fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127.exe
Size

931KB
MD5

774f0d2036abdc5126770040f5ead005
SHA1

d8a455d20670df2402268c178b8e4a046fb823e3
SHA256

fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127
SHA512

81e2000f43382d5aba220b249ac25ba16c4abbdf384eb9d9fd1a5e136a5cb2e0c953b70cce5692d11265219be60436acb45beecad4dac6465e2de4f5c51c2ec5
SSDEEP

24576:h1OYdaOTCZ/iWCvu/2sWsJA/jlt+DHhsI:h1OsxCpYO/dJJDHhsI

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

zxfAe0kbdNwIVpK.exe

pid process

1712 zxfAe0kbdNwIVpK.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

zxfAe0kbdNwIVpK.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfnfacndpfcheiofbebgilalnaacmkcb\2.0\manifest.json	zxfAe0kbdNwIVpK.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfnfacndpfcheiofbebgilalnaacmkcb\2.0\manifest.json	zxfAe0kbdNwIVpK.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfnfacndpfcheiofbebgilalnaacmkcb\2.0\manifest.json	zxfAe0kbdNwIVpK.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfnfacndpfcheiofbebgilalnaacmkcb\2.0\manifest.json	zxfAe0kbdNwIVpK.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfnfacndpfcheiofbebgilalnaacmkcb\2.0\manifest.json	zxfAe0kbdNwIVpK.exe

Drops file in System32 directory 4 IoCs

Processes:

zxfAe0kbdNwIVpK.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	zxfAe0kbdNwIVpK.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	zxfAe0kbdNwIVpK.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	zxfAe0kbdNwIVpK.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	zxfAe0kbdNwIVpK.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

zxfAe0kbdNwIVpK.exe

pid	process
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe
1712	zxfAe0kbdNwIVpK.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

zxfAe0kbdNwIVpK.exe

description	pid	process
Token: SeDebugPrivilege	1712	zxfAe0kbdNwIVpK.exe
Token: SeDebugPrivilege	1712	zxfAe0kbdNwIVpK.exe
Token: SeDebugPrivilege	1712	zxfAe0kbdNwIVpK.exe
Token: SeDebugPrivilege	1712	zxfAe0kbdNwIVpK.exe
Token: SeDebugPrivilege	1712	zxfAe0kbdNwIVpK.exe
Token: SeDebugPrivilege	1712	zxfAe0kbdNwIVpK.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127.exe

description	pid	process	target process
PID 4972 wrote to memory of 1712	4972	fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127.exe	zxfAe0kbdNwIVpK.exe
PID 4972 wrote to memory of 1712	4972	fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127.exe	zxfAe0kbdNwIVpK.exe
PID 4972 wrote to memory of 1712	4972	fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127.exe	zxfAe0kbdNwIVpK.exe

C:\Users\Admin\AppData\Local\Temp\fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127.exe
"C:\Users\Admin\AppData\Local\Temp\fc0bdbd6acc50eb66bc2d806eb933acdaa2a2157bba8dfcb23e31f8c34cfe127.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\zxfAe0kbdNwIVpK.exe
.\zxfAe0kbdNwIVpK.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
893b57e20cf4e240067ca48d2dd4f6d5

SHA1
b127f052c23b277eaf997f8b36708928b9510391

SHA256
cd4ff247827b7cc41494a312cd957c9d151a2a18683c002cf2390678e77a887a

SHA512
392a724f62baacfbe71285af58821e1ec3d8e4f29e6e80279b3b65cca6c15ebfb8f415077b7eb8afc27962512a4846aba5ffbb28f8a7184c840b4f668726607d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
a0d9339801dcb25abd60985804a49caf

SHA1
608b0efbecb1927f5affff2a87325ef0eea5828c

SHA256
318473b133b8361d1bb20068b23c5f3585d8971135971410e38f79ac3da7ae1b

SHA512
ef2859b03cc319137c1d14987fd6c26e8e096c6cc54eca5b6e15c10a56e9d33eb2253fc52a39eed5f10b421519fdec8b0f474cfa75411a2e421564bc148fab9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\[email protected]\install.rdf

Filesize
598B

MD5
a6af6bbd94b04e92cab6db3a26a64fd5

SHA1
fb473f3516fbf0d2c0effa401b72d0a69feb9222

SHA256
f17fc3c7be921828afe7a642b9fd149da3f29f626abd84f64ad6793fdac321f8

SHA512
e45737cdf38b7251355be1a0890ec6c9c35abcbf01c272e5155c7871f04e722ccf9f72e19ed98a843b8af4f8e9abad1cf748a0e4e60c7e4d9cca3163eb3bef4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\lfnfacndpfcheiofbebgilalnaacmkcb\C5Z.js

Filesize
6KB

MD5
dee6f8dde4267734eb5e36b10a860b9f

SHA1
066eff6d8f9b01bc284b6c7116f1b74d6d6d8781

SHA256
b80cd37d3bc9a57a52f41632edca5112a0d8dcc618d6b7f37dea6b67217cb33a

SHA512
4b75ca33f36264ba5ef9e8003db31765a37b5f8a158163360dedcdedbf9d733d7f1c0e6cf7511054654a48c98bace765def49bac011af9598ecb8dfe1d03916a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\lfnfacndpfcheiofbebgilalnaacmkcb\background.html

Filesize
140B

MD5
ff54f0df4eb3187c7fa83faa54ce4da7

SHA1
1797045c5fd7c45a1239671a7f34d0e4c4ac802c

SHA256
8348971450de5185bed01a8e50b7783e8628d1bfbf0385d46190e34b676e4a69

SHA512
24b0980102977f92e65e15799c41c498d9235c38c23761e01d9df3df8bb596b97306662bacc9536044667353901540f0aaa1de2ba0feb5be8f0ea80d8966a0ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\lfnfacndpfcheiofbebgilalnaacmkcb\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\lfnfacndpfcheiofbebgilalnaacmkcb\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\lfnfacndpfcheiofbebgilalnaacmkcb\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\zxfAe0kbdNwIVpK.dat

Filesize
1KB

MD5
ac3e708c3011f566e9b6c3cc33f58a46

SHA1
21634cd305c2434c997e12ed53a1131eae02335d

SHA256
2eb1e736fb1718caeed30ce13c55a55b07515651a5dcff0570972d707bce00a5

SHA512
1664c7e429191d100f159d1868508961167b7dba096ff027c2bba2fa1494bf85195c76b3033ea70ef500437662327f12acfe86fddfc77e427f26d3155e2bab32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\zxfAe0kbdNwIVpK.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9D5E.tmp\zxfAe0kbdNwIVpK.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1712-132-0x0000000000000000-mapping.dmp

Download