c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d

Analysis

max time kernel
196s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d.exe
Size

931KB
MD5

50994fef394938ebdd13481228c3599e
SHA1

ad0181443bd6e9b13545d3af7162520f575ac2e3
SHA256

c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d
SHA512

3a28706b4f9e8e518b0cb630ccbb160d9667b582405770551864f3d95e33823c99a07ddb3fedbf1da42eac114a626c0f2c239129247c42688694fe6b9e98f4aa
SSDEEP

24576:h1OYdaOGMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfH:h1Os4MWyUQ+GUVFIcHPvpfH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CJP02507nuu9WTC.exe

pid process

228 CJP02507nuu9WTC.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

CJP02507nuu9WTC.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gooajhifgmlmadempdnfmilploclklik\2.0\manifest.json	CJP02507nuu9WTC.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gooajhifgmlmadempdnfmilploclklik\2.0\manifest.json	CJP02507nuu9WTC.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gooajhifgmlmadempdnfmilploclklik\2.0\manifest.json	CJP02507nuu9WTC.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gooajhifgmlmadempdnfmilploclklik\2.0\manifest.json	CJP02507nuu9WTC.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gooajhifgmlmadempdnfmilploclklik\2.0\manifest.json	CJP02507nuu9WTC.exe

Drops file in System32 directory 4 IoCs

Processes:

CJP02507nuu9WTC.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	CJP02507nuu9WTC.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	CJP02507nuu9WTC.exe
File opened for modification	C:\Windows\System32\GroupPolicy	CJP02507nuu9WTC.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	CJP02507nuu9WTC.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

CJP02507nuu9WTC.exe

pid	process
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe
228	CJP02507nuu9WTC.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

CJP02507nuu9WTC.exe

description	pid	process
Token: SeDebugPrivilege	228	CJP02507nuu9WTC.exe
Token: SeDebugPrivilege	228	CJP02507nuu9WTC.exe
Token: SeDebugPrivilege	228	CJP02507nuu9WTC.exe
Token: SeDebugPrivilege	228	CJP02507nuu9WTC.exe
Token: SeDebugPrivilege	228	CJP02507nuu9WTC.exe
Token: SeDebugPrivilege	228	CJP02507nuu9WTC.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d.exe

description	pid	process	target process
PID 2528 wrote to memory of 228	2528	c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d.exe	CJP02507nuu9WTC.exe
PID 2528 wrote to memory of 228	2528	c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d.exe	CJP02507nuu9WTC.exe
PID 2528 wrote to memory of 228	2528	c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d.exe	CJP02507nuu9WTC.exe

C:\Users\Admin\AppData\Local\Temp\c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d.exe
"C:\Users\Admin\AppData\Local\Temp\c621bb0b2cc404aa1225e78a5c7c97f6faff4a21039a7f76b92349dd5176fe4d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528

C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\CJP02507nuu9WTC.exe
.\CJP02507nuu9WTC.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\CJP02507nuu9WTC.dat
Filesize
1KB

MD5
ecdfec6a023c7344d99bd0194b406524

SHA1
0a97fd983ab957590d6fae6bee4f6c153732a28d

SHA256
d484fd5e4e786e5ebeb83b4e73164cdbdd4df116cdd50bcf4d8ba49f78000e60

SHA512
91a5ed8c8eb7234e95eb4f78a8a1a9b26f26156baaf51b8e8e61104798353f8e134b2d6be8c729f6e9b76bf355b453a2790624e16c14fe0f9317b7f30f583bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\CJP02507nuu9WTC.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\CJP02507nuu9WTC.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
28a2259fac669f0302a9e88514d56372

SHA1
005ac76a31b79ce38db1503482af5177a239e5d6

SHA256
4ad48e121e92079f51f1b4651374c4cd3d9cd82b6ac5bedcdcab776c6043c57f

SHA512
7ee78e86d1a692c0be8b4bca04b51806e2487c176e9e9b59fd80c19fa52ce6346382a2137c427d370bce983c8fa674b2c40efc41ba4be229eb21b8d165a3894d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
725511a746607ab19f7fa9ce35dc08d7

SHA1
cdfbf40fe8462c077febcad2fa07302f735b067a

SHA256
dc9adf95b96074411ff6eae09c9b4d39f02cdd983b64026fa8cea1d59a8ec5c7

SHA512
f0d33ba68d0192311ff7cb83cc3817869354b5e8bc40e2d727fcdbf2093353bf0a909e27b16fdb043f5d6d27fdf9f5ea7dd24302c2d93a6da82b6cbdf4d88f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\[email protected]\install.rdf
Filesize
598B

MD5
7e4023c7fdcd8f36e7e9a25df2ff31ed

SHA1
cd7bba2a7b515dc134d15553a4911522644d6b11

SHA256
74a9a58b51c878fce7a3d0bb60104b0a9ab44a52279e0b58e363fe11a2f4c50e

SHA512
ab6dbbc1334c7ac17da05756c668d787595e9b80abb95da0b000b8024b337c74218b8daaa61f1e51054ee576cd3f2b36856df209b6cd3b20aca883708efec089

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\gooajhifgmlmadempdnfmilploclklik\background.html
Filesize
145B

MD5
90e11b2116adec0667e5e0fafec15255

SHA1
588fb27bebf79fa81efcfc0f50fa78167db58e17

SHA256
9a6601d0dfeee1fa687d9a357529765935e78e7c3ec840d28cb315453e33701b

SHA512
c48b3669b36571a9008534cacac92b860691e7fb4de0f76f0f1dd26da5cfc315109d0c7dc25e2eb5b8a0939b9f6a7bef3b43428a7c7dd2cf5d35d7eec954b8f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\gooajhifgmlmadempdnfmilploclklik\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\gooajhifgmlmadempdnfmilploclklik\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\gooajhifgmlmadempdnfmilploclklik\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5573.tmp\gooajhifgmlmadempdnfmilploclklik\oHEyTU4T.js
Filesize
6KB

MD5
b06f00d9a1327ac77b041add867c7940

SHA1
afd87197661f897fc4056dfa68c8787a582d9756

SHA256
be80f72b01f6e481aa6e2c632f974f40941442db712954651aa89655776f64ae

SHA512
51ca5fc473f0bf35fd861a6c13c6e812f51712e8309d6b708e13d882286234e26c0565e6513fe2d79dfeadcf30d7c77c9ed7a7a2053f3b4ba6fe3388ffa7a690

Download Submit
memory/228-132-0x0000000000000000-mapping.dmp

Download