Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 16:35
Static task
static1
Behavioral task
behavioral1
Sample
fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe
Resource
win7-20220812-en
General
-
Target
fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe
-
Size
931KB
-
MD5
a9e6e6054d71e6e17309946f6ee5431d
-
SHA1
73b9a6cc597a0da66b49e0afae010eda9c0a4024
-
SHA256
fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5
-
SHA512
6d4be8453c4cd85d04358a11ebc744d5a3653d0d140882e187403c4ec82572fd0e6759c4c371fd772f3b90297b6d2e2894e0976c4d78ed92e6f83c746fb588b7
-
SSDEEP
24576:h1OYdaOkCZ/iWCvu/2sWsJA/jlt+DHhsi:h1Os6CpYO/dJJDHhsi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
7VgSQXDvMPTTxwK.exepid process 976 7VgSQXDvMPTTxwK.exe -
Loads dropped DLL 1 IoCs
Processes:
fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exepid process 1900 fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
7VgSQXDvMPTTxwK.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnfamdjghhdeddomcjeekcmbmlkembgf\2.0\manifest.json 7VgSQXDvMPTTxwK.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnfamdjghhdeddomcjeekcmbmlkembgf\2.0\manifest.json 7VgSQXDvMPTTxwK.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnfamdjghhdeddomcjeekcmbmlkembgf\2.0\manifest.json 7VgSQXDvMPTTxwK.exe -
Drops file in System32 directory 4 IoCs
Processes:
7VgSQXDvMPTTxwK.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 7VgSQXDvMPTTxwK.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 7VgSQXDvMPTTxwK.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 7VgSQXDvMPTTxwK.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 7VgSQXDvMPTTxwK.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
7VgSQXDvMPTTxwK.exepid process 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe 976 7VgSQXDvMPTTxwK.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7VgSQXDvMPTTxwK.exedescription pid process Token: SeDebugPrivilege 976 7VgSQXDvMPTTxwK.exe Token: SeDebugPrivilege 976 7VgSQXDvMPTTxwK.exe Token: SeDebugPrivilege 976 7VgSQXDvMPTTxwK.exe Token: SeDebugPrivilege 976 7VgSQXDvMPTTxwK.exe Token: SeDebugPrivilege 976 7VgSQXDvMPTTxwK.exe Token: SeDebugPrivilege 976 7VgSQXDvMPTTxwK.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exedescription pid process target process PID 1900 wrote to memory of 976 1900 fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe 7VgSQXDvMPTTxwK.exe PID 1900 wrote to memory of 976 1900 fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe 7VgSQXDvMPTTxwK.exe PID 1900 wrote to memory of 976 1900 fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe 7VgSQXDvMPTTxwK.exe PID 1900 wrote to memory of 976 1900 fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe 7VgSQXDvMPTTxwK.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe"C:\Users\Admin\AppData\Local\Temp\fb40fee5e9a7b0c4191f469f73a3a2f28c78db28b96a3b42ca9e784f644965f5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\7VgSQXDvMPTTxwK.exe.\7VgSQXDvMPTTxwK.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\7VgSQXDvMPTTxwK.datFilesize
1KB
MD5a611bd21a774b70c8f6e1bb17c71aaea
SHA1c7fb30133d9ed8f5bca945adb3e98376a98983f2
SHA256591d2501f701c4abbdc7739b6e31ad5ca093276a6f16dc8e4e51ed18d83fb949
SHA51206ccc7e3a46f5a2f2861a6133451c54041918d9b5020a4df2e63889cbe8703afdcbd855270a50adf04cbe9e04729e3024e6ed9f82fe1f8b209b385a33dadd48c
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\7VgSQXDvMPTTxwK.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\[email protected]\chrome.manifestFilesize
35B
MD51641ace1fbc3f628df523d0b9b7758fe
SHA17a5e6e1e1878591091853dbe238fdcbb9df05a7f
SHA25695ad6a28d9b69a632e5aeca8f1da00e3712ca45b4f4d43b0e48ee2de9a62b863
SHA5120f5ff295f0a754dc082687b43b636da315e2f3d49fb82697335b15bbda36eb4f931c35d246cefee4f76d5d3e6c3aa3bd304e9bb55edb0b511d19deae4e141297
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5d5528a642f8a3ea7c4cead4cda0d4500
SHA183e0951ad14d181df9218c47d2643ed3d26869ba
SHA2569478a2d55a127e06b8e199f14e56ac721c980d83bbaf7157f6441f272dab3d0e
SHA5120d7ac55fd5410796389a7daced3228bc4714de3de559ee725e529ffa4783f48f78530d320aaf106e0d372335b3d97ce5becd22ed420abad0825feedb9be0ac71
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\[email protected]\install.rdfFilesize
592B
MD58c0da816ffd8b2b62c4f7da5357caf1b
SHA107140a28dbd4be084adb00ae726044e27da8ac87
SHA256f2d1fc727b9417866fff21cdb95de07ef89a22ef126ddfc4fe50f29dc55e951b
SHA51244ddb90103f08c2263176e3350cd5cde0ffa4969e90a89c8a713dd31447197d32f11cf84232c29dacd5b24877b36289b8e6d17c5284301a45a0aa18755c528a9
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\nnfamdjghhdeddomcjeekcmbmlkembgf\XR.jsFilesize
6KB
MD5c27715a438f8e1f4a0ccd2318bfe7bf0
SHA1115ed549de1b5b673367745a531ef769eb614251
SHA256a6a1fbe400e6f26a0085221d7d0a3d0df5cab31704ed770f52f364d700126bd9
SHA5129eb08e3b30a0d352f88e8754e486ecd9190d42a262e861d33e9e4b9ba89f7b7193a0370f8abbc911a770192b942631e0638756832dc3a8252f79ad1a5e9d93c1
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\nnfamdjghhdeddomcjeekcmbmlkembgf\background.htmlFilesize
139B
MD5fa69fab4b7111ebc2dfeb133a825f3b8
SHA13dc91455325781f0bff96b6961507b2d22fd4c0e
SHA256bf89f81d293454ad308ad9f2142bb1a1c07e50fef77ab87bb2ce47e8a36b1e12
SHA512db17ee8f9d12c013de1727683c0767ff12f0dbd48328ec966d75ce3894ebee9dd1f5566b35d88d4d3d40fccb66626324178cde4d1570a8b3a3deae5d3da48ef7
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\nnfamdjghhdeddomcjeekcmbmlkembgf\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\nnfamdjghhdeddomcjeekcmbmlkembgf\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\nnfamdjghhdeddomcjeekcmbmlkembgf\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zS17E5.tmp\7VgSQXDvMPTTxwK.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/976-56-0x0000000000000000-mapping.dmp
-
memory/1900-54-0x0000000075A81000-0x0000000075A83000-memory.dmpFilesize
8KB