b5f641f8417874af188d9e67a4bb35d908794e2a2767e78b81fa41ef3f76bd24

Analysis

max time kernel
157s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5f641f8417874af188d9e67a4bb35d908794e2a2767e78b81fa41ef3f76bd24.exe
Size

931KB
MD5

44377db9893744db157df53679421d17
SHA1

9920ad4e4b7e9f0755cabf3367ca24501c66ef3f
SHA256

b5f641f8417874af188d9e67a4bb35d908794e2a2767e78b81fa41ef3f76bd24
SHA512

50c474890cc6e0f0cbb6d8c118a421fff6ed8dfd22a049ee4ccb9fc249eecd03eca38b3c3dbf4b3a195b4acc928c2e390a3a013854fa3f399b6ddd90b591e1b1
SSDEEP

24576:h1OYdaOBMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfZ:h1OsnMWyUQ+GUVFIcHPvpfZ

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2164	eePWRy9cqT7eq6F.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmiaijefnmflipeonlnlbojknphkljnl\1.3\manifest.json	eePWRy9cqT7eq6F.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmiaijefnmflipeonlnlbojknphkljnl\1.3\manifest.json	eePWRy9cqT7eq6F.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmiaijefnmflipeonlnlbojknphkljnl\1.3\manifest.json	eePWRy9cqT7eq6F.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmiaijefnmflipeonlnlbojknphkljnl\1.3\manifest.json	eePWRy9cqT7eq6F.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmiaijefnmflipeonlnlbojknphkljnl\1.3\manifest.json	eePWRy9cqT7eq6F.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	eePWRy9cqT7eq6F.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	eePWRy9cqT7eq6F.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	eePWRy9cqT7eq6F.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	eePWRy9cqT7eq6F.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2164	eePWRy9cqT7eq6F.exe
2164	eePWRy9cqT7eq6F.exe
2164	eePWRy9cqT7eq6F.exe
2164	eePWRy9cqT7eq6F.exe
2164	eePWRy9cqT7eq6F.exe
2164	eePWRy9cqT7eq6F.exe
2164	eePWRy9cqT7eq6F.exe
2164	eePWRy9cqT7eq6F.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2164	4732	b5f641f8417874af188d9e67a4bb35d908794e2a2767e78b81fa41ef3f76bd24.exe	83
PID 4732 wrote to memory of 2164	4732	b5f641f8417874af188d9e67a4bb35d908794e2a2767e78b81fa41ef3f76bd24.exe	83
PID 4732 wrote to memory of 2164	4732	b5f641f8417874af188d9e67a4bb35d908794e2a2767e78b81fa41ef3f76bd24.exe	83

C:\Users\Admin\AppData\Local\Temp\b5f641f8417874af188d9e67a4bb35d908794e2a2767e78b81fa41ef3f76bd24.exe
"C:\Users\Admin\AppData\Local\Temp\b5f641f8417874af188d9e67a4bb35d908794e2a2767e78b81fa41ef3f76bd24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\eePWRy9cqT7eq6F.exe
  .\eePWRy9cqT7eq6F.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
bf7b3d51abfd81b0ba962605a7eeb41d

SHA1
8600af8871e79fd9bdc32db6937b671db0b2921c

SHA256
60b33edbc3f8936abd00135a17ba4e7a67e31a27a7d81cbab97fe006d15eb589

SHA512
400e6503aa0bf04bd6650c8d1e3df40fe31ded2934e69eaa821fc850881360822a575ae1435a8845e7d837ecb3d171ab4aebd6fc13ad94db45429450015fb4bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
bf9f70ebe204c5f51836ab5d7b0234a0

SHA1
c8dea57b1bcec2588b6ad44d109285ecddaceec4

SHA256
f1db5de7668be7f2d6060fb0009511b6c9422b515d86ef9e00d44906dd04299f

SHA512
4b4fbe7fb13245ef7c53e0f989cbd91c313843d01352d0d9867c7d090d197450e5fe512b6775d3870a43473d72ddc976cfdcc14e873b36dca15a5d40ca98f694

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\[email protected]\install.rdf

Filesize
592B

MD5
3568c7f7ae36e99143896cee47bb8a51

SHA1
d9248bb84dfab89652a06d73c0e845e98a71dc3e

SHA256
2db1c03460b46f54862d268b176b533a50bf6b7f8d99fa735eb911a3f4e18ab1

SHA512
9bbb47031cdc54a27c1dd835a6add895c4a853ab213e5a17957cbdc6fbd8473e8302f67153c8af8a48a587582d9c0659f2230ff5865b3188e0832bebfdea70bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\cmiaijefnmflipeonlnlbojknphkljnl\background.html

Filesize
140B

MD5
ccc716dacae16e7c08814bc05c239c22

SHA1
6fbe439baba1031ac2d9109c9d75a894314eec07

SHA256
2ceadc71f9daa8a48108066acce6aecbee12db430228351911d2fc2441ca503c

SHA512
03356ae7dd51d6f658cdec36e25070f97e2e6c9ef02027b00baf585275949b307bc34748b67d7f5247ccdd60c815d9ec3f81e0d9f5a7cee72a4ad481888d5aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\cmiaijefnmflipeonlnlbojknphkljnl\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\cmiaijefnmflipeonlnlbojknphkljnl\grl.js

Filesize
6KB

MD5
6c905f0fa529b55068389e630dadd685

SHA1
2fa0060ebc4658330eb2630a7014fe1703f380bd

SHA256
c18a709b73a6377301872fcb87c19ae21c85b5948c8f3d3690a3922336c5260b

SHA512
5a3f1d09861a6e0e3e10a3db0f3caa89e1c1958adf515dd69db817036aa8ef511f7e53c890cee6083780c96230185151a9357f58f8bde2f0f57f953b515419e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\cmiaijefnmflipeonlnlbojknphkljnl\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\cmiaijefnmflipeonlnlbojknphkljnl\manifest.json

Filesize
498B

MD5
664e2884e17f23553a19eee317642194

SHA1
a28ccc088d6b6692646150f3e8f111e568723fb4

SHA256
ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191

SHA512
b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\eePWRy9cqT7eq6F.dat

Filesize
1KB

MD5
ad017bd9b1261024e5a6c0b8827b0e26

SHA1
a0ad183fa603723c737168cfe432c7d569bb50b2

SHA256
1acff102f902823685aa966b36037eedd042ef9d756f5b2e6eaf54d2a0d99850

SHA512
793f817c22ce96a7590224390c07b9f3a92933a03f2cc3954cbd62e67b22aaf0159063e1b1766ded71f8efd9416d09d740ea9ced427272dd701c67f57c10c43d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\eePWRy9cqT7eq6F.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE728.tmp\eePWRy9cqT7eq6F.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit