Analysis
-
max time kernel
136s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 11:41
Static task
static1
Behavioral task
behavioral1
Sample
e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f.exe
Resource
win7-20220901-en
General
-
Target
e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f.exe
-
Size
931KB
-
MD5
b927e5b2336b7a9395f75c8c3384c7c3
-
SHA1
f775ceffd3fe5291b291a7035ee2f7fa8419740e
-
SHA256
e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f
-
SHA512
6bb3500bafa73df0a9bf0ef77d0534edcd31c09514e84d11d20aa2853c073d3fa660cd7bc2524f386d30dc0506c2fc0e22b993923b87d44e237954aed8e0f869
-
SSDEEP
24576:h1OYdaOOMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpf6:h1Os4MWyUQ+GUVFIcHPvpf6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
H1JqWFoYpBw7laO.exepid process 4420 H1JqWFoYpBw7laO.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
H1JqWFoYpBw7laO.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\epkebnjeeekfbfaimnofpohdjjjcccji\2.0\manifest.json H1JqWFoYpBw7laO.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\epkebnjeeekfbfaimnofpohdjjjcccji\2.0\manifest.json H1JqWFoYpBw7laO.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\epkebnjeeekfbfaimnofpohdjjjcccji\2.0\manifest.json H1JqWFoYpBw7laO.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\epkebnjeeekfbfaimnofpohdjjjcccji\2.0\manifest.json H1JqWFoYpBw7laO.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\epkebnjeeekfbfaimnofpohdjjjcccji\2.0\manifest.json H1JqWFoYpBw7laO.exe -
Drops file in System32 directory 4 IoCs
Processes:
H1JqWFoYpBw7laO.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy H1JqWFoYpBw7laO.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini H1JqWFoYpBw7laO.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol H1JqWFoYpBw7laO.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI H1JqWFoYpBw7laO.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
H1JqWFoYpBw7laO.exepid process 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe 4420 H1JqWFoYpBw7laO.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
H1JqWFoYpBw7laO.exedescription pid process Token: SeDebugPrivilege 4420 H1JqWFoYpBw7laO.exe Token: SeDebugPrivilege 4420 H1JqWFoYpBw7laO.exe Token: SeDebugPrivilege 4420 H1JqWFoYpBw7laO.exe Token: SeDebugPrivilege 4420 H1JqWFoYpBw7laO.exe Token: SeDebugPrivilege 4420 H1JqWFoYpBw7laO.exe Token: SeDebugPrivilege 4420 H1JqWFoYpBw7laO.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f.exedescription pid process target process PID 1484 wrote to memory of 4420 1484 e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f.exe H1JqWFoYpBw7laO.exe PID 1484 wrote to memory of 4420 1484 e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f.exe H1JqWFoYpBw7laO.exe PID 1484 wrote to memory of 4420 1484 e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f.exe H1JqWFoYpBw7laO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f.exe"C:\Users\Admin\AppData\Local\Temp\e29ef4b254da522acb30b84bb1cc457f52d3b9af25d5a4b82ee52f560ac1ae8f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\H1JqWFoYpBw7laO.exe.\H1JqWFoYpBw7laO.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\H1JqWFoYpBw7laO.datFilesize
1KB
MD58d9b08df59b8a44a0400ed424bef0f6a
SHA18f7b60d33d28974c52ebbfcfb8a0fe3e4db44542
SHA256d7b5cb2cb58139912c9a82fc40dea3bf7dc5f175f27336d11ed9d0a8aa48338d
SHA512bc77f27d0f7f6b9237ea76337d08cb13aa2b46fcbd7d77efb1e3dd48e332bcc9b528d1f951600eab60da3cc67a7bbf2dd117e9dee005891abf0a8a49d14aecba
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\H1JqWFoYpBw7laO.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\H1JqWFoYpBw7laO.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\[email protected]\chrome.manifestFilesize
35B
MD5a2988d5e7d19e80a4553f5821650c821
SHA19c596e5c024657afea0b304f92b341a43765703b
SHA256089c4997f727eb5b5b7f883235378bd7516b8a005b6cf931998d9168ae77ac6e
SHA512dc868a7fac7f9ff75d71864fab32b15fc818fd1cd7c8b406152bb8fa822f7d9e8a18edbf0e9539a18a9e2832e94c7c60b0de4916142b0507ba051b0fe90961c8
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\[email protected]\content\bg.jsFilesize
8KB
MD591efc89a56f5553647b941dcada7c44c
SHA1227122f43323873ddb07fe1da231f7230ba2e3c0
SHA2563ffc37555dd4bb2860ddc4e4d8180f68be31a9e79c804daeaf6cd1a29abe999c
SHA512e6292ca24226850104bbeaa83ef4561e8f20ae351380362d075e918b6ea133f3024b8453d8f5dd1068591ba4859adcd21bb8401e833662fa7dabd9125582aa57
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\[email protected]\install.rdfFilesize
593B
MD539b8c844872a879f33dfcac2f6650bd8
SHA10e38eccb8b64fa23e7a32b806f1c93e76fa7129d
SHA2564727e1ef56970c2de339cc85a4b44cdb183fd26540c4ed1ec0fb7e742feaef4b
SHA512c7fdd6a44709537b39dc25b509129d35b0b46dcebd94f655529982a7c34b8363e71c2f627b141f33e9c7987ea63f0b6b6174b534dc72afe667718e04c6cb921c
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\epkebnjeeekfbfaimnofpohdjjjcccji\E0FFcmzY.jsFilesize
6KB
MD5009db197f67c0e9359e69bd5687455f4
SHA1bda4b244eb3962345a85682f81870ba5a4d6b6cc
SHA2565d301435ee3f2fb2367dcfc15f3faec6ea96b537a83f17bfc4ebb1bc27945646
SHA512c4dd6428c4f2b6e1df10360eb07ea2cfda9b1f20d2d8265a01500cbafde15434259c6d0f355620c2780b712b0431838a9653d1dd0cd3f632319af9049fa2e9d6
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\epkebnjeeekfbfaimnofpohdjjjcccji\background.htmlFilesize
145B
MD513db2d55b785d43a3641ceb9c91ec35f
SHA19fb61fd1b5aec124ee7c05ca09340f389ab786cc
SHA2561f7cf842efc3382cc8e8f0421e64ab59601cf61b95cb17ae936fb3180b46829f
SHA512cce905312a699bbd1578107401ed7469f8d99e25c232d2ea56327d007f13ab2320acc0798d61b4d8cd7cd551626582a4d2c4807695c60a12888b18cde52a7bb6
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\epkebnjeeekfbfaimnofpohdjjjcccji\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\epkebnjeeekfbfaimnofpohdjjjcccji\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSEBFB.tmp\epkebnjeeekfbfaimnofpohdjjjcccji\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/4420-132-0x0000000000000000-mapping.dmp