f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879

Analysis

max time kernel
164s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879.exe
Size

2.5MB
MD5

d6b826bf9c31ce5f72cc231761fcd315
SHA1

846b3fd6bf67763d9c4605e3cc847312fe7cfcca
SHA256

f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879
SHA512

325f4b8cc12117a5d8a3c9e85fa6dc00d602de5caf9a18fd27cdb608d3ec9a803010017707c31d8b6dd85399aee2e10b873b2021b932e423e961ecf60eafec90
SSDEEP

49152:h1OsQ+QK3xQpjajXKioFMpYphqd3ArqvFUmEaDxEAxh4UR9TEd:h1OWQCjbKioVg3ArKh40U

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

WhwKbBbqiv2wFti.exe

pid process

3096 WhwKbBbqiv2wFti.exe
Loads dropped DLL 3 IoCs

Processes:

WhwKbBbqiv2wFti.exeregsvr32.exeregsvr32.exe

pid process

3096 WhwKbBbqiv2wFti.exe
3728 regsvr32.exe
3112 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3096	WhwKbBbqiv2wFti.exe

pid	process
3096	WhwKbBbqiv2wFti.exe
3728	regsvr32.exe
3112	regsvr32.exe

Drops Chrome extension 5 IoCs

Processes:

WhwKbBbqiv2wFti.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\abajpomkliiekaiimhchipeanjocjfok\2.0\manifest.json	WhwKbBbqiv2wFti.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\abajpomkliiekaiimhchipeanjocjfok\2.0\manifest.json	WhwKbBbqiv2wFti.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\abajpomkliiekaiimhchipeanjocjfok\2.0\manifest.json	WhwKbBbqiv2wFti.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\abajpomkliiekaiimhchipeanjocjfok\2.0\manifest.json	WhwKbBbqiv2wFti.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\abajpomkliiekaiimhchipeanjocjfok\2.0\manifest.json	WhwKbBbqiv2wFti.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exeWhwKbBbqiv2wFti.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	WhwKbBbqiv2wFti.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	WhwKbBbqiv2wFti.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	WhwKbBbqiv2wFti.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	WhwKbBbqiv2wFti.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe

Drops file in Program Files directory 8 IoCs

Processes:

WhwKbBbqiv2wFti.exe

description	ioc	process
File created	C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.x64.dll	WhwKbBbqiv2wFti.exe
File opened for modification	C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.x64.dll	WhwKbBbqiv2wFti.exe
File created	C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.dll	WhwKbBbqiv2wFti.exe
File opened for modification	C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.dll	WhwKbBbqiv2wFti.exe
File created	C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.tlb	WhwKbBbqiv2wFti.exe
File opened for modification	C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.tlb	WhwKbBbqiv2wFti.exe
File created	C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.dat	WhwKbBbqiv2wFti.exe
File opened for modification	C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.dat	WhwKbBbqiv2wFti.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WhwKbBbqiv2wFti.exe

pid process

3096 WhwKbBbqiv2wFti.exe
3096 WhwKbBbqiv2wFti.exe

pid	process
3096	WhwKbBbqiv2wFti.exe
3096	WhwKbBbqiv2wFti.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879.exeWhwKbBbqiv2wFti.exeregsvr32.exe

description	pid	process	target process
PID 5116 wrote to memory of 3096	5116	f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879.exe	WhwKbBbqiv2wFti.exe
PID 5116 wrote to memory of 3096	5116	f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879.exe	WhwKbBbqiv2wFti.exe
PID 5116 wrote to memory of 3096	5116	f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879.exe	WhwKbBbqiv2wFti.exe
PID 3096 wrote to memory of 3728	3096	WhwKbBbqiv2wFti.exe	regsvr32.exe
PID 3096 wrote to memory of 3728	3096	WhwKbBbqiv2wFti.exe	regsvr32.exe
PID 3096 wrote to memory of 3728	3096	WhwKbBbqiv2wFti.exe	regsvr32.exe
PID 3728 wrote to memory of 3112	3728	regsvr32.exe	regsvr32.exe
PID 3728 wrote to memory of 3112	3728	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879.exe
"C:\Users\Admin\AppData\Local\Temp\f9f2bd2251695de76cf3b4eae7b4489d7fe2f3f2bc9199a89cab2b0a05bdb879.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\WhwKbBbqiv2wFti.exe
.\WhwKbBbqiv2wFti.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.x64.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.x64.dll"
4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:3112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.dat

