faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66

Analysis

max time kernel
4s
max time network
56s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe
Size

931KB
MD5

1b3ee254ecacf5e07a80bf5697130695
SHA1

d831485afc892e570ad1f8c7dbdec273c49e6596
SHA256

faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66
SHA512

7fe4512c977f5a0804547ded638b85b36d06cdba726229210a2428c5a6af0ff316afbf433e3843eb35f53efcb756a2d02b4c0571a10fb3cb02e1b288dd30bfb6
SSDEEP

24576:h1OYdaOvCZ/iWCvu/2sWsJA/jlt+DHhsq:h1OslCpYO/dJJDHhsq

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Lxf3GcHcNE7l6Ff.exe

pid process

2044 Lxf3GcHcNE7l6Ff.exe
Loads dropped DLL 1 IoCs

Processes:

faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe

pid process

2040 faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2040	faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe

Drops Chrome extension 3 IoCs

Processes:

Lxf3GcHcNE7l6Ff.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiadoalnkhgidfmfillkhehlopgabodm\2.0\manifest.json	Lxf3GcHcNE7l6Ff.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiadoalnkhgidfmfillkhehlopgabodm\2.0\manifest.json	Lxf3GcHcNE7l6Ff.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiadoalnkhgidfmfillkhehlopgabodm\2.0\manifest.json	Lxf3GcHcNE7l6Ff.exe

Drops file in System32 directory 4 IoCs

Processes:

Lxf3GcHcNE7l6Ff.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	Lxf3GcHcNE7l6Ff.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Lxf3GcHcNE7l6Ff.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Lxf3GcHcNE7l6Ff.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Lxf3GcHcNE7l6Ff.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Lxf3GcHcNE7l6Ff.exe

pid	process
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe
2044	Lxf3GcHcNE7l6Ff.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Lxf3GcHcNE7l6Ff.exe

description	pid	process
Token: SeDebugPrivilege	2044	Lxf3GcHcNE7l6Ff.exe
Token: SeDebugPrivilege	2044	Lxf3GcHcNE7l6Ff.exe
Token: SeDebugPrivilege	2044	Lxf3GcHcNE7l6Ff.exe
Token: SeDebugPrivilege	2044	Lxf3GcHcNE7l6Ff.exe
Token: SeDebugPrivilege	2044	Lxf3GcHcNE7l6Ff.exe
Token: SeDebugPrivilege	2044	Lxf3GcHcNE7l6Ff.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe

description	pid	process	target process
PID 2040 wrote to memory of 2044	2040	faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe	Lxf3GcHcNE7l6Ff.exe
PID 2040 wrote to memory of 2044	2040	faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe	Lxf3GcHcNE7l6Ff.exe
PID 2040 wrote to memory of 2044	2040	faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe	Lxf3GcHcNE7l6Ff.exe
PID 2040 wrote to memory of 2044	2040	faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe	Lxf3GcHcNE7l6Ff.exe

C:\Users\Admin\AppData\Local\Temp\faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe
"C:\Users\Admin\AppData\Local\Temp\faf5894bb0293687f8a2aa51c54407ae213d6d23c5405da7d77da61075916b66.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\Lxf3GcHcNE7l6Ff.exe
.\Lxf3GcHcNE7l6Ff.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
8ddb58f0b434ca2657f219745e000692

SHA1
d1d9941f3b3822475458975e2e0986349f783372

SHA256
7691d99468596d5aa7dbe238061ab1e77d254519579ba6419bbb69980849144a

SHA512
9eff6241bf61a7496a51891a06855d0b6c9845ee914f871a763b193c559b688faffa260a4c219053d917dbb5707a9548cbf35c7654fd1dc550751fdb1b3aa9b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
a837ae4b14d4d414021bc97349d8f492

SHA1
ee64504ec714c884899b3dbe82be4a2ab049f548

SHA256
bc81a6317b20adb61f163b7c773dd0f4f619e7c9474789f7fce872c97f019183

SHA512
4625034fef6106b60f9cc5ebbaaeb2171f5daa6045c6ab5003f1fcd3fa336b2fb1a02c2b74593249b75862c2e0219c8bd2430128897e89dba7126a76182d6ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\[email protected]\install.rdf
Filesize
598B

MD5
3d36d1b76e258fedf19727f0ad95c20b

SHA1
b676aecc4881e95c81401d492552e96b07f097f5

SHA256
23f1bb2d544e6fda6817bed163f743a76461684e5afe3ff0b4f0f392e04a35ca

SHA512
20f71b17dcfbf6384cc218055b4011fcb9e2c44b3af1cf6f86583155893fd7c889a85d38fcae96844420e198edd1c29e3633766627981c7ee18a2f44530921c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\Lxf3GcHcNE7l6Ff.dat
Filesize
1KB

MD5
7b41e8d6de6dcabcc2ee5711a755e425

SHA1
f71f2759f7ae0f105e7137002d9dc120e2ad1e12

SHA256
747ddb9eab2bf36a8cf324d2e121be9b279ce6e012c7bf94f547398aa5cf97a4

SHA512
9812856e3c4f80cf3e86d30e57219d33e1e2e8c4c13edcd9d26d8bbb06b0cb0f48704efb2c56deea903d888d0c9c7a2136b67a438879caf6939969c880c0ea70

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\Lxf3GcHcNE7l6Ff.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\eiadoalnkhgidfmfillkhehlopgabodm\background.html
Filesize
141B

MD5
3d920bb025948fbcd08d85f563a6f2d8

SHA1
c2b1215e96d7f6d03ee82b44844af7318ffc0fd3

SHA256
7d7fa6245bd4c1dbc2bb1975b9cb4fea9bd217a3156ce7bdbf6f7ce18df15f52

SHA512
7ec932aaf0d62b4c448672f9919e7fadcdc2adc52c58f58a249625e630d1e7ce38fd1d94fb0dbaa5fa1c0f7e06b75449310e728abcedb1b96a439ab32dcec0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\eiadoalnkhgidfmfillkhehlopgabodm\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\eiadoalnkhgidfmfillkhehlopgabodm\cvPW.js
Filesize
6KB

MD5
e6715568bd15f8cda58e281eed05431b

SHA1
65da5cbf3c15417085d6e77db861858a39e8418c

SHA256
922cc278ed317f4c0195dcccb0e814c0c0419497abbe506f38ccd295cdff76f2

SHA512
06a03f1ab0aa2678d28be1d7b2e26dff76ea78cc8af0ab2c7e4babe121ea646188b46799533f78fe7d5e8baea8082a608dfeda9ce18f1521e454a62524e29313

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\eiadoalnkhgidfmfillkhehlopgabodm\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\eiadoalnkhgidfmfillkhehlopgabodm\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zSCE58.tmp\Lxf3GcHcNE7l6Ff.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/2040-54-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads