7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d

Analysis

max time kernel
126s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d.exe
Size

931KB
MD5

4ce52e7f56d57189fe8a3e5bfe645093
SHA1

6ad2b3bcf4a7c068e5c0abb38ab642990586cf1b
SHA256

7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d
SHA512

4b21a91f33cd67c17f3ed7d5cd9e5e5dde2521918b30e4f5f61c5382a302f049d13be19bff3b3eb48003cae6ac8029a6bdcba7912837185d13840f24704bc2ab
SSDEEP

24576:h1OYdaOcMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfT:h1OsiMWyUQ+GUVFIcHPvpfT

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

V2MSBWZcll5f2wK.exe

pid process

1712 V2MSBWZcll5f2wK.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

V2MSBWZcll5f2wK.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\iaidckihacjepekfgebljfjjeogdpdcb\2.0\manifest.json	V2MSBWZcll5f2wK.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\iaidckihacjepekfgebljfjjeogdpdcb\2.0\manifest.json	V2MSBWZcll5f2wK.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\iaidckihacjepekfgebljfjjeogdpdcb\2.0\manifest.json	V2MSBWZcll5f2wK.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iaidckihacjepekfgebljfjjeogdpdcb\2.0\manifest.json	V2MSBWZcll5f2wK.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\iaidckihacjepekfgebljfjjeogdpdcb\2.0\manifest.json	V2MSBWZcll5f2wK.exe

Drops file in System32 directory 4 IoCs

Processes:

V2MSBWZcll5f2wK.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	V2MSBWZcll5f2wK.exe
File opened for modification	C:\Windows\System32\GroupPolicy	V2MSBWZcll5f2wK.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	V2MSBWZcll5f2wK.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	V2MSBWZcll5f2wK.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

V2MSBWZcll5f2wK.exe

pid	process
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe
1712	V2MSBWZcll5f2wK.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

V2MSBWZcll5f2wK.exe

description	pid	process
Token: SeDebugPrivilege	1712	V2MSBWZcll5f2wK.exe
Token: SeDebugPrivilege	1712	V2MSBWZcll5f2wK.exe
Token: SeDebugPrivilege	1712	V2MSBWZcll5f2wK.exe
Token: SeDebugPrivilege	1712	V2MSBWZcll5f2wK.exe
Token: SeDebugPrivilege	1712	V2MSBWZcll5f2wK.exe
Token: SeDebugPrivilege	1712	V2MSBWZcll5f2wK.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d.exe

description	pid	process	target process
PID 4884 wrote to memory of 1712	4884	7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d.exe	V2MSBWZcll5f2wK.exe
PID 4884 wrote to memory of 1712	4884	7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d.exe	V2MSBWZcll5f2wK.exe
PID 4884 wrote to memory of 1712	4884	7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d.exe	V2MSBWZcll5f2wK.exe

C:\Users\Admin\AppData\Local\Temp\7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d.exe
"C:\Users\Admin\AppData\Local\Temp\7c8f100984e0a8607f02f22f05ca3dcc6c4a11462c62287ee5c037f3d2c1cf4d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\V2MSBWZcll5f2wK.exe
.\V2MSBWZcll5f2wK.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
48d476c97956723e9086445ff18e1d7f

SHA1
73c80341b213ddc2a02cf237e6bc77e44351b893

SHA256
4e0c9bf5e8da1603723eeb88e1412ade38d9e501639b25d5ee24953958acab48

SHA512
7428f684ad9b2eb7efd8763aecb3f426e18a6e1a412e52abf1aa21d9eab166d896d4f209c99d4a252d7f80890f156bead440a263663da59bc4a5935d9bff628c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
df047d71595cc6f00cbf0d70bcc75c96

SHA1
4fd6b56d6d051f7567a14e68a8b1397cc2f793c5

SHA256
07cae357b21bf451f1d0528bc29fc3b7a348ff7646aa2c593fe5f47dee65b9b9

SHA512
bc729f551da076f40a7e2f1edb68299705197aa65a70614349a45bcb539e0c8a208c29595c6ecc73b95d0510c15d7c5a4344a2b1759ed2aecb61366e9f3adfac

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\[email protected]\install.rdf
Filesize
596B

MD5
28e08e4bcd58427924c4803df46ef9cc

SHA1
d1f95ff288245e19bb016187b0ef41ea8b5daf9d

SHA256
9d0177b5368a228d3c6a1847984bb225542be6d9559e6309f1bb5921a1642544

SHA512
1bd5408fcfffcb181109d48ee85e74cdec482f582242da9d934dc0c7430bb95cad700bc3a09093847ff608f4dad4d5697a6c0dac9c67f5ccc81f86307d5ff50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\V2MSBWZcll5f2wK.dat
Filesize
1KB

MD5
60f5304c24b8279023b3b3fa63bef148

SHA1
28d338a3255b2a7a7d75bfeba657026c6afce8a9

SHA256
86b2a2814a481fdfabf8cd65395ed683f8a44adf57d88acfd752575cf1f1b66d

SHA512
ddd492172e7d72770c6bd0e17b5ce414b5ca0bce13eb606d61408798f3b9a016c94a79289765277f3789e1f7c3f44ba918f6a946423041b011466933e963b1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\V2MSBWZcll5f2wK.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\V2MSBWZcll5f2wK.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\iaidckihacjepekfgebljfjjeogdpdcb\K9.js
Filesize
6KB

MD5
c906fa2b011d97d7bedb62e5a8416d6d

SHA1
ca48d8c12910a447567f05a4c06062028ee1df42

SHA256
944571b21a10c6cda60a56215fc8c6b1f4b1dde03ebb6b1a735931981597baa0

SHA512
0fbfc3c48cdc7a938651f5a72a82d03f9f7fd2d871ac3a5d1fac9bce0b94126fed5465a5ce12a10320ccd486f4816241515a753b02429098b2e488e7e009cf9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\iaidckihacjepekfgebljfjjeogdpdcb\background.html
Filesize
139B

MD5
dc6c848acd35de3c41a9df18567ee098

SHA1
9f0669f15bc51b613c7a3d7dea877ea4e8046fea

SHA256
a04e1c66aa1ad12eb0f8ed92a5b3eecc83074f9ca4c6b14949177e5b7786c963

SHA512
ebf2f194f2d0ab6bbcc2fc608d06ea6eb15d9df5c7696b172a48acab3429d32b26aed6d6715bc67510e022dcf6c412b380b15d7a4a618347788b35925f7dabac

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\iaidckihacjepekfgebljfjjeogdpdcb\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\iaidckihacjepekfgebljfjjeogdpdcb\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACA0.tmp\iaidckihacjepekfgebljfjjeogdpdcb\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1712-132-0x0000000000000000-mapping.dmp

Download