ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991

Analysis

max time kernel
126s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991.exe
Size

931KB
MD5

416d3bc79e27369bc357cd21ac2c99ff
SHA1

faa1076d903871c3ae493e59b051b988c8e86d9b
SHA256

ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991
SHA512

e3e330da27f48c34af532d39ce580a0a7121a9a430a1924ed497438841fb33f16c70698c0720273438dad52b4271d03f0983fab9ad90863aeda283fd11e451b3
SSDEEP

24576:h1OYdaOxMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfW:h1Os/MWyUQ+GUVFIcHPvpfW

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

4tIH3NSdYMNioWH.exe

pid process

2500 4tIH3NSdYMNioWH.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

4tIH3NSdYMNioWH.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpccnfaekicndbdfbddjoddijmhgbp\2.0\manifest.json	4tIH3NSdYMNioWH.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpccnfaekicndbdfbddjoddijmhgbp\2.0\manifest.json	4tIH3NSdYMNioWH.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpccnfaekicndbdfbddjoddijmhgbp\2.0\manifest.json	4tIH3NSdYMNioWH.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpccnfaekicndbdfbddjoddijmhgbp\2.0\manifest.json	4tIH3NSdYMNioWH.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpccnfaekicndbdfbddjoddijmhgbp\2.0\manifest.json	4tIH3NSdYMNioWH.exe

Drops file in System32 directory 4 IoCs

Processes:

4tIH3NSdYMNioWH.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	4tIH3NSdYMNioWH.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	4tIH3NSdYMNioWH.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	4tIH3NSdYMNioWH.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	4tIH3NSdYMNioWH.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

4tIH3NSdYMNioWH.exe

pid	process
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe
2500	4tIH3NSdYMNioWH.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

4tIH3NSdYMNioWH.exe

description	pid	process
Token: SeDebugPrivilege	2500	4tIH3NSdYMNioWH.exe
Token: SeDebugPrivilege	2500	4tIH3NSdYMNioWH.exe
Token: SeDebugPrivilege	2500	4tIH3NSdYMNioWH.exe
Token: SeDebugPrivilege	2500	4tIH3NSdYMNioWH.exe
Token: SeDebugPrivilege	2500	4tIH3NSdYMNioWH.exe
Token: SeDebugPrivilege	2500	4tIH3NSdYMNioWH.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991.exe

description	pid	process	target process
PID 5068 wrote to memory of 2500	5068	ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991.exe	4tIH3NSdYMNioWH.exe
PID 5068 wrote to memory of 2500	5068	ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991.exe	4tIH3NSdYMNioWH.exe
PID 5068 wrote to memory of 2500	5068	ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991.exe	4tIH3NSdYMNioWH.exe

C:\Users\Admin\AppData\Local\Temp\ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991.exe
"C:\Users\Admin\AppData\Local\Temp\ba34d9e090870347fdbe9d934fae40eb0f185e8d5692e247f588b4b50247f991.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\4tIH3NSdYMNioWH.exe
.\4tIH3NSdYMNioWH.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\4tIH3NSdYMNioWH.dat

Filesize
1KB

MD5
2be7e39e148f129054bec90cdf869fb7

SHA1
275fe5ae1ac5a9488410c87ddf0c55a53449919f

SHA256
248e8bae9a9ec622b72488cbf1819c67e7264e50ab032bfd61716690d219fe3f

SHA512
253ef1a7fdb9ca5c2c10b533b784b462340b8bba2f02422f2f02bed369edcbec04626e474589c4f0e6d9a4a1a0bc0f8de64e3b37f2ca46b22963cd44bfdd1421

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\4tIH3NSdYMNioWH.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\4tIH3NSdYMNioWH.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
4714c888d6077e72508638c24d833f12

SHA1
570afc80e6ad3990e4ce7259c9dadca4cfe74fce

SHA256
4998058c20a42be8c4b00de696a7d9f8c35c31202a2699ff66c2435fde1d2030

SHA512
412ebea368faf7c131b6df0e896d413d9fd63f4e8e95603b68b4414fecba264b2a9a853f097693459a9a10c7c7c27e3dc5f58aea9cbe65b635b1ffcdb8488804

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
926cc875d0f7eca67bd10fd99681c8bd

SHA1
d564a04b2108ee380ece319e04b86690530395f4

SHA256
656fa6b89b8b4c3fc058fe0c187c440e68ecfa9f17b337e578284b25447c1561

SHA512
f4de34901c04534f5165f844584d36f89b77428a4b3850467f4b4f71932788e52aee23286fc36a3ee913fb563ec93e201cd626eed55ff7ffa48ccf7f1c66f10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\[email protected]\install.rdf

Filesize
597B

MD5
83ca633c5167b9bf0b93ec1d4eab4731

SHA1
8dad44dae8f37dde1b27953bf8b745601ed837ef

SHA256
baeb3641b5d1d9a55c16b750be61350660710f291a72c043aec1606f4c1abaa5

SHA512
45f3e0d15a6149a4cd5b3c3a90fd6702fb86d9c430e120c176d478764e9c3fd720eefdf43b304d72911949dd819156c18a053ac0bd9b2600fbdb060e49de8479

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\ndjpccnfaekicndbdfbddjoddijmhgbp\background.html

Filesize
138B

MD5
e610c64fcaf46c1f10309b2165f49370

SHA1
76168e031e1d07d2d52630bf76bc4907c6bbc9ae

SHA256
b31e69345000bb479ddcb3ca8005ee5f81636e82211e5028613ec0baae6f046f

SHA512
7d0a7933b4e5be05cf9a6476498051dbfba61be13e7fedc4d8fb694193c3045dc6564c5d607d63bfe657cedc6a0e86ff31317b9eb7492d34ef5aa9054d2374a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\ndjpccnfaekicndbdfbddjoddijmhgbp\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\ndjpccnfaekicndbdfbddjoddijmhgbp\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\ndjpccnfaekicndbdfbddjoddijmhgbp\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC095.tmp\ndjpccnfaekicndbdfbddjoddijmhgbp\q.js

Filesize
6KB

MD5
86f99fb95df332709af55a3d57ebc4f2

SHA1
52f8732e5c097f8e68c1b76454b195deb182c349

SHA256
1d261561a4c17e3ac0566372d069cf509f10b490617ce60d4560eb508146c299

SHA512
cbad44938e984ccb73f29cfe014815b0fd78148fec05e796a889cecb2c77569e5a3e38d18665ecaf1f4c3b7174825c28a8a87efc5df09cc58e5097db35c90a98

Download Submit
memory/2500-132-0x0000000000000000-mapping.dmp

Download