faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc

Analysis

max time kernel
66s
max time network
76s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe
Size

920KB
MD5

1f3d509c0655ad7c14e3ceb9cad180c9
SHA1

19a73d5665e74a169eac8372057a7a6747a2ff30
SHA256

faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc
SHA512

f7b63bdd80d38c96b6abcf497663d0c626110fec6a0c95faf5a499f5108c6dbe9a57bba1b084c862639307e32c2e2d3c54c1e83d4b9603a652618d15e8e0ee4f
SSDEEP

24576:h1OYdaO+SoMtdHAqcdDVhYwiei7+EpFAh/kKA:h1OspPHVmVhYwiLtKkKA

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

nCvjLEZu7X7O1sI.exe

pid process

316 nCvjLEZu7X7O1sI.exe
Loads dropped DLL 1 IoCs

Processes:

faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe

pid process

2044 faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2044	faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe

Drops Chrome extension 3 IoCs

Processes:

nCvjLEZu7X7O1sI.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofboanbmbeggngdhihbpcijplidajgih\2.0\manifest.json	nCvjLEZu7X7O1sI.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofboanbmbeggngdhihbpcijplidajgih\2.0\manifest.json	nCvjLEZu7X7O1sI.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofboanbmbeggngdhihbpcijplidajgih\2.0\manifest.json	nCvjLEZu7X7O1sI.exe

Drops file in System32 directory 4 IoCs

Processes:

nCvjLEZu7X7O1sI.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	nCvjLEZu7X7O1sI.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	nCvjLEZu7X7O1sI.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	nCvjLEZu7X7O1sI.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	nCvjLEZu7X7O1sI.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

nCvjLEZu7X7O1sI.exe

pid	process
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe
316	nCvjLEZu7X7O1sI.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

nCvjLEZu7X7O1sI.exe

description	pid	process
Token: SeDebugPrivilege	316	nCvjLEZu7X7O1sI.exe
Token: SeDebugPrivilege	316	nCvjLEZu7X7O1sI.exe
Token: SeDebugPrivilege	316	nCvjLEZu7X7O1sI.exe
Token: SeDebugPrivilege	316	nCvjLEZu7X7O1sI.exe
Token: SeDebugPrivilege	316	nCvjLEZu7X7O1sI.exe
Token: SeDebugPrivilege	316	nCvjLEZu7X7O1sI.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe

description	pid	process	target process
PID 2044 wrote to memory of 316	2044	faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe	nCvjLEZu7X7O1sI.exe
PID 2044 wrote to memory of 316	2044	faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe	nCvjLEZu7X7O1sI.exe
PID 2044 wrote to memory of 316	2044	faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe	nCvjLEZu7X7O1sI.exe
PID 2044 wrote to memory of 316	2044	faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe	nCvjLEZu7X7O1sI.exe

C:\Users\Admin\AppData\Local\Temp\faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe
"C:\Users\Admin\AppData\Local\Temp\faee264d42d2eb3b2f6b8d45b5d5aa7d7b5d713bf71154d522caf2bcd99718fc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\nCvjLEZu7X7O1sI.exe
.\nCvjLEZu7X7O1sI.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\nCvjLEZu7X7O1sI.dat

Filesize
1KB

MD5
40e917ea2d8cf7851ce630e61c1baa41

SHA1
d20bc61d5130dc727030f869b4d6624f5167913f

SHA256
6856317b13e7d52143be6a7ab4cbf10a625964e53959dffbadfa6da40786ecd1

SHA512
af757583ec4cf9d760a503c723640a80b73016c57ebd1945c9bcbf6d697a6e30a97850f8b0a4e59d8d08263d487f67485a1f8e3287150b62324afcb3d3d65fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\nCvjLEZu7X7O1sI.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
a149dc9530f4f49fc5885e3ba4945d3f

SHA1
8c3fbe68af7fd54939712b658fe10a0439abc117

SHA256
068b7bd0f751e27336a30b61d186622588b8d7e1ca4ce0ff9b112633f1bbdb1d

SHA512
84a14d07fb97ed49a2363a8d77872dd3de6b3bdcf9b09c110248ec5dd8e53aac3f06e146c0e54163f14a2de6e6a4e50eb9274bacbdea1643dd19dd7a9517e5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
dba3d9e5088cb7786ed60facdfe26240

SHA1
adcb7bf37e759c6b0ada780950d604beccdac9ec

SHA256
f23064158056ea95a78a1053684e057d84178395d86ce697bf3d0417c42a2f59

SHA512
846a6b8966af961b486c4b2f58494c69a81d00bc38f067f843a9e463894be46448c2e60a6ea9684ec65dc52e264b3c11f51cebe7f7b3a440f56d0a3a75777815

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\[email protected]\install.rdf

Filesize
591B

MD5
d727f7dbc179b81cec4d2a95de4d12f2

SHA1
43e2d1752881d0042122996e318643ee871a697f

SHA256
cb60353114cad5e51ebbb8a49589f183d9fc6e92b07afdb80cdb7c1dbe350650

SHA512
84689da3c4d20ff72699393f50f667ff6f19236f4a4834caaf787988f7511143517ba684c00686da35aa1a4b1b2748a7209d44da2f38ec8223de25eadf98bf25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\ofboanbmbeggngdhihbpcijplidajgih\PYoyR1L.js

Filesize
6KB

MD5
4079e0307b4c01ab4badc1d76d591b7c

SHA1
4b32514aa651c1d41153f4129677bccb49d00458

SHA256
85d2c0c66d708f95a08b2db5b0b1367ded93474c53db0a7fe8c78160f8892ce2

SHA512
cf4e40b38c94bbd5e94838acdba963cb9d57ba6abe1333d49fbf1b24ba61b1dabb9578dd8d21fb2a5d2dc2d18e66c9b6c38ac8c365037f5c79dc221d93e4c2f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\ofboanbmbeggngdhihbpcijplidajgih\background.html

Filesize
144B

MD5
c344df3a4a3fdd2235682183222e2b3c

SHA1
effb196fe9df72f7b9d1eb0faecd928a770cd1ee

SHA256
0c02d690e6d05c785b5f1b39cef3946ddf76078c5773c5425ab0a2519fa9e5a4

SHA512
6e03ea477cb288a04f66ca24f02b5fafb50d08224a379aa084ad79f2184fcd307d77ac8675ce02013a531b5a0ac7da5a4dbeb6cb66112bc3dd9bd5b8b4f5c8d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\ofboanbmbeggngdhihbpcijplidajgih\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\ofboanbmbeggngdhihbpcijplidajgih\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\ofboanbmbeggngdhihbpcijplidajgih\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zS97ED.tmp\nCvjLEZu7X7O1sI.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/316-56-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x0000000076221000-0x0000000076223000-memory.dmp

Filesize
8KB

Download