fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96

Analysis

max time kernel
181s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96.exe
Size

931KB
MD5

96f2bdc8dc1347d4cc3d245fc6631f67
SHA1

4ca891e2041c1dff3c410b5d2d6cc617a03030e5
SHA256

fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96
SHA512

d73170585ed1c7756fd0d345c4b525ed7290f2d8ec171e04d45b6b8c4ad20b10369daad1dd6fffae36f6dfc901479ee973829c5a7b257ed2ca72f6538c545c15
SSDEEP

24576:h1OYdaOjCZ/iWCvu/2sWsJA/jlt+DHhsu:h1OsZCpYO/dJJDHhsu

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

jhql1L9LIEjrfdk.exe

pid process

4856 jhql1L9LIEjrfdk.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

jhql1L9LIEjrfdk.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjmnnigdkopcjgdddadajagdecgifebp\2.0\manifest.json	jhql1L9LIEjrfdk.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjmnnigdkopcjgdddadajagdecgifebp\2.0\manifest.json	jhql1L9LIEjrfdk.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjmnnigdkopcjgdddadajagdecgifebp\2.0\manifest.json	jhql1L9LIEjrfdk.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjmnnigdkopcjgdddadajagdecgifebp\2.0\manifest.json	jhql1L9LIEjrfdk.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjmnnigdkopcjgdddadajagdecgifebp\2.0\manifest.json	jhql1L9LIEjrfdk.exe

Drops file in System32 directory 4 IoCs

Processes:

jhql1L9LIEjrfdk.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	jhql1L9LIEjrfdk.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	jhql1L9LIEjrfdk.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	jhql1L9LIEjrfdk.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	jhql1L9LIEjrfdk.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

jhql1L9LIEjrfdk.exe

pid	process
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe
4856	jhql1L9LIEjrfdk.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

jhql1L9LIEjrfdk.exe

description	pid	process
Token: SeDebugPrivilege	4856	jhql1L9LIEjrfdk.exe
Token: SeDebugPrivilege	4856	jhql1L9LIEjrfdk.exe
Token: SeDebugPrivilege	4856	jhql1L9LIEjrfdk.exe
Token: SeDebugPrivilege	4856	jhql1L9LIEjrfdk.exe
Token: SeDebugPrivilege	4856	jhql1L9LIEjrfdk.exe
Token: SeDebugPrivilege	4856	jhql1L9LIEjrfdk.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96.exe

description	pid	process	target process
PID 4944 wrote to memory of 4856	4944	fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96.exe	jhql1L9LIEjrfdk.exe
PID 4944 wrote to memory of 4856	4944	fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96.exe	jhql1L9LIEjrfdk.exe
PID 4944 wrote to memory of 4856	4944	fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96.exe	jhql1L9LIEjrfdk.exe

C:\Users\Admin\AppData\Local\Temp\fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96.exe
"C:\Users\Admin\AppData\Local\Temp\fed4ef32fb25a4d2f06eccbcc24850f46985b17854328447de7de47840993c96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\jhql1L9LIEjrfdk.exe
.\jhql1L9LIEjrfdk.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
8d2a8ee07481307cdcbcf155258a7ff4

SHA1
8349496612ce9b7440e3650fb68fe1bcacb16622

SHA256
64f476762b69c3bc2a857806c3dc33093306bad2e150c829cefda83d9af227ad

SHA512
5c9a0c221764c75ffd40d8f7875ea9e13c9d315a93983b254230e6ee33698409099777757dbf503c2560f00a01b95a58bc98116a18b0a75232a33dd726bb3552

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
521e833c997653d24c3acc95e412baa0

SHA1
57955821d7564ed2022b7d6d4d43692beb959bcb

SHA256
053e2576e09a2a390a7230fe3ccbc26a9597fb03f2f738a0fd508eb48a0b8e00

SHA512
c1368e77b4da525e29761d99afb34f01143e6d4494ef39d0f49b82f5088b4f23fdaacb0a23f73155ad0ebf28f57d6fb9f875be2708c1fa29c31ca6a9e9dd15d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\[email protected]\install.rdf

Filesize
590B

MD5
fc13da2144e3520645cd4fed09335aee

SHA1
9b6ddc56bff28ecb24cdbf6f088e15ae6e6e4031

SHA256
b5439d7419fb9ae7c7c3f28392caf4bbb46bf3865b995d5db1d62aab97e99d55

SHA512
95a55d87523778e7ce7db0142d558d481601752816e15a6843ed4de594814943df79f26879b2409c35d3bea5d6c73c18b70e831b2d2d3e491f26289259cd4d2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\bjmnnigdkopcjgdddadajagdecgifebp\background.html

Filesize
140B

MD5
76b03f420a192a68f5e14e870bf2034c

SHA1
6b4c91b4696c863a517322692f7eac300e3e11e4

SHA256
65dc707b5a661ee00245b7398990928c4a17ac39e44dd0403a3246bf5851d114

SHA512
7b6222aa4b4d4a3fb32e0a0bc63843fe45bfa66b755ab0e077b991a3d43d99895c1430305b38a05d66cea94bbf54b01f895ece5fa44734b614e7fb704b499fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\bjmnnigdkopcjgdddadajagdecgifebp\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\bjmnnigdkopcjgdddadajagdecgifebp\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\bjmnnigdkopcjgdddadajagdecgifebp\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\bjmnnigdkopcjgdddadajagdecgifebp\zGS.js

Filesize
6KB

MD5
a89db230775ff82449190cfca6be9019

SHA1
71b329c5c1d53a32374427ae4dadbe4ff92d5860

SHA256
840d34bb873f6fbc59596748cbe79a0d2bd37a5eb1ee39572cd3f59c3c21f1c4

SHA512
2777f81cea7e667620a3113c86ede5ae87ec3cb562b6a37b9bc30827a85f64acb155059be637cee67a00ee26df081153037026905b328f9dfee948d0e4286638

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\jhql1L9LIEjrfdk.dat

Filesize
1KB

MD5
b7c8d846722c3ab19fdab8f612bcd7a7

SHA1
2a5293e9d65484123ff488c183093a720c787ed0

SHA256
8acceaa67217b97371a9b1b7c2dc3eb076e8407360af0aa8a8e7694767a99b10

SHA512
72d28b90aa6f20b3856a4ff854b687b9a7bfceacce7395a32ce2ee8534a745201759cf977efae8201d30a55486a549da4862d2b6890cf5e6644289b1a26c179f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\jhql1L9LIEjrfdk.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS56BB.tmp\jhql1L9LIEjrfdk.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/4856-132-0x0000000000000000-mapping.dmp

Download