0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c

Analysis

max time kernel
94s
max time network
186s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c.exe
Size

931KB
MD5

29be1b52c730c7405c695d976fc20949
SHA1

18a86d0a448ede03155522622b768f4bbfe5dd94
SHA256

0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c
SHA512

c5db90067882fd319bdc53778cd69374df80d241ac87dcf373cbed7853afd703ee70e76be4bc421e176e9f7dc1b91adf36381a13a50feae69665083260b7f36b
SSDEEP

24576:h1OYdaODMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfP:h1OsRMWyUQ+GUVFIcHPvpfP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1972	1WzwD2I8mZRC4ts.exe

Loads dropped DLL 1 IoCs

pid	Process
752	0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apefpdcdfeleilcpaeofekcbmnnjimki\2.0\manifest.json	1WzwD2I8mZRC4ts.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apefpdcdfeleilcpaeofekcbmnnjimki\2.0\manifest.json	1WzwD2I8mZRC4ts.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\apefpdcdfeleilcpaeofekcbmnnjimki\2.0\manifest.json	1WzwD2I8mZRC4ts.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	1WzwD2I8mZRC4ts.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1WzwD2I8mZRC4ts.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1WzwD2I8mZRC4ts.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1WzwD2I8mZRC4ts.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe
1972	1WzwD2I8mZRC4ts.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	1WzwD2I8mZRC4ts.exe
Token: SeDebugPrivilege	1972	1WzwD2I8mZRC4ts.exe
Token: SeDebugPrivilege	1972	1WzwD2I8mZRC4ts.exe
Token: SeDebugPrivilege	1972	1WzwD2I8mZRC4ts.exe
Token: SeDebugPrivilege	1972	1WzwD2I8mZRC4ts.exe
Token: SeDebugPrivilege	1972	1WzwD2I8mZRC4ts.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1972	752	0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c.exe	28
PID 752 wrote to memory of 1972	752	0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c.exe	28
PID 752 wrote to memory of 1972	752	0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c.exe	28
PID 752 wrote to memory of 1972	752	0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c.exe	28

C:\Users\Admin\AppData\Local\Temp\0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c.exe
"C:\Users\Admin\AppData\Local\Temp\0afecd7d75f47876b56e08efd16f7ab02e23e8b54605a132a8cb40d40c082a4c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\1WzwD2I8mZRC4ts.exe
  .\1WzwD2I8mZRC4ts.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\1WzwD2I8mZRC4ts.dat

Filesize
1KB

MD5
2dbf4cb59a971ffc2ea9d16f657f4a9e

SHA1
4c1b186a8fa8043620760662594ddf84f5ebb69f

SHA256
0db2ebacc5ba84930564b2a5b30d6c138d1845aedc5c5332edcf34ca016a29ea

SHA512
0cf316265b3d48c66d46140c3712ea38208b25336a482146de9088ad8b77ef9beb5d8d09f5c0767488e0c938191fcc5dc1d013451d6964692ef37d9fca128bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\1WzwD2I8mZRC4ts.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\apefpdcdfeleilcpaeofekcbmnnjimki\background.html

Filesize
141B

MD5
aa56874704532f5b1c97ae6ed2a260c9

SHA1
4c3ad7df9dec4a56bcc169eece1b80384a296fb0

SHA256
617d97242e05a7486f408d2297e251592ed186a9e6d032d4976bcbd74e172c6b

SHA512
299058f964803a817c54d0d6c1d6cfcb15204cdba1a6c0c87f947d8f55d101254f393c0750df555f513df5d4fd94172c8d9092f0f85fbb4d2278befcdb6bd23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\apefpdcdfeleilcpaeofekcbmnnjimki\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\apefpdcdfeleilcpaeofekcbmnnjimki\hOjV.js

Filesize
6KB

MD5
eed6793d16ded96f82a1bf38506934dd

SHA1
8988a8a96f6dcaeef8a2faacfdc1b8df48007668

SHA256
ff9844b0540e57ebd514fe5911c2357a78baaaad9512a0ab2c496945e9144b3c

SHA512
f4e2f90fd968781810d4c47b622b91f67c7f3cbc9721b8cf2b7deb1981b025708cdfdd840846838db9387e385ac143f1479d14dd53038bd98243a8a11ee138d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\apefpdcdfeleilcpaeofekcbmnnjimki\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\apefpdcdfeleilcpaeofekcbmnnjimki\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
91486cc22fbc1f9060c641757c70ecf5

SHA1
8c5eded5b9df132e1f0036db5f3d1a2924522592

SHA256
82b25349e087e5c12ec0185c03dc867ee9d238726e27c0e967baa77d5792bb25

SHA512
bbc8661da6944399ec35b293e7c45bed7fe28ed445206d93de85c0addb4ca652370988e172e1bfc1d08d440fefc1ed0d87f6604bac32fdebc709c3b50d38f296

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
1dca380f0ee7c230927ded64ea3f5fcb

SHA1
73670da9ac7c29c06044c4372a7cf164e773ee75

SHA256
7240ac82d995a12db96fa060b381d1dda90964a6275e74caf1b7379d9d25bc06

SHA512
9690c797144eac96bb3a705b6c7dc8b511f80ceb175d31bf50cead47c1d2d9133c4cf744b023bb31c19e956987590d2e1f5baba24683e768e97bd3aa68adf4ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8602.tmp\[email protected]\install.rdf

Filesize
591B

MD5
d6a30a006a11fdfaf97b0c47b57bb360

SHA1
1a952fe0bac069b19dee68178f6c2d9067a58d9f

SHA256
6941767eb346223ab62183ffb7cd638080c583626ce2995d722ce93f6382702a

SHA512
28f27164bd116459e55cb6628aa6409eaa16a95d61665367ff7361167cc16e19e4de6cfed05e5a9f1f8c65773c5fdf170f27b954b1307c7881bbb3bdef3f6e4a

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8602.tmp\1WzwD2I8mZRC4ts.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/752-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download