fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149

Analysis

max time kernel
127s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149.exe
Size

931KB
MD5

6f5a85b52c20cc98f47f5f8f1535fdec
SHA1

8e95b2ad4aba4cfb62bf022f0ba6d790164758bd
SHA256

fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149
SHA512

32e30addd54098e61a9a9f4f64b96821cf2499379fa42bb524bde762f5a910fb77c34d025def82cbc1178f40bc9dfea33d288d643d27138e99d28660ca514c2d
SSDEEP

24576:h1OYdaOUCZ/iWCvu/2sWsJA/jlt+DHhsx:h1Os6CpYO/dJJDHhsx

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ewaKwKDW7uGILMk.exe

pid process

692 ewaKwKDW7uGILMk.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

ewaKwKDW7uGILMk.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fldihghhaafbpgckdkahimccfnjbpdoh\2.0\manifest.json	ewaKwKDW7uGILMk.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fldihghhaafbpgckdkahimccfnjbpdoh\2.0\manifest.json	ewaKwKDW7uGILMk.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fldihghhaafbpgckdkahimccfnjbpdoh\2.0\manifest.json	ewaKwKDW7uGILMk.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fldihghhaafbpgckdkahimccfnjbpdoh\2.0\manifest.json	ewaKwKDW7uGILMk.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fldihghhaafbpgckdkahimccfnjbpdoh\2.0\manifest.json	ewaKwKDW7uGILMk.exe

Drops file in System32 directory 4 IoCs

Processes:

ewaKwKDW7uGILMk.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ewaKwKDW7uGILMk.exe
File opened for modification	C:\Windows\System32\GroupPolicy	ewaKwKDW7uGILMk.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ewaKwKDW7uGILMk.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ewaKwKDW7uGILMk.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

ewaKwKDW7uGILMk.exe

pid	process
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe
692	ewaKwKDW7uGILMk.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ewaKwKDW7uGILMk.exe

description	pid	process
Token: SeDebugPrivilege	692	ewaKwKDW7uGILMk.exe
Token: SeDebugPrivilege	692	ewaKwKDW7uGILMk.exe
Token: SeDebugPrivilege	692	ewaKwKDW7uGILMk.exe
Token: SeDebugPrivilege	692	ewaKwKDW7uGILMk.exe
Token: SeDebugPrivilege	692	ewaKwKDW7uGILMk.exe
Token: SeDebugPrivilege	692	ewaKwKDW7uGILMk.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149.exe

description	pid	process	target process
PID 4568 wrote to memory of 692	4568	fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149.exe	ewaKwKDW7uGILMk.exe
PID 4568 wrote to memory of 692	4568	fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149.exe	ewaKwKDW7uGILMk.exe
PID 4568 wrote to memory of 692	4568	fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149.exe	ewaKwKDW7uGILMk.exe

C:\Users\Admin\AppData\Local\Temp\fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149.exe
"C:\Users\Admin\AppData\Local\Temp\fddd9d1756f8ab565e0a053f3e6d4ba49d1a8c790d08672163595f64ccbfd149.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568

C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\ewaKwKDW7uGILMk.exe
.\ewaKwKDW7uGILMk.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
b0207ba0f4acf41d75a26fb8558b6768

SHA1
25204f8e01751be5427fa31edad58fd040bc8138

SHA256
64302d1631a2c1f9f066344d2dce3852e1aad2dfc764b6d95b3d4ad70e2037c5

SHA512
ca05b13bd208bf35aa2b02a076209efb3352a7f19f879b3107b79ce3d119f17d6b006afb5695371e6ada0c0a8d2a1a22af6ecee6bcc311a66e9fe5d3cacb5271

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
1f618cd9888eeba4cecde024e2cd5011

SHA1
ed1ac10f31ae564552512c69425037a1e68db205

SHA256
1bddfdc6767991868b41bf6713e2eecd1f7740bdb2510ad7863cc7002a5d7fd1

SHA512
b8d89796065e455ccd0806c402cf78b8d08f75412a5ce016986fb51d79e99b78fcd7ded3ab1dc4d31699c2ad246904ae8cb5910997461b9b17aedd2ec826f294

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\[email protected]\install.rdf
Filesize
591B

MD5
3ce966a3c4b39f551dabd07de683c343

SHA1
1d9103133a9f3c554c93f8a336e18490e3feb52c

SHA256
f11a1b4f44a18e64a83cdb141b67e80e2767b119beaa60c128ac23a92e41566e

SHA512
009277606c0d8ecc537814b1f3c32b75b5004587444b2dab1dd6b4934b9a6c6cb2a98cb806a74f49576669b02b7c7773daf6bba26152a82f817ff29235b555f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\ewaKwKDW7uGILMk.dat
Filesize
1KB

MD5
4175731239115de506bae3265ce7534f

SHA1
1d992f584e7bb85a94c5db0948c3c6955a4bdc20

SHA256
4c93ea5d09d6b2c19570d55217fa0812da22981fcfadbd6f64bbd02febaeb093

SHA512
858b38f8d9837e30902d13259e88f009c182978f4c0c329280391d931105477c63e1d8643b1b8694d4846294c4c43fb2364d257b0a5eaf1cade314e6790eb68a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\ewaKwKDW7uGILMk.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\ewaKwKDW7uGILMk.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\fldihghhaafbpgckdkahimccfnjbpdoh\background.html
Filesize
143B

MD5
bb0f49ed667b34c8ba07e69b2845622d

SHA1
ea0b339b1bd7733c68c837de4b89f684d86b87ea

SHA256
53263863b13d7680011858baa1ed0823d735f200d731e2c6b4800b9f177356ba

SHA512
2122b13ec045a111ae6ccea73a99a1dc2a40d6b8997b3b12cc47251580003d903f98179227568c356b769e4b8d9f6b033f04ad3e129a82f4551dfccf47926928

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\fldihghhaafbpgckdkahimccfnjbpdoh\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\fldihghhaafbpgckdkahimccfnjbpdoh\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\fldihghhaafbpgckdkahimccfnjbpdoh\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC306.tmp\fldihghhaafbpgckdkahimccfnjbpdoh\sWtJ66.js
Filesize
6KB

MD5
0bbcbced2d9908508bb647b93f547fd6

SHA1
7486ec8c163cac272505ae3145913beaa6969e90

SHA256
89814e51ca30b4db7fe513f26940a325b124da864d3714df5f0244f8d2b363a2

SHA512
24fcd7f8d5e75e18e82e8af59d2ba64e1a87940d16b791a5eb58705b23edfb065d3f3b9a75c0cf3e4e631ab0b16f78b7d876142003729c515743319a0e9ee74f

Download Submit
memory/692-132-0x0000000000000000-mapping.dmp

Download