Filesize
6KB

MD5
6fb56e9c31d78c1a22d95188a0a6060d

SHA1
e80b4354f8cb4c5537fb2f68068b7bc4fa88f5c8

SHA256
c51f6d749ac83d021b1c55fecc4bf24aae0538dadb8549e1b47c7b1e27188058

SHA512
3a7ef12a5bc053a077aa929e9f67b17ce43ceb8915e15d8535018eff99de801b0c3054eac990143319bb23e757a03b63f720c8059cc322d5976827dadedd8b84

Download Submit
C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.dll

Filesize
748KB

MD5
c4836ef373cdfa7eac3738c59ae9fb83

SHA1
2f019c1b3357e3be378ac804acfc98ec4f80b576

SHA256
5c7ba1a9e0bf346f3b4baa8e6965981b0ff412eabc879ecc531e98f268c34e3e

SHA512
e459aeba63802639c8e7245afc139d86e75a805e14b90318b926ff00fe384d14ac209dc76fb88319218c89fe1562c737ed4c5847cd92e698d529ba6737c2fb4d

Download Submit
C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.x64.dll

Filesize
887KB

MD5
fe714aa952e86e33b2cc1652e0f7f6cb

SHA1
25927512b7bef5f0586f7edab4d4804ec43409aa

SHA256
c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579

SHA512
fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7

Download Submit
C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.x64.dll

Filesize
887KB

MD5
fe714aa952e86e33b2cc1652e0f7f6cb

SHA1
25927512b7bef5f0586f7edab4d4804ec43409aa

SHA256
c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579

SHA512
fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7

Download Submit
C:\Program Files (x86)\GoSave\zjZS65MrLKnm80.x64.dll

Filesize
887KB

MD5
fe714aa952e86e33b2cc1652e0f7f6cb

SHA1
25927512b7bef5f0586f7edab4d4804ec43409aa

SHA256
c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579

SHA512
fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\WhwKbBbqiv2wFti.dat

Filesize
6KB

MD5
6fb56e9c31d78c1a22d95188a0a6060d

SHA1
e80b4354f8cb4c5537fb2f68068b7bc4fa88f5c8

SHA256
c51f6d749ac83d021b1c55fecc4bf24aae0538dadb8549e1b47c7b1e27188058

SHA512
3a7ef12a5bc053a077aa929e9f67b17ce43ceb8915e15d8535018eff99de801b0c3054eac990143319bb23e757a03b63f720c8059cc322d5976827dadedd8b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\WhwKbBbqiv2wFti.exe

Filesize
765KB

MD5
102dfa10cc29d7f1ded876dfd7274280

SHA1
f26e57d916bf7c5c3a4b49a2edaf30e945b0b44e

SHA256
67d9ee9e36b29e081ff2084dc488b0b6c4120e791a5c33ce6027cf89718e4bb3

SHA512
c3b7bb463873420f1582880308acca440c24fefaf45c9ad75319665e07c0f4548bd6fe07fabec48edd138a495a2607297773b16400e351e68a7462b45fb2c0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\WhwKbBbqiv2wFti.exe

Filesize
765KB

MD5
102dfa10cc29d7f1ded876dfd7274280

SHA1
f26e57d916bf7c5c3a4b49a2edaf30e945b0b44e

SHA256
67d9ee9e36b29e081ff2084dc488b0b6c4120e791a5c33ce6027cf89718e4bb3

SHA512
c3b7bb463873420f1582880308acca440c24fefaf45c9ad75319665e07c0f4548bd6fe07fabec48edd138a495a2607297773b16400e351e68a7462b45fb2c0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\abajpomkliiekaiimhchipeanjocjfok\Iq9lBgwh.js

