fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c

Analysis

max time kernel
131s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c.exe
Size

927KB
MD5

2b4b1ba74c1ea3a951c1e074a3a5bb5b
SHA1

febd062ff9246f4d9eac38c2f3cf52be898186b3
SHA256

fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c
SHA512

5e9c59f7050663fed020802db07ef4dd85bc93d4a592ebade5dcfc4533fa939a9f3c2f8a458dda6d2a63f6c1fd8ee661c5bdba1355310a32053239f49b043e2d
SSDEEP

24576:h1OYdaOujqjInQju5vMu6qN2FctIOBYXZBai3GBlgpKLe/7rc:h1OsOQjO6HHzayGBe/7rc

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

A3p4Wq2K97hWGMD.exe

pid process

1852 A3p4Wq2K97hWGMD.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

A3p4Wq2K97hWGMD.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofkjagaaabdcfanfldkjbcbaaigjmbbh\2.0\manifest.json	A3p4Wq2K97hWGMD.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofkjagaaabdcfanfldkjbcbaaigjmbbh\2.0\manifest.json	A3p4Wq2K97hWGMD.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofkjagaaabdcfanfldkjbcbaaigjmbbh\2.0\manifest.json	A3p4Wq2K97hWGMD.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofkjagaaabdcfanfldkjbcbaaigjmbbh\2.0\manifest.json	A3p4Wq2K97hWGMD.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofkjagaaabdcfanfldkjbcbaaigjmbbh\2.0\manifest.json	A3p4Wq2K97hWGMD.exe

Drops file in System32 directory 4 IoCs

Processes:

A3p4Wq2K97hWGMD.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	A3p4Wq2K97hWGMD.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	A3p4Wq2K97hWGMD.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	A3p4Wq2K97hWGMD.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	A3p4Wq2K97hWGMD.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

A3p4Wq2K97hWGMD.exe

pid	process
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe
1852	A3p4Wq2K97hWGMD.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

A3p4Wq2K97hWGMD.exe

description	pid	process
Token: SeDebugPrivilege	1852	A3p4Wq2K97hWGMD.exe
Token: SeDebugPrivilege	1852	A3p4Wq2K97hWGMD.exe
Token: SeDebugPrivilege	1852	A3p4Wq2K97hWGMD.exe
Token: SeDebugPrivilege	1852	A3p4Wq2K97hWGMD.exe
Token: SeDebugPrivilege	1852	A3p4Wq2K97hWGMD.exe
Token: SeDebugPrivilege	1852	A3p4Wq2K97hWGMD.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c.exe

description	pid	process	target process
PID 4024 wrote to memory of 1852	4024	fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c.exe	A3p4Wq2K97hWGMD.exe
PID 4024 wrote to memory of 1852	4024	fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c.exe	A3p4Wq2K97hWGMD.exe
PID 4024 wrote to memory of 1852	4024	fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c.exe	A3p4Wq2K97hWGMD.exe

C:\Users\Admin\AppData\Local\Temp\fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c.exe
"C:\Users\Admin\AppData\Local\Temp\fc759766d46607218f06a91fa1fa053b2cc45e0a660fc632fe2b6a3fa9e36a9c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024

C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\A3p4Wq2K97hWGMD.exe
.\A3p4Wq2K97hWGMD.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\A3p4Wq2K97hWGMD.dat

Filesize
1KB

MD5
5c1313a98448620aa3beb1dead129f09

SHA1
65aaba5281c19c67e9a8a6c8bbf174cafa9ed6b5

SHA256
efb4ea0b6e85025d227376880580b57f1df3211e8cbd0de91c9d563803838a21

SHA512
9b35b0885aac2ad683c996008be83dfc3f7643ab41c5d159a047da3049a66382b082a781b52a378fc69f3a79c6c768e0df70bb9226c2e1a8df160a89f22888d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\A3p4Wq2K97hWGMD.exe

