fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c

Analysis

max time kernel
175s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c.exe
Size

931KB
MD5

6a5842767b5b29fbc3cd477c93323e7f
SHA1

9f862ff3f4df91569e4891ba6254c95a13a8b4f8
SHA256

fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c
SHA512

9284cdb1abb1db9ae35cd1c846662125b7d092fc98d689025e0cc350ad3f2dcd52e94e06b2a361391415551720e6fdc16a289ba6112e05056e92ca58e9f45a33
SSDEEP

24576:h1OYdaO8CZ/iWCvu/2sWsJA/jlt+DHhsk:h1OsyCpYO/dJJDHhsk

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

0WQDzKjPJ718RBR.exe

pid process

2792 0WQDzKjPJ718RBR.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

0WQDzKjPJ718RBR.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhgnfhoankbffcbnoeknmdmikcoohgpj\2.0\manifest.json	0WQDzKjPJ718RBR.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhgnfhoankbffcbnoeknmdmikcoohgpj\2.0\manifest.json	0WQDzKjPJ718RBR.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhgnfhoankbffcbnoeknmdmikcoohgpj\2.0\manifest.json	0WQDzKjPJ718RBR.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhgnfhoankbffcbnoeknmdmikcoohgpj\2.0\manifest.json	0WQDzKjPJ718RBR.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhgnfhoankbffcbnoeknmdmikcoohgpj\2.0\manifest.json	0WQDzKjPJ718RBR.exe

Drops file in System32 directory 4 IoCs

Processes:

0WQDzKjPJ718RBR.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	0WQDzKjPJ718RBR.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	0WQDzKjPJ718RBR.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	0WQDzKjPJ718RBR.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	0WQDzKjPJ718RBR.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

0WQDzKjPJ718RBR.exe

pid	process
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe
2792	0WQDzKjPJ718RBR.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

0WQDzKjPJ718RBR.exe

description	pid	process
Token: SeDebugPrivilege	2792	0WQDzKjPJ718RBR.exe
Token: SeDebugPrivilege	2792	0WQDzKjPJ718RBR.exe
Token: SeDebugPrivilege	2792	0WQDzKjPJ718RBR.exe
Token: SeDebugPrivilege	2792	0WQDzKjPJ718RBR.exe
Token: SeDebugPrivilege	2792	0WQDzKjPJ718RBR.exe
Token: SeDebugPrivilege	2792	0WQDzKjPJ718RBR.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c.exe

description	pid	process	target process
PID 516 wrote to memory of 2792	516	fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c.exe	0WQDzKjPJ718RBR.exe
PID 516 wrote to memory of 2792	516	fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c.exe	0WQDzKjPJ718RBR.exe
PID 516 wrote to memory of 2792	516	fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c.exe	0WQDzKjPJ718RBR.exe

C:\Users\Admin\AppData\Local\Temp\fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c.exe
"C:\Users\Admin\AppData\Local\Temp\fa2486847c559de3300e87020814e1c98ffd4323b3f810f4af26fe4258c3426c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:516

C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\0WQDzKjPJ718RBR.exe
.\0WQDzKjPJ718RBR.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\0WQDzKjPJ718RBR.dat

Filesize
1KB

MD5
cae58de161a93e80d80e138213791e2c

SHA1
69d63b4af3b8e8ef5d37b32beff5d18655983ebe

SHA256
3d3338cff6ee663f7a5e4dc5f7028c8347948721c3f18d449b74a1aa2df354dc

SHA512
799111b40765d583089d2427e468112828da222c801d6f88abcf52e09101498fdb3e9c1a17459aee3047ea3978e2d5a2919335410d8e111b69e6445f1e093c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\0WQDzKjPJ718RBR.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\0WQDzKjPJ718RBR.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
46c73570d4277073eb8d7371bbee1381

SHA1
10b5da0e3d2104682d61cc07008f91f11de9f057

SHA256
d37b504e60001189fa57e6eddaf73489ecf83cdf0b606688d44ac95b5ab62056

SHA512
d2643722ca837a480b2019380fe9446729e72cef60c2778ef60815345fbd0c08ce91deadadc0997b55c154db4a010f7e177b30c4601d43dae4c3102af53fc303

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
d4fb0e02e59acebaad2eb87ae0300d85

SHA1
0aa3b2e694f3fca79fa1c4aad1a05e08198c5a1f

SHA256
42681b8a0230f9a96e26d08c85a01ae77669fc819a3769cf22d30d9e6566599a

SHA512
eacce0df830cb5a2753afbb8e5173e239b3eee98d5063e4958c450d3f958c6e854f569e2fdc707099052321044af04ba2bf0612fce37197a1e6a6d1db20e5fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\[email protected]\install.rdf

Filesize
595B

MD5
53b44ff4d03534a60d6236a442424419

SHA1
43650937b66eccea75ae5b4af4f09ca5ce82c69b

SHA256
4850d6f786af015a4dd79bf45cc2e0a61ea288c3c389dd34891f38bdda1c7f02

SHA512
60c26af0b409172310f88ce4636c6f290bb54ab08f0e7aaa7e8fc6de66508086954780c9b6e2b1f8c52842b8f3315dbecbf2ac599d065a0638509ab9678131ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\jhgnfhoankbffcbnoeknmdmikcoohgpj\background.html

Filesize
141B

MD5
87cdda321fafe9a076cf3fea94ca7d28

SHA1
924aa8bfbc7c026e8694a4e547b98fa9fcc4954d

SHA256
5862c28b0ef4c2604fa02dd67e2c8dca27ba6dd7bd0e4cd587a9d6f43aa2cfdf

SHA512
15e149fec149494e4f77eabba864e28242331ed18cbd4f2a411a8d27f8768e77c1ea5d8901a71bd455b2b16f5187c3ce692573e9cf29eef45fdb4eca997b0af9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\jhgnfhoankbffcbnoeknmdmikcoohgpj\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\jhgnfhoankbffcbnoeknmdmikcoohgpj\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\jhgnfhoankbffcbnoeknmdmikcoohgpj\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41AC.tmp\jhgnfhoankbffcbnoeknmdmikcoohgpj\x5TX.js

Filesize
6KB

MD5
96bc742779a1758c5ce09a42ffa5086e

SHA1
645b3c1ab248a3d781fde33f061f195f661f96e8

SHA256
ec00d72fce2b4ddefe11dbd15713af4d6c21a2784d3d8f6153c3af601769fe4b

SHA512
67dc5b47e929167da482155ec87ba09f5994a9afad0a375d50b9d9d1de27263b3b20594723ca94f5fd0b4624d33acadeacfe16b237ddeda723a3ea5c2feec75f

Download Submit
memory/2792-132-0x0000000000000000-mapping.dmp

Download