Analysis
-
max time kernel
177s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 16:22
Static task
static1
Behavioral task
behavioral1
Sample
ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa.exe
Resource
win7-20220901-en
General
-
Target
ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa.exe
-
Size
932KB
-
MD5
d27a1b4f0e8fa9059bb3e13728556639
-
SHA1
4d025dceca921b599543dcc7bf84d84ae921e102
-
SHA256
ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa
-
SHA512
0713ae2fdf745a808c12ff80897165c3650623c7d8967e6cb48f7f23ce8880bafe0b2ae1888bf8861bfb511ad7c17cd3483958e475c59ba6fad8804e32fb5ea9
-
SSDEEP
24576:h1OYdaOpCZ/iWCvu/2sWsJA/jlt+DHhsP:h1OsvCpYO/dJJDHhsP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sHe2ajfKQecmWtm.exepid process 5096 sHe2ajfKQecmWtm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
sHe2ajfKQecmWtm.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcldakpaenejgmdegelfcflcegkmihfe\2.0\manifest.json sHe2ajfKQecmWtm.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcldakpaenejgmdegelfcflcegkmihfe\2.0\manifest.json sHe2ajfKQecmWtm.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcldakpaenejgmdegelfcflcegkmihfe\2.0\manifest.json sHe2ajfKQecmWtm.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcldakpaenejgmdegelfcflcegkmihfe\2.0\manifest.json sHe2ajfKQecmWtm.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcldakpaenejgmdegelfcflcegkmihfe\2.0\manifest.json sHe2ajfKQecmWtm.exe -
Drops file in System32 directory 4 IoCs
Processes:
sHe2ajfKQecmWtm.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI sHe2ajfKQecmWtm.exe File opened for modification C:\Windows\System32\GroupPolicy sHe2ajfKQecmWtm.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini sHe2ajfKQecmWtm.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol sHe2ajfKQecmWtm.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
sHe2ajfKQecmWtm.exepid process 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe 5096 sHe2ajfKQecmWtm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
sHe2ajfKQecmWtm.exedescription pid process Token: SeDebugPrivilege 5096 sHe2ajfKQecmWtm.exe Token: SeDebugPrivilege 5096 sHe2ajfKQecmWtm.exe Token: SeDebugPrivilege 5096 sHe2ajfKQecmWtm.exe Token: SeDebugPrivilege 5096 sHe2ajfKQecmWtm.exe Token: SeDebugPrivilege 5096 sHe2ajfKQecmWtm.exe Token: SeDebugPrivilege 5096 sHe2ajfKQecmWtm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa.exedescription pid process target process PID 1060 wrote to memory of 5096 1060 ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa.exe sHe2ajfKQecmWtm.exe PID 1060 wrote to memory of 5096 1060 ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa.exe sHe2ajfKQecmWtm.exe PID 1060 wrote to memory of 5096 1060 ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa.exe sHe2ajfKQecmWtm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa.exe"C:\Users\Admin\AppData\Local\Temp\ff71d756e146f3d8f7e6e893c44405f818ca46ad684f4ffc5a9ad5ab3f4505aa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\sHe2ajfKQecmWtm.exe.\sHe2ajfKQecmWtm.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\[email protected]\chrome.manifestFilesize
35B
MD568ce75f62232fa92af90070204d197f9
SHA190edc5e97209f463edbab09e45a1293b9e5ebe19
SHA2569c9f31394e1cef3633b2ff57dd8d4176dc7ce4d1ffeca833d0f56e3a8952e5e6
SHA5120d6918b9911ca079e86c0e336d5ef02d0e9f3e00046f9a4827bd3b8fd7814de1f019e03fd364371977f75af89f610e2f5f7345d124ee696d2b3dbb1ffc00ceac
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\[email protected]\content\bg.jsFilesize
9KB
MD5e47d421be1b418df17dbe38e82e6dc12
SHA1151399abd8076dbfe84ddff9ff811e65856ed16c
SHA2566eef772adb3385ed4d18c184a58d3511b3b005406cd3caf692005621fdeff126
SHA51295fab7af207079c56a754a2d115107cfa768179fb22dd66ff60ace793e469a77c8e6001d405a413e860d543e652196d80efdc1bef1f7383077fe8407f5ae0a73
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\[email protected]\install.rdfFilesize
595B
MD50f333196d058123c331ec4fd4898fd79
SHA146e87ce4c210800f0871e7b9b4d78a0ddf2e4ecc
SHA25615678826259fcc8a5a7bfb1c66a9281b9e764fd77cbde551503066373fc955a3
SHA5123248092d65cd219c22711b2ab73297cb12b7b7ac8e7a77a201a2b23c4f75c8cc31f5ddae65e4d5963c420142a6bd31039aa0ea646a4c8376732eb603e5e9a552
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\mcldakpaenejgmdegelfcflcegkmihfe\background.htmlFilesize
145B
MD568e008b26d2f3cce4513d97fae62ab00
SHA17ebafb5b6559d9c21fd0007f8f355a7937de788b
SHA2564d4e3cadef0914995619a2abdba03db778aadc20b11d9b0d705853bec64f8c65
SHA512adab443e2b55b244ef3c8415d3461d2605930b6eeeeba48c8373fc5e24c5f303e61dc2c61b053fc1f0ec75ba11359c427f324b2b5ccdec0f3c74403602d7c66b
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\mcldakpaenejgmdegelfcflcegkmihfe\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\mcldakpaenejgmdegelfcflcegkmihfe\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\mcldakpaenejgmdegelfcflcegkmihfe\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\mcldakpaenejgmdegelfcflcegkmihfe\xDspv3Wa.jsFilesize
6KB
MD52e9e30f26d9930fff2cc20f6035a73f9
SHA14e9f6a08076a8d6bdb5788e77c2a02a5f9117afc
SHA2567da3a34943797401ffb24ebb783d3b42443734a878828f2fd05b102344913c42
SHA512d455844aed3dd4b55310fdd0265ea0b4a15858a68d9ab9fbb6a84e0fe52d27acb88caff73192967b0fc455ab40b81bbcb96dba0c7bb1475925f22715f8b5b4b5
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\sHe2ajfKQecmWtm.datFilesize
1KB
MD56d582c9a6684ddd7d44c2418788d4906
SHA162ac9f22ba4e03333807670d8033eaf89587b48a
SHA256f3eaaf51e99b857b4a5c4f11550ea1dbc60c73d0a082955fc2b4e906b26bf1ca
SHA512c1772ae6a698553015aa05fb8d6a8834735d6cd272822a329cdf86f8f44837955b686c2590b48d96c27979ca18a20ceebbb855cadf735481df1eeedc5790dfb2
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\sHe2ajfKQecmWtm.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS56E.tmp\sHe2ajfKQecmWtm.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/5096-132-0x0000000000000000-mapping.dmp