504952f72d336218ee9cd5b723dd8a98c63a47a1

SHA512
b5258f5f77badc7bc7eeda9967e1090f0f5b6d961b0b89d67116a7f9d30f01c6ea74ce509f87f3cf8bb92788febd757c3d9a41afdc27667d013fdd2797634906

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCD96.tmp\pfbjkpchhejcfajolooigglfjcpnefoo\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit