fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb.exe
Size

919KB
MD5

ab22e539fa1504db76b741f2448af04a
SHA1

6cf48488b70ab43d3a0fd9c4e89133d0dc55d1a6
SHA256

fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb
SHA512

172203dbb14067a107092cfa2b1fc28d3b8f6dcc28bdb162ef49a9ab37695013276816104912afca492098f0b715c9ba951c9c44bacf8e7aa57c249ba4b7a1b2
SSDEEP

24576:h1OYdaOEMtdHAqcdDVhYwiei7+EpFAh/kKI:h1OsRPHVmVhYwiLtKkKI

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

LonfCjWy8IkQFWm.exe

pid process

2780 LonfCjWy8IkQFWm.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

LonfCjWy8IkQFWm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\femonmheiajgmkfcnlcgikminkgeihff\2.0\manifest.json	LonfCjWy8IkQFWm.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\femonmheiajgmkfcnlcgikminkgeihff\2.0\manifest.json	LonfCjWy8IkQFWm.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\femonmheiajgmkfcnlcgikminkgeihff\2.0\manifest.json	LonfCjWy8IkQFWm.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\femonmheiajgmkfcnlcgikminkgeihff\2.0\manifest.json	LonfCjWy8IkQFWm.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\femonmheiajgmkfcnlcgikminkgeihff\2.0\manifest.json	LonfCjWy8IkQFWm.exe

Drops file in System32 directory 4 IoCs

Processes:

LonfCjWy8IkQFWm.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	LonfCjWy8IkQFWm.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	LonfCjWy8IkQFWm.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	LonfCjWy8IkQFWm.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	LonfCjWy8IkQFWm.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

LonfCjWy8IkQFWm.exe

pid	process
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe
2780	LonfCjWy8IkQFWm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

LonfCjWy8IkQFWm.exe

description	pid	process
Token: SeDebugPrivilege	2780	LonfCjWy8IkQFWm.exe
Token: SeDebugPrivilege	2780	LonfCjWy8IkQFWm.exe
Token: SeDebugPrivilege	2780	LonfCjWy8