Filesize
768KB

MD5
09e156c94b649920c0c6efa8508ada9a

SHA1
8ba966f84a07648613468b06a11d17f2650e8af0

SHA256
2584e4b5077edba37c8e6f97ccdc2e582136ae0144212b37eb97cd4d8685059a

SHA512
1a1d2ff05d413ec1c18735dcb06775f0e652fc778f0ce31a9bdc8e567beb32253df635ee2e9b3bdc430c49f0f5ca6128e44cbd88b2cb712a6712c8327f209375

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\A3p4Wq2K97hWGMD.exe

Filesize
768KB

MD5
09e156c94b649920c0c6efa8508ada9a

SHA1
8ba966f84a07648613468b06a11d17f2650e8af0

SHA256
2584e4b5077edba37c8e6f97ccdc2e582136ae0144212b37eb97cd4d8685059a

SHA512
1a1d2ff05d413ec1c18735dcb06775f0e652fc778f0ce31a9bdc8e567beb32253df635ee2e9b3bdc430c49f0f5ca6128e44cbd88b2cb712a6712c8327f209375

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
794c431bd2b9f8fa630eb6f82b334ad6

SHA1
583d6bea4873e5776dd89714d5cbf1b9597628c8

SHA256
34e0938d8a7064a3e02d80aad7c3b4d931c26261280a2e3c939d8c2bc346d85b

SHA512
40520dec8e74faa260c10f440cf61a586659ce80d7632dc77018297be37ff4f44ef7be2080c317b9e354f9b8100a8ae1afed917e41927e6ae45e3d1f7de598ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
3c85ee383af549eb480e979cc79bff7a

SHA1
d06cd03c5d1c4d609f3973695213577f8b8b0cbc

SHA256
6cfe583cd05cc25229a0f2529fae1998ed01f2efbcb12fdf5c0cbd42202b7924

SHA512
14c98771de10350d984ee06a75c9eaf40b969b1b19dad7814d4f8ee35410a9dfcf0a9bd9835e98396269355569b16eac44bfb29d4bd9bda4c20f413163a5a1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\[email protected]\install.rdf

Filesize
594B

MD5
a337944191b8eeaff9f6307d9e030746

SHA1
b64a12e4d1989d340875d5a872d0c2b61ff85658

SHA256
8386b9c18066fb715b459d6e5d311378e5bde80593abd956d11dae9cb45269fd

SHA512
483bf7776dd5ef0e4fbef2f2e653fd8978cbe311cbd58047f4bb244f00acd06147a711469bacdd9076ea2cca8de91390fdd4c8e0ae2e4a0337014fb636ce87e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\ofkjagaaabdcfanfldkjbcbaaigjmbbh\background.html

Filesize
143B

MD5
1797f72f43586badd0bd66b578ea23fe

SHA1
8a68f985946552479d0cf53c7a7ab09e09a89489

SHA256
4730b4d2fd41eddf7c0fce9b470e85a56a9465a11e78a3f86af431dd00f42ceb

SHA512
0747fa463a3aab569c81faa3b58837654074f1c9e68702fedcb8cbe217315cd05b89406f6ac3b644d83bb2ed2e5cc840a8b880cd73754d5655aebf5159ecabe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\ofkjagaaabdcfanfldkjbcbaaigjmbbh\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\ofkjagaaabdcfanfldkjbcbaaigjmbbh\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\ofkjagaaabdcfanfldkjbcbaaigjmbbh\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE10E.tmp\ofkjagaaabdcfanfldkjbcbaaigjmbbh\ppGD0m.js

Filesize
6KB

MD5
053447da02f205014593b3999bad8193

SHA1
e430fc804778b384a5860787499b0567cd0c9f4c

SHA256
861f65661ce4d4f1427b5b7bfdc07dfdd09bb40711f4e987968b2ddd180003c5

SHA512
852237b87fc39664d98096c1c34f5c62485195879389ea019e94649ef1616fab8f93687e08a09347a041de6b26f671b35f1a02ba8b3d1816dd27ab7e5ac7e474

Download Submit
memory/1852-132-0x0000000000000000-mapping.dmp

Download