Filesize
5KB

MD5
f100f77e7f593239da554549db7d34c0

SHA1
9b7e0a9ab00fbbc1b45c584f60274fb07c9f3cb6

SHA256
0524d717e765e867be5d581c566aeb43d19abcc69c796cb09b0ab3c354c0ac55

SHA512
c6e6d36f112a1bada06592749690490615d232e84e1bcb84371b25e87e004baa8416b2d63ce46c3d37b793f90ea01b92b438a509282c82436ac243b347b6e9c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\abajpomkliiekaiimhchipeanjocjfok\background.html

Filesize
145B

MD5
f9606b930727ca06575fc7bcefe6a537

SHA1
bb352575ab64e126ed14928a1bc85dd0e28bce3e

SHA256
ac1b4b6d5fb7f18a816c8c0329be7c37512e1f932dc0b6ea9fa8f0a8bdd398d9

SHA512
529eb85c653ce0b34b251ad52b608af6923a9fe36d33e8028ec0cd292d1446806f958b17cddc07f01c613f5b58ede5bcf97db79c160af2205a0af3480717d7a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\abajpomkliiekaiimhchipeanjocjfok\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\abajpomkliiekaiimhchipeanjocjfok\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\abajpomkliiekaiimhchipeanjocjfok\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\zjZS65MrLKnm80.dll

Filesize
748KB

MD5
c4836ef373cdfa7eac3738c59ae9fb83

SHA1
2f019c1b3357e3be378ac804acfc98ec4f80b576

SHA256
5c7ba1a9e0bf346f3b4baa8e6965981b0ff412eabc879ecc531e98f268c34e3e

SHA512
e459aeba63802639c8e7245afc139d86e75a805e14b90318b926ff00fe384d14ac209dc76fb88319218c89fe1562c737ed4c5847cd92e698d529ba6737c2fb4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\zjZS65MrLKnm80.tlb

Filesize
3KB

MD5
f461159d95e1a49a534ad0320ff3984b

SHA1
e3363285437846f046b126adbcd8e4789aa1f486

SHA256
d6967480d6f6fd4b9d31fb7e38ee6f04c76c36edd2795f852ec3938d984993d6

SHA512
2a12587d4a69c967771d8b4ed43e857a81899e177d5ec8ddf8365eaa4e8752032fac8d25b5c3a89ae5efc82b4c6dfd4ba2d26e998b3ad95cc8fdc6ef0c7416ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\zjZS65MrLKnm80.x64.dll

Filesize
887KB

MD5
fe714aa952e86e33b2cc1652e0f7f6cb

SHA1
25927512b7bef5f0586f7edab4d4804ec43409aa

SHA256
c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579

SHA512
fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
a1a58527c056659456beb32661e6ebe1

SHA1
ed0104053103eb1df6f885ed15bf12d4393e9a41

SHA256
619b4f6c80c54fd2a582ef33f74c28b835a3c16d6bff7dcb1c94b6f1a82e7672

SHA512
05ce2c88e41b5ba91967820379f4e581a05472f80ff2fc2a4836a033fd0a06236fdd3cfb97bfe75a83391939b16baa9f9298ebfaec41a02040c7d447f2937af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
05c8237200bd4c57a773846f9acc4d70

SHA1
8a4b42a51f2eca504ff2e81d806bddab70fa5fcf

SHA256
96ed67a5ca69056e357ef342d8ac5108b6821ad4125179ba9747b5fd6d499c05

SHA512
cd44cf0536a0771a4cafcaf613ff866716659f88576c0e25ba6b3b9022de188265ea54c76b5a6fe7dc824f347e2d42d736138454dcdf7f553e49997f79355901

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29DF.tmp\[email protected]\install.rdf

Filesize
597B

MD5
da3fc4a85addc820bdda7c2f7d9f2002

SHA1
327b116219bb88348aaba6f0c48b1468f80e46c2

SHA256
7e3b807250e3fda39f4f4a9b6dfce61676826103cd6aae76f74117fd3e9d090f

SHA512
05afd75b0974e38573630b31840ea75e6de5f6fba094efec350fb91ab4f71b3c690c80b2c4ebd9572deccb4b221df76de4dd17b56827234ef306743723d5fde5

Download Submit
memory/3096-132-0x0000000000000000-mapping.dmp

Download
memory/3112-152-0x0000000000000000-mapping.dmp

Download
memory/3728-149-0x0000000000000000-mapping.dmp

Download