17eb6765eb6296b13494a5731996e8c8b268953d88ff74f6eb2f030f87eb1d20

Analysis

max time kernel
143s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17eb6765eb6296b13494a5731996e8c8b268953d88ff74f6eb2f030f87eb1d20.exe
Size

931KB
MD5

5fbd5196c8c87a249de153df878c8c70
SHA1

94a93ad620ef2ae3804d92afe9a62f6b5f1ff383
SHA256

17eb6765eb6296b13494a5731996e8c8b268953d88ff74f6eb2f030f87eb1d20
SHA512

a1f1c8900b4f4855fd891064e34b55a912d15a147908295575f29e2ea6044a217ba075d0d11757e563f8eccc474dc6596441835fd1732f3dd0ba046943a1ab65
SSDEEP

24576:h1OYdaOtMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpft:h1OsfMWyUQ+GUVFIcHPvpft

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2800	IN6p4bHzwFjCube.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfepggedibncfdgkebepaepolojoael\2.0\manifest.json	IN6p4bHzwFjCube.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfepggedibncfdgkebepaepolojoael\2.0\manifest.json	IN6p4bHzwFjCube.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfepggedibncfdgkebepaepolojoael\2.0\manifest.json	IN6p4bHzwFjCube.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfepggedibncfdgkebepaepolojoael\2.0\manifest.json	IN6p4bHzwFjCube.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfepggedibncfdgkebepaepolojoael\2.0\manifest.json	IN6p4bHzwFjCube.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	IN6p4bHzwFjCube.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	IN6p4bHzwFjCube.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	IN6p4bHzwFjCube.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	IN6p4bHzwFjCube.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe
2800	IN6p4bHzwFjCube.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	IN6p4bHzwFjCube.exe
Token: SeDebugPrivilege	2800	IN6p4bHzwFjCube.exe
Token: SeDebugPrivilege	2800	IN6p4bHzwFjCube.exe
Token: SeDebugPrivilege	2800	IN6p4bHzwFjCube.exe
Token: SeDebugPrivilege	2800	IN6p4bHzwFjCube.exe
Token: SeDebugPrivilege	2800	IN6p4bHzwFjCube.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2800	4936	17eb6765eb6296b13494a5731996e8c8b268953d88ff74f6eb2f030f87eb1d20.exe	80
PID 4936 wrote to memory of 2800	4936	17eb6765eb6296b13494a5731996e8c8b268953d88ff74f6eb2f030f87eb1d20.exe	80
PID 4936 wrote to memory of 2800	4936	17eb6765eb6296b13494a5731996e8c8b268953d88ff74f6eb2f030f87eb1d20.exe	80

C:\Users\Admin\AppData\Local\Temp\17eb6765eb6296b13494a5731996e8c8b268953d88ff74f6eb2f030f87eb1d20.exe
"C:\Users\Admin\AppData\Local\Temp\17eb6765eb6296b13494a5731996e8c8b268953d88ff74f6eb2f030f87eb1d20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\IN6p4bHzwFjCube.exe
  .\IN6p4bHzwFjCube.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\IN6p4bHzwFjCube.dat

Filesize
1KB

MD5
0b1de336b9eecc509558469a08a23a25

SHA1
92ada7ccf5daadcc2c97ab02b1161bfaf852bf4d

SHA256
7d07a876b03bedfb611d32c63b6cfe43b2ba375eb6d62fa5ab83e960bab383a5

SHA512
0fc1101cbed9e88175700d06d4af5c3650fce074ad885eda1880c49f8ad001ad7f3dab8da3d7b909fd4f5e5f3ec37c63bb9b6d45cdc401cbd5c366187bb6ff03

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\IN6p4bHzwFjCube.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\IN6p4bHzwFjCube.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
b9a0de86f148008cb0b990ef1eab1924

SHA1
ba2f4a9a746399ded5a454d89c15e9118cd55df7

SHA256
3c239fdb92e0fafb5aeba696d3744adfa612e3e6df4b72193e1e41613c1df094

SHA512
7e101052c7664d0524ac72058c98b1bfce489470344568a7e22ec14e0a128ea4449990f3be5590f88a9234a17baca51fae2826d42a98ea7d4c2c90a68d8f0b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
e47c2e80a6b3c8b9a5364d0107564129

SHA1
9e43347095416cc052e2f0ebdda8440996a126cf

SHA256
21bd9a8a1219ca7a814ee14590ff7b5ed6777f79e941d300069ff208cba864d0

SHA512
a5b50fc87e274c6af0faa97f71cf1526071a55ba17d0e2a627654faa514aaee1cf921e2c7c5a55fe7ce503439c53f1c41c87adb5f66c9a1df6513572381eb5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\[email protected]\install.rdf

Filesize
595B

MD5
17ebbf1ab6ee1db129c14c6131ce09dd

SHA1
f778ac708e1596f593c9330249e8d5fc8f7172d6

SHA256
67de12f9d4396418d0dfd40d15dd055dad0a957831010c2a971bee73b196901c

SHA512
c7d3d151235beb2e624617ab11c90d84f51dd7dd5c2cfc9394c9f77c57c34be77e723d5a0fe19a92ad0df2b0b7173e3ad4f954e5d3ea307fafefb0b1e1f9800c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\mhfepggedibncfdgkebepaepolojoael\FW.js

Filesize
6KB

MD5
8c9825b5e503a99ba95f613640e359ca

SHA1
6c4ace7237ab91f611073553488d877390eaeed6

SHA256
bea7e966b8bce4d87754239eaaf290a9ed3003777fe7405de6c9e027e965fbdf

SHA512
b10f5921e5279726c79b7076e50cf1589f8db1364c8be9c420e4d012f421b4c0edc75bc5f4eb37b5d42858eb3100a92e9652dcb05cfdf3f199f996fe2090a813

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\mhfepggedibncfdgkebepaepolojoael\background.html

Filesize
139B

MD5
742450d4eee6f30e12be7bdf6268ed5a

SHA1
ea37206e6ca6683116982fc0feddf686f9268e0d

SHA256
0024a6458aa7f6792cf85bc1719d04627688906e9709711c6618828756af3a42

SHA512
ffa486d7fbc59a3108d4263330663adb3c266cb709180a8dc80f7dfe058424c5f81bfd4126ced8794c0e41e5247c264749185f0ae5be567acbebd505c2136d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\mhfepggedibncfdgkebepaepolojoael\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\mhfepggedibncfdgkebepaepolojoael\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F8.tmp\mhfepggedibncfdgkebepaepolojoael\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit