74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4.exe
Size

931KB
MD5

83c4b975bfb16e58cdd5e06b1054c667
SHA1

2dc8997357c8f82db79a0998e35583a06d3ebec6
SHA256

74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4
SHA512

85ac5013f7e0fe9578402e3d004a6cc8fdc8dfecfc98c554a007beae6a6a0b2395f819e4195a3e3f473c1e7837b60dc83ba7c377178aa320fe9ac86e9f174b2a
SSDEEP

24576:h1OYdaOHz+C9GKz+C9GgMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfC:h1OslMWyUQ+GUVFIcHPvpfC

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

61yLzPz1oHLIfqk.exe

pid process

2492 61yLzPz1oHLIfqk.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

61yLzPz1oHLIfqk.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\2.0\manifest.json	61yLzPz1oHLIfqk.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\2.0\manifest.json	61yLzPz1oHLIfqk.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\2.0\manifest.json	61yLzPz1oHLIfqk.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\2.0\manifest.json	61yLzPz1oHLIfqk.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\2.0\manifest.json	61yLzPz1oHLIfqk.exe

Drops file in System32 directory 4 IoCs

Processes:

61yLzPz1oHLIfqk.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	61yLzPz1oHLIfqk.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	61yLzPz1oHLIfqk.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	61yLzPz1oHLIfqk.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	61yLzPz1oHLIfqk.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

61yLzPz1oHLIfqk.exe

pid	process
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe
2492	61yLzPz1oHLIfqk.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

61yLzPz1oHLIfqk.exe

description	pid	process
Token: SeDebugPrivilege	2492	61yLzPz1oHLIfqk.exe
Token: SeDebugPrivilege	2492	61yLzPz1oHLIfqk.exe
Token: SeDebugPrivilege	2492	61yLzPz1oHLIfqk.exe
Token: SeDebugPrivilege	2492	61yLzPz1oHLIfqk.exe
Token: SeDebugPrivilege	2492	61yLzPz1oHLIfqk.exe
Token: SeDebugPrivilege	2492	61yLzPz1oHLIfqk.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4.exe

description	pid	process	target process
PID 4540 wrote to memory of 2492	4540	74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4.exe	61yLzPz1oHLIfqk.exe
PID 4540 wrote to memory of 2492	4540	74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4.exe	61yLzPz1oHLIfqk.exe
PID 4540 wrote to memory of 2492	4540	74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4.exe	61yLzPz1oHLIfqk.exe

C:\Users\Admin\AppData\Local\Temp\74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4.exe
"C:\Users\Admin\AppData\Local\Temp\74e63d5c03d473e40d2bbcb3663c0ba1f6edea95baa3164effd79a2ae29736c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\61yLzPz1oHLIfqk.exe
.\61yLzPz1oHLIfqk.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\61yLzPz1oHLIfqk.dat

Filesize
1KB

MD5
bb5071bec6c46f3004911e9fdbedfbaf

SHA1
82a12a9dd953ff21ffdc3d8f500ae4f4f7369b82

SHA256
71cedd3ab556d7cf4c7fed5a41da5b8a2299d30d5644211a8d6932ca9b45397f

SHA512
067f920d5a352204dfc1e70a261258f8c97064d63c765762c066ba3e9834c8354ceb54803b7a777a3e1865ed8d25618add752eb6cabd5b4cd36141db4fb925fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\61yLzPz1oHLIfqk.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\61yLzPz1oHLIfqk.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\QlLeYQN.js

Filesize
6KB

MD5
1345e7e1b4888a11cd0dcb96bdcf437d

SHA1
1d836083eda6a43474b50c6d66793ce9f7a8b17b

SHA256
45a3e451b9685aa5fa500dc5b82559375419cf2e6d1f2155a0dd93ac1d6c75ae

SHA512
e7a6dd747fb6d7a7a803c9fe8a9e79652d2f1e4a4259578666d591cc0a001a8e67fe030b1551e3a340c4f29afb373a145f8ace31c3e8a6ecefe3245405b0e333

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\background.html

Filesize
144B

MD5
1b6649992a5fcf6fea588a3d7fcfc2ba

SHA1
883f809b72e0af72d9b7fa4ba88adf9a251ff21c

SHA256
313ecaf23371b19c9fbe504148828559744b39ab29e198966406d0a066b68495

SHA512
e1a30e797c5d45e93908b47776b88b66bfe1222033f212f76277373b6b6371be5b9e4d82813bae83e415ee9de27055b5ae5875a9cb22439577267f37c0295e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\bjkjfnpoeeldfmeoahlpohmpfjcbfamk\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
10e0d3be2f385d25631bb8e7dd4135f0

SHA1
047e62d5af2263b15a93312357da5e5623ab471a

SHA256
c34080704164440848cc2678248f5266d7fa68e948a9ee2d82331d36036fa28b

SHA512
a5be7b4e47a513c16909cd02ea203c5a76a48c5b119fc10e5c245522ef36477ce1c49dffd08ab150c3f837aac999ec566462cfbf6ae39f07724cde1ca29ec574

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
0b6dd8978609f7b317184ab7327eb66b

SHA1
4e0aae73d5fcc03c0f8b35e0aa3da4c8c190f4ae

SHA256
d9f7a145e2b4c2ddc57dfbf5828a5f77960e2f5e26f3c826750a763b6b41498c

SHA512
29820359c674d39d650705f3c8010dbf063aec95f2ab2b522223195a36e8a7d20818c4f542b2e11e2faa2e6326e65da508ae0e867781cd3af9d2c2ddb47b6061

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS85BF.tmp\[email protected]\install.rdf

Filesize
591B

MD5
5309dfcffc64ce23be767cc608807629

SHA1
f6ea0a3f6038430bc7c0b4ac13c8afb934bb3328

SHA256
e8922be5526d0a39063df38328f8e7aa6845def092b42d06f262a37c749a9168

SHA512
8431a9ecbbd5621d393b23fb7ae38ad0db5c6ee7866c4161e355160ae174abf45d6bc87ba03fdccb9491432b8f4100a68814b5e1b830b80fe659f6458481ac67

Download Submit
memory/2492-132-0x0000000000000000-mapping.dmp

Download