bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b.exe
Size

924KB
MD5

ed6256d2d1d8fd4b831653cc04edd0f0
SHA1

53caabd550e4d391bdcc1be104b037a63ef7578d
SHA256

bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b
SHA512

d4a638d14e9649f4c2a9f9e3c06ede05c0c846ad56efc41a938deef7a9f783b96b0c70460c925ac4ae1c751309c59ccf4e8719ce418e78b16cf3c1cb3aae209c
SSDEEP

24576:h1OYdaO14BQGx2jUReefMaGeOPw8Y7H3b+Q4:h1OsH4BQ02o4efMz68Y/+Q4

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ZJ0LbaMPMgn0dV2.exe

pid process

4908 ZJ0LbaMPMgn0dV2.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

ZJ0LbaMPMgn0dV2.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilnpnghdlbpeejlhnficmhcgboddlbbh\2.0\manifest.json	ZJ0LbaMPMgn0dV2.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilnpnghdlbpeejlhnficmhcgboddlbbh\2.0\manifest.json	ZJ0LbaMPMgn0dV2.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilnpnghdlbpeejlhnficmhcgboddlbbh\2.0\manifest.json	ZJ0LbaMPMgn0dV2.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilnpnghdlbpeejlhnficmhcgboddlbbh\2.0\manifest.json	ZJ0LbaMPMgn0dV2.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilnpnghdlbpeejlhnficmhcgboddlbbh\2.0\manifest.json	ZJ0LbaMPMgn0dV2.exe

Drops file in System32 directory 4 IoCs

Processes:

ZJ0LbaMPMgn0dV2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	ZJ0LbaMPMgn0dV2.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ZJ0LbaMPMgn0dV2.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ZJ0LbaMPMgn0dV2.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ZJ0LbaMPMgn0dV2.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

ZJ0LbaMPMgn0dV2.exe

pid	process
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe
4908	ZJ0LbaMPMgn0dV2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ZJ0LbaMPMgn0dV2.exe

description	pid	process
Token: SeDebugPrivilege	4908	ZJ0LbaMPMgn0dV2.exe
Token: SeDebugPrivilege	4908	ZJ0LbaMPMgn0dV2.exe
Token: SeDebugPrivilege	4908	ZJ0LbaMPMgn0dV2.exe
Token: SeDebugPrivilege	4908	ZJ0LbaMPMgn0dV2.exe
Token: SeDebugPrivilege	4908	ZJ0LbaMPMgn0dV2.exe
Token: SeDebugPrivilege	4908	ZJ0LbaMPMgn0dV2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b.exe

description	pid	process	target process
PID 1368 wrote to memory of 4908	1368	bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b.exe	ZJ0LbaMPMgn0dV2.exe
PID 1368 wrote to memory of 4908	1368	bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b.exe	ZJ0LbaMPMgn0dV2.exe
PID 1368 wrote to memory of 4908	1368	bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b.exe	ZJ0LbaMPMgn0dV2.exe

C:\Users\Admin\AppData\Local\Temp\bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b.exe
"C:\Users\Admin\AppData\Local\Temp\bbe4b3680016f5ceec2584ef3679c992035dd488185f97dbbcc800bfb5d26c2b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ZJ0LbaMPMgn0dV2.exe
.\ZJ0LbaMPMgn0dV2.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ZJ0LbaMPMgn0dV2.dat

Filesize
1KB

MD5
7478a7da143a55dc4a6d83d4e9163157

SHA1
44832f5ced5cfec4d870111e46d12d7074fe6339

SHA256
428fd50c3e060d744289ec1e001be1152cff568f44c44ca7c95bca8a945146b2

SHA512
c4dd104cbee42c60379efd8a51d255f369ed2c3f4f570199337da8e0a64daddd5de5274be4e3626c0609e1a7bfae02445e38cc27726d910e9bd311b13df3418c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ZJ0LbaMPMgn0dV2.exe

