faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c.exe
Size

931KB
MD5

8d95f456f334a491bcd8488ed89f5317
SHA1

851c5d1661291dd495aa4f0b8febfb449ac300b7
SHA256

faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c
SHA512

97562860460b96130ce6a315b17ef95f5b2862ad89b2601dcb184c106df6e7f456a53e218a46f0443e73bc26ff279d049d9f74f3bcba832c2b6a9bac31219df2
SSDEEP

24576:h1OYdaOHCZ/iWCvu/2sWsJA/jlt+DHhs4:h1OsdCpYO/dJJDHhs4

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

DNZ3nmK2ppEQda5.exe

pid process

1716 DNZ3nmK2ppEQda5.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

DNZ3nmK2ppEQda5.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfohccfjfplbfejbninimjngmhilgmai\2.0\manifest.json	DNZ3nmK2ppEQda5.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfohccfjfplbfejbninimjngmhilgmai\2.0\manifest.json	DNZ3nmK2ppEQda5.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfohccfjfplbfejbninimjngmhilgmai\2.0\manifest.json	DNZ3nmK2ppEQda5.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfohccfjfplbfejbninimjngmhilgmai\2.0\manifest.json	DNZ3nmK2ppEQda5.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfohccfjfplbfejbninimjngmhilgmai\2.0\manifest.json	DNZ3nmK2ppEQda5.exe

Drops file in System32 directory 4 IoCs

Processes:

DNZ3nmK2ppEQda5.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	DNZ3nmK2ppEQda5.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	DNZ3nmK2ppEQda5.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	DNZ3nmK2ppEQda5.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	DNZ3nmK2ppEQda5.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

DNZ3nmK2ppEQda5.exe

pid	process
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe
1716	DNZ3nmK2ppEQda5.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

DNZ3nmK2ppEQda5.exe

description	pid	process
Token: SeDebugPrivilege	1716	DNZ3nmK2ppEQda5.exe
Token: SeDebugPrivilege	1716	DNZ3nmK2ppEQda5.exe
Token: SeDebugPrivilege	1716	DNZ3nmK2ppEQda5.exe
Token: SeDebugPrivilege	1716	DNZ3nmK2ppEQda5.exe
Token: SeDebugPrivilege	1716	DNZ3nmK2ppEQda5.exe
Token: SeDebugPrivilege	1716	DNZ3nmK2ppEQda5.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c.exe

description	pid	process	target process
PID 4904 wrote to memory of 1716	4904	faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c.exe	DNZ3nmK2ppEQda5.exe
PID 4904 wrote to memory of 1716	4904	faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c.exe	DNZ3nmK2ppEQda5.exe
PID 4904 wrote to memory of 1716	4904	faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c.exe	DNZ3nmK2ppEQda5.exe

C:\Users\Admin\AppData\Local\Temp\faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c.exe
"C:\Users\Admin\AppData\Local\Temp\faf7ef734b813c294a5cbce415267998839cbec875316afea3f00b587cf2b21c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\DNZ3nmK2ppEQda5.exe
.\DNZ3nmK2ppEQda5.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
b03ca453463ad458abf8f98f0211bbe8

SHA1
bcd829ff3e3f9d7cb46c40975c43ca7e79f2adc8

SHA256
a0ef5ec6840d41d736998e50cc2fa5845375bbd3f99867d5cd4b6a776aeb1898

SHA512
e9354627b1d2655398230f7dbd50d5c815fdc439cf000c609cfafec9a593e7318538834c28bd17e7ee1049eae6430d2f4574168c8c2ed6ed72d6051927621fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
d21d6f2761cbdd521cf9463eefa7f6f4

SHA1
3ff1080fafe9aab3aefe2afb7d7e0762ad354c7a

SHA256
9ccfcf4f452ee0ddee67f5830b8b5d06122974e790a8bed6aef1910ede510cf2

SHA512
bf673c2d83c548b950f63261a6f1649de6752e38cee9e19a1ded4fc8b0c443a2959f913b31057d93dd56f8eb4cb6181548115242d6b9492bd195640f40860bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\[email protected]\install.rdf

Filesize
597B

MD5
8b2d8637270a80cfb61be76b3d655364

SHA1
24792c23f1c4a07ee71d09bbbd4abd753150c374

SHA256
c1918ac0157abedf0f60dc19b76aaa6503f6de323ca12c217ba9175f53c9ba85

SHA512
e70412974d99b39d98daff262bbf1476940a76a51b9793979f23197dc039a48a59bc0203987ea834a38d16f03ee791e79f7599326fb7f6fb71576bafa83dcb11

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\DNZ3nmK2ppEQda5.dat

Filesize
1KB

MD5
b503381575b3e6fb90daf21b30780229

SHA1
b01df55a732f34ca2d50108e124b34ea2fcce4e4

SHA256
45524b94849645f41b140a0485814ab2b90ac175edfb7815e7dda82278a5196c

SHA512
ceab6121dd7d851be5a7129c31bd228d83c8328eef81a6e8f4213c128023094ce26a5b13e1092987c4fa406a7afd2409dadeef7723d96d9d228f0c34db8f842a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\DNZ3nmK2ppEQda5.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\DNZ3nmK2ppEQda5.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\jfohccfjfplbfejbninimjngmhilgmai\DtXkjL.js

Filesize
6KB

MD5
6339bc6ce798bc1d96027c315fb609ab

SHA1
81d9656c62e426b9b9ac909f816bcdb49c7f9c82

SHA256
2c0bfde370ecddedf018185e639d5ce1476e4864beb5e15e3e0dcdf84bb20714

SHA512
0bd25a4bea8a986451bf93ceb723b0e6441d577f045c3b8cb5429e84be77531fd9aa65a41c74ebcde631c4e4c78b973a58541f6d653d3379b7ddb3bfa74bcdf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\jfohccfjfplbfejbninimjngmhilgmai\background.html

Filesize
143B

MD5
ffe32cd118d8cba750223cb5135c753e

SHA1
9512a61d67adedca4a4662dd15afed77fc06fbc0

SHA256
c1ca816b19998964326f1b7b5dfc693aae98f83110c3530d84c20edf57b2237b

SHA512
5c83ed7c851cbee7421b0069384fce1f842f0db870be38baca9922fa525db3e8de5ad907514c4231cc1cd2b36b7ccba7070e340189768ac22e540a1a87dc440a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\jfohccfjfplbfejbninimjngmhilgmai\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\jfohccfjfplbfejbninimjngmhilgmai\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS767D.tmp\jfohccfjfplbfejbninimjngmhilgmai\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1716-132-0x0000000000000000-mapping.dmp

Download