fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b

Analysis

max time kernel
13s
max time network
63s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe
Size

931KB
MD5

744d4d9c13e02f420fb8c8f08739104d
SHA1

816fe7ec3f216ff2c1fee369f886b358fd5a8fa7
SHA256

fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b
SHA512

1a5a9ebe5af47b2000d7cec6d1aa645eb96b651eea564d4e17f02223babfc41af1fcd025429b2fd4a4ae434e6cdc0559601bb5b6ee5a970b3d8ffbda14ceff50
SSDEEP

24576:h1OYdaOrCZ/iWCvu/2sWsJA/jlt+DHhs0:h1OsBCpYO/dJJDHhs0

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

UJBzeeaevr2Hpki.exe

pid process

1004 UJBzeeaevr2Hpki.exe
Loads dropped DLL 1 IoCs

Processes:

fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe

pid process

2044 fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2044	fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe

Drops Chrome extension 3 IoCs

Processes:

UJBzeeaevr2Hpki.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkncogbmbbaeepmalfpgioagemjmmimo\2.0\manifest.json	UJBzeeaevr2Hpki.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkncogbmbbaeepmalfpgioagemjmmimo\2.0\manifest.json	UJBzeeaevr2Hpki.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkncogbmbbaeepmalfpgioagemjmmimo\2.0\manifest.json	UJBzeeaevr2Hpki.exe

Drops file in System32 directory 4 IoCs

Processes:

UJBzeeaevr2Hpki.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	UJBzeeaevr2Hpki.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	UJBzeeaevr2Hpki.exe
File opened for modification	C:\Windows\System32\GroupPolicy	UJBzeeaevr2Hpki.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	UJBzeeaevr2Hpki.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

UJBzeeaevr2Hpki.exe

pid	process
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe
1004	UJBzeeaevr2Hpki.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

UJBzeeaevr2Hpki.exe

description	pid	process
Token: SeDebugPrivilege	1004	UJBzeeaevr2Hpki.exe
Token: SeDebugPrivilege	1004	UJBzeeaevr2Hpki.exe
Token: SeDebugPrivilege	1004	UJBzeeaevr2Hpki.exe
Token: SeDebugPrivilege	1004	UJBzeeaevr2Hpki.exe
Token: SeDebugPrivilege	1004	UJBzeeaevr2Hpki.exe
Token: SeDebugPrivilege	1004	UJBzeeaevr2Hpki.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe

description	pid	process	target process
PID 2044 wrote to memory of 1004	2044	fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe	UJBzeeaevr2Hpki.exe
PID 2044 wrote to memory of 1004	2044	fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe	UJBzeeaevr2Hpki.exe
PID 2044 wrote to memory of 1004	2044	fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe	UJBzeeaevr2Hpki.exe
PID 2044 wrote to memory of 1004	2044	fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe	UJBzeeaevr2Hpki.exe

C:\Users\Admin\AppData\Local\Temp\fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe
"C:\Users\Admin\AppData\Local\Temp\fc22fbdb473278776705e3e0112b041e911d3c498673ebe57842255dab44619b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\UJBzeeaevr2Hpki.exe
.\UJBzeeaevr2Hpki.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\UJBzeeaevr2Hpki.dat

Filesize
1KB

MD5
89884f4c3bb703ac2f8b8b2954a133d2

SHA1
61a15d6e3e8abdc6ddadf52707283f0c89e5efcc

SHA256
7b3ed13cb8ecca30e56d145bf714bf84106fe526f1dd3294fa6a35ec1ed417ae

SHA512
f09b4e29d5fced4e39d54d153b7a162de2bbedbe73f36f623ac4a187cfb8441535c5c26d05950ce707e6184b9443f5bc067c3c915573c15358f4243bb2519f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\UJBzeeaevr2Hpki.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
66e1c0bd2c09b9b60e77e55202a72f49

SHA1
f0d442eab9776628751f906069afa9044a0b5e64

SHA256
1a5cf84b145223cffc649afea197cb97342063415f59691370940381051ba397

SHA512
030ef2ca323ffaf418f618cf65e39c95762eef3337a91491dd83ae8a5c48b925adade99f206cfd254a065bb346d4388d141aca069ebe0bbc393bb8295d084a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
2071e53bc209efd67a8f46d1842a9455

SHA1
85b8180fc66b5879aa9371ab544bd01d1b478c0d

SHA256
3d328e20b0289ffe6f61d49f2da0042abcf8e600f4eff4b16f8aa42c67ac4c9c

SHA512
68dab8b79fd9d896dbe46686afba463180b6e838189ca0de505eb909c92bf501854f4eb3f6fa9e97c8796c9d1ab719a3deaa326983a88857a8c3df81111e5ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\[email protected]\install.rdf

Filesize
597B

MD5
acf58016fc2346ab554c35c758592a28

SHA1
bb8af5f6a1d70382d071710634c49ecaeefd6250

SHA256
7d958d572b76978560566ef1c6534bff013b2e3e9b7373db25153015606b0ce9

SHA512
7cc6cb46b3d43abdc0552bc47e6b4db114ce1ecb45dd4c5456e4d9eefda5f44647d065af281d0aceaafa919d87839bd6a421a77e30b9b82bd52fc2cdd6ab85bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\lkncogbmbbaeepmalfpgioagemjmmimo\JKB0VX0mOS.js

Filesize
6KB

MD5
987d7d62e29de53db86faab6c2b2aec7

SHA1
04f117db2ca13212a23a66a9b70d9ac21db0d377

SHA256
6008477d88a07bf46720e90d9b0d8f07acea67f70753871f3c32fcb5b0717455

SHA512
b796b50f2ddf504dee5384140e9a8a494d951d2cc02d4692610e0261030e32ae4082d7b00ded1c4e6d9262636a8a02181057632822386ba5d9612281be8c8b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\lkncogbmbbaeepmalfpgioagemjmmimo\background.html

Filesize
147B

MD5
6c1ef25240595a154062d697776b5d7f

SHA1
e4866490a696d054366f18e310016e1db8bc67ba

SHA256
3dcdc0ad08dade8ecb4ee3894d8b7bb4e8a869b442c8ffc78886b5a2ab945769

SHA512
ce16163105bccad3204697b9b98bebd54e7389953d9635ec8699ae01105f7e9212fdad9202c936673aac2e62920b1a3f22c61c03c1b2ec06548c4b07fdefe04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\lkncogbmbbaeepmalfpgioagemjmmimo\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\lkncogbmbbaeepmalfpgioagemjmmimo\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\lkncogbmbbaeepmalfpgioagemjmmimo\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF5E4.tmp\UJBzeeaevr2Hpki.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1004-56-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download