Filesize
766KB

MD5
98bb6d71947f05029c05bf6475839ce5

SHA1
9caad62d2dcb2f3d72e068643b4266cae20e2870

SHA256
0455048865ea330b772bf2586abc91f7ddeda4f7d6ef9f2de89576554fa7b3c1

SHA512
0ec35056c52cca408bfb5024226194f9727eaba5c415c3ccbe6acb0785774e43d4ddf65818c127a8770c9b05d40658479b34ffab4e4a475ed8ad142bc61bbaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ZJ0LbaMPMgn0dV2.exe

Filesize
766KB

MD5
98bb6d71947f05029c05bf6475839ce5

SHA1
9caad62d2dcb2f3d72e068643b4266cae20e2870

SHA256
0455048865ea330b772bf2586abc91f7ddeda4f7d6ef9f2de89576554fa7b3c1

SHA512
0ec35056c52cca408bfb5024226194f9727eaba5c415c3ccbe6acb0785774e43d4ddf65818c127a8770c9b05d40658479b34ffab4e4a475ed8ad142bc61bbaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
71142be0653f27a4a8d577b662ba0ae2

SHA1
e2e354949a6254631cd48062825d938abe8ae4ef

SHA256
d99099729ab11c9ad2c7325a7b8128c0f055d1fdd1cb07cb52ce9674b090b259

SHA512
5cfaf15cac6bab674b8d0aba8f3e85bd8eb5a8cab20af822ef3ef7a9b0d456c8b5564f97e73898a56ae694c78fe4035fba8e64b9813f3088f2454394ffc59196

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
d6821ea50921ad2baab750f56d92535a

SHA1
acd2402d28b97b278300c6262d88a09826b915d1

SHA256
26e4c574db9b4a5e87fbe9c3ba0d6b82ebcb80eea656a08bcd8c0e68dff68947

SHA512
22f941f25cd9d3d197f2e6a05b4586e4d91c161b5a5123f5a45cbbb77a1487ccbeb6b1b138bbf940df37c08619a48a8d552a18e9d412de2b47e909a30edc1124

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\[email protected]\install.rdf

Filesize
596B

MD5
4d1c0c7ba922e1c074a1236a6816d105

SHA1
d3dd24bd8de27303c6ac02ae847554837aa2f334

SHA256
4a43e2780ae647454cf5b60572efee8737a09bf5582d6b4eaad3584edf8ecd43

SHA512
0c973151adcacf8ccd9d7d148fad632d0739c8751023dcafde6b0eccd058c06f9a95a9b3480dd4429a2b59163a78d60b432b823c49e8ceda186eec11e69dc8aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ilnpnghdlbpeejlhnficmhcgboddlbbh\background.html

Filesize
142B

MD5
760a4f9ddba31e9a9eaa33a1a025ca2a

SHA1
f332602e70fc04f5fac6ca8d534a47b610c68fb3

SHA256
0cd54c7b953014d6708601daf16cddddc69bf379e9f86282a4b95bc9dd6ce378

SHA512
20d68c6c1f366d25510e3adf39f57439938ec6d22aa6333892eab3ddc79451ee73828056831c5f40edb2751509646b59d9d2d072415b36139a4519699ef14c64

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ilnpnghdlbpeejlhnficmhcgboddlbbh\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ilnpnghdlbpeejlhnficmhcgboddlbbh\lf3Rf.js

Filesize
5KB

MD5
7fd0a6a8767bdb20988023e91bb77530

SHA1
d142497a81cd1b16f022508753c79a74dadad482

SHA256
ca2ebbc3f3bdc503ae87b36160419ea430c439032ad72dcfade80b55f3d07feb

SHA512
e7357261a47a07d36c83b977ef958f1b87d803fbe7c3157b904a93c03bca9d7bd134c2955f8f9779b25a3a815ff81c835f643a95e0f5fa8b4ae9b710164b12d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ilnpnghdlbpeejlhnficmhcgboddlbbh\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA28E.tmp\ilnpnghdlbpeejlhnficmhcgboddlbbh\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4908-132-0x0000000000000000-mapping.dmp

Download