Analysis
-
max time kernel
33s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 16:24
Static task
static1
Behavioral task
behavioral1
Sample
febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe
Resource
win7-20220812-en
General
-
Target
febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe
-
Size
931KB
-
MD5
166e42c818f418d9acff9881d2e75283
-
SHA1
110fee83e665efb5fcb6d1cd53d5a45b88851dd4
-
SHA256
febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4
-
SHA512
78bfbb0f934fdc9464b13e841b3697bfecbd92ec99792324abb563a924d7631bd5b75750a9d310c726ea3ca31d1c3a76452f7847a862622328263cad2a3d501e
-
SSDEEP
24576:h1OYdaOPCZ/iWCvu/2sWsJA/jlt+DHhsj:h1Os5CpYO/dJJDHhsj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cnvQxEQzIfv3YrD.exepid process 1812 cnvQxEQzIfv3YrD.exe -
Loads dropped DLL 1 IoCs
Processes:
febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exepid process 364 febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
cnvQxEQzIfv3YrD.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcfcjklmppajajmnmopebfaeknhfheem\2.0\manifest.json cnvQxEQzIfv3YrD.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcfcjklmppajajmnmopebfaeknhfheem\2.0\manifest.json cnvQxEQzIfv3YrD.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcfcjklmppajajmnmopebfaeknhfheem\2.0\manifest.json cnvQxEQzIfv3YrD.exe -
Drops file in System32 directory 4 IoCs
Processes:
cnvQxEQzIfv3YrD.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol cnvQxEQzIfv3YrD.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI cnvQxEQzIfv3YrD.exe File opened for modification C:\Windows\System32\GroupPolicy cnvQxEQzIfv3YrD.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini cnvQxEQzIfv3YrD.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
cnvQxEQzIfv3YrD.exepid process 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe 1812 cnvQxEQzIfv3YrD.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cnvQxEQzIfv3YrD.exedescription pid process Token: SeDebugPrivilege 1812 cnvQxEQzIfv3YrD.exe Token: SeDebugPrivilege 1812 cnvQxEQzIfv3YrD.exe Token: SeDebugPrivilege 1812 cnvQxEQzIfv3YrD.exe Token: SeDebugPrivilege 1812 cnvQxEQzIfv3YrD.exe Token: SeDebugPrivilege 1812 cnvQxEQzIfv3YrD.exe Token: SeDebugPrivilege 1812 cnvQxEQzIfv3YrD.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exedescription pid process target process PID 364 wrote to memory of 1812 364 febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe cnvQxEQzIfv3YrD.exe PID 364 wrote to memory of 1812 364 febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe cnvQxEQzIfv3YrD.exe PID 364 wrote to memory of 1812 364 febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe cnvQxEQzIfv3YrD.exe PID 364 wrote to memory of 1812 364 febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe cnvQxEQzIfv3YrD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe"C:\Users\Admin\AppData\Local\Temp\febd647795d44e97e84bcb6e4c637ba664e02752ecc098777da3d1eed9d5ffe4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\cnvQxEQzIfv3YrD.exe.\cnvQxEQzIfv3YrD.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\cnvQxEQzIfv3YrD.datFilesize
1KB
MD5b9487b3d8d9cde578de84680306afc14
SHA1bb23cbb312be3354d3c5cc64869498aef249838c
SHA256446f3d42c9465d11cb33a48847d54a921037dcb88d0623f3878863ccd94800f3
SHA512c15c439e6c9b02b1481188e5f1a2d35dedf4953fb7e8622ab42d34b8608aeb60982fcd784ffcd87271938c10362295f9c3a502461a95390eed4f7d8baa90e939
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\cnvQxEQzIfv3YrD.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\jcfcjklmppajajmnmopebfaeknhfheem\Q0ZhP7auRS.jsFilesize
6KB
MD55aa435b0e95d9a83a67ad2cf9820c5e9
SHA1312f5190e948579fcb11aa6c3f1901194aa6c863
SHA256bf218800309dd5c2f3b95a14d74a6dd1d82f4a6f7b5210bc82f897c559697100
SHA512961ec1f9241084333bb5b9b0e8e8cf0ba453e52e3775d5d785dc6a218f39ca43b2cb30e8fc34dcb2001c12e6e50acaa4f0db564c1898f3c9af2121db787a7b29
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\jcfcjklmppajajmnmopebfaeknhfheem\background.htmlFilesize
147B
MD5104801e40d265711a84c5fd002e3ea46
SHA18485b2a7345dda88c641a50157bfc02abf901101
SHA2563b671e202ab77e81076901151ea9175b4ef23c21091d2bc54c1322fddf2eed78
SHA5129c3f15d7feb88d75efd830bd06a09638db4779a0df4ab4ad043b21299c856d6baa6761018f92c3928b324843e1fc4acd38cd68b1a09f28d3e754fae7dc4b7b6d
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\jcfcjklmppajajmnmopebfaeknhfheem\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\jcfcjklmppajajmnmopebfaeknhfheem\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\jcfcjklmppajajmnmopebfaeknhfheem\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\[email protected]\chrome.manifestFilesize
35B
MD55cefe19f2c68c44c96fd39077e65d718
SHA1bd88e58bb1b80287d12318f4066c0bd40bd145e1
SHA25631d5925ebfdd26096b01dd00adc5f64bad6b2619f860e67651e8cea5ebc85837
SHA5129f4c4885ebbf0d7da856fdcd7c9b7a30757570bb7c7850390f100d5a46ead878257233d5168ea39d79a0f47ac70c0b906ba6031b97cda181d40dc7e399d7d4fe
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\[email protected]\content\bg.jsFilesize
8KB
MD501a0f985a6bcb84f91e034409865c085
SHA1ed5084fed75822d62287d31e6aa58cea728650c3
SHA256ed5a6b648625a3e9dcefa83810e3853e7da7a1bfbc912674f76ca77632b6e2b5
SHA5129f32977071c6ff084a27fe72ff40186760a11fc4f4a360bb4e7a00f11e041b975dfd1705136cda6d9d1df6fe7d4224ea3627142ff23d0f4bddb9961be64b4186
-
C:\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\[email protected]\install.rdfFilesize
599B
MD5663fc015740086faa3911f98aaafc676
SHA1d14549c8b0b5726a7e47d758d350de21de7e1ced
SHA2568ab77ceff8e22466465874d3c4d2f2571deea0f57d39ef4add54de800b4153e4
SHA51203fb71054a8a2fa614b4a4d9c7e19596299953530633c7721321efeaf06b1691a08ed5b01508a4454660e173313f61d3223886221616fc545a6a64650e3e3b84
-
\Users\Admin\AppData\Local\Temp\7zS7FFA.tmp\cnvQxEQzIfv3YrD.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1812-56-0x0000000000000000-mapping.dmp