Analysis
-
max time kernel
182s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 12:00
Static task
static1
Behavioral task
behavioral1
Sample
1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850.exe
Resource
win7-20221111-en
General
-
Target
1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850.exe
-
Size
931KB
-
MD5
d236e888d04dfe8cbc509127bab92576
-
SHA1
e2e84ee395fd0be3088ea8878e6377ac68c78c5b
-
SHA256
1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850
-
SHA512
1ee648eae30b2472d926b58c39843a48d26e56be0d40c3f02cdbe998b67287f746ef6eac4eade27579540625055009c35a9035abcd745a5c0cc066e59eba1474
-
SSDEEP
24576:h1OYdaOqMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfc:h1OsAMWyUQ+GUVFIcHPvpfc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Cmw4R4nGoeqhnvC.exepid process 1304 Cmw4R4nGoeqhnvC.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
Cmw4R4nGoeqhnvC.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljlcjjobgmimdhacloigjmdcgojfoecm\2.0\manifest.json Cmw4R4nGoeqhnvC.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljlcjjobgmimdhacloigjmdcgojfoecm\2.0\manifest.json Cmw4R4nGoeqhnvC.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljlcjjobgmimdhacloigjmdcgojfoecm\2.0\manifest.json Cmw4R4nGoeqhnvC.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljlcjjobgmimdhacloigjmdcgojfoecm\2.0\manifest.json Cmw4R4nGoeqhnvC.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljlcjjobgmimdhacloigjmdcgojfoecm\2.0\manifest.json Cmw4R4nGoeqhnvC.exe -
Drops file in System32 directory 4 IoCs
Processes:
Cmw4R4nGoeqhnvC.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Cmw4R4nGoeqhnvC.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol Cmw4R4nGoeqhnvC.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI Cmw4R4nGoeqhnvC.exe File opened for modification C:\Windows\System32\GroupPolicy Cmw4R4nGoeqhnvC.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Cmw4R4nGoeqhnvC.exepid process 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe 1304 Cmw4R4nGoeqhnvC.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Cmw4R4nGoeqhnvC.exedescription pid process Token: SeDebugPrivilege 1304 Cmw4R4nGoeqhnvC.exe Token: SeDebugPrivilege 1304 Cmw4R4nGoeqhnvC.exe Token: SeDebugPrivilege 1304 Cmw4R4nGoeqhnvC.exe Token: SeDebugPrivilege 1304 Cmw4R4nGoeqhnvC.exe Token: SeDebugPrivilege 1304 Cmw4R4nGoeqhnvC.exe Token: SeDebugPrivilege 1304 Cmw4R4nGoeqhnvC.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850.exedescription pid process target process PID 1356 wrote to memory of 1304 1356 1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850.exe Cmw4R4nGoeqhnvC.exe PID 1356 wrote to memory of 1304 1356 1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850.exe Cmw4R4nGoeqhnvC.exe PID 1356 wrote to memory of 1304 1356 1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850.exe Cmw4R4nGoeqhnvC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850.exe"C:\Users\Admin\AppData\Local\Temp\1cfda56ac7c8974326249c5f2007641568d0cbc3111792c34c571920f919c850.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\7zS15F9.tmp\Cmw4R4nGoeqhnvC.exe.\Cmw4R4nGoeqhnvC.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3588
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS15F9.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS15F9.tmp\[email protected]\chrome.manifest
Filesize35B
MD50e7a6407158b5be4012f3a28f065e350
SHA12f9345617f312cdb7060be6ae708916226518bd7
SHA256725bdee87f3708a0699e2fca3404bd3396477bfd7e9b4e83957104b7fdba093b
SHA51235e7e842e7846d23a856da89d1d374e565ac782d41120564b1b8b40d2261f730ad33207ecf7e458b728c29a0a390c09d06779009814c5ca9cc51a5f604157d67
-
C:\Users\Admin\AppData\Local\Temp\7zS15F9.tmp\[email protected]\content\bg.js
Filesize8KB
MD5a38b6de6765eb0313e5349c847b751ae
SHA10077299dc288b70b7052c44910515dc438190ec8
SHA25658ed680c25bb21eb42661c9d214ef5b57c6916fb50f2e8fd69cc37b723cac6af
SHA5127e78cd05cfa79a07d5f03e5735a0c4b4aa9e823b0682454ff659862a4b517a218c54584b9fddbdb77e463ace999177d8e2013851e1452e12885304f0ba0a5374
-
C:\Users\Admin\AppData\Local\Temp\7zS15F9.tmp\[email protected]\install.rdf
Filesize590B
MD54ed9542df41241bddc2b57a75e7556b8
SHA11cf89d8c6f01cb0a3174c47d4c6d358b7ab5f026
SHA2560f8a77cdd7603e4618bc82525ef2a8e52bd420e742471dbc029987d256f7eb2a
SHA51215ea5e004abe4e09867b34adfd7973c3a172c48a19f59ab4064ff1910b3c4cf7838e3cabb687174addc7e45f3441b4024acd9f4cd87b18cba5d907d6d8863a2c
-
Filesize
1KB
MD58333fcce9c346d0d6e2cc2f2720d94d2
SHA18e8c99182cef428f47cb49105dc93421d516736a
SHA256c0ec9b69e6c1402fd292cd3158c6d94ce899c8b201d38acf190578830c078cab
SHA512f9ac6555a573001e5a094d9c9ff02f9c6c1b7e3ea74b2d823a119b279402020b7c27450ad497255255d34ba6cc0d57a2ba02a597e814b8d958b1a73f306af254
-
Filesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
Filesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
Filesize
139B
MD50f57d21f10a127bfd762ba5087f22510
SHA1cd218361620324feafd2745bab76218c7ef1de51
SHA256e899a0d4fbef8c39c58402f4dfc6d030510feb2cfcd8afc7d1015f9eb7345070
SHA51230d9a9582e2f8b09e6764d703322d9cca67e0715b490fe1790da53c951edcd423590fff0fe2bed0b17ea469d5d30fd6e7ab304ae377432318db095ab701a541b
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
Filesize
6KB
MD5f8648b418fee4c2a89d198330ffb5809
SHA16abe8c1bc6f6610b890b00b3d69926d31eab9b74
SHA2568c455e1d60c237a0f5d9d6d01d4876158559fd04cb4e5e9078e2a9cdab413323
SHA512333e6ee13d424cf1d6c2b4a7bf9f35a1d30245f3b5763abcb80a251c29994fa8128b14e7e8755accb5b148217c3d1dc422a75b47886c5c500be470f6d5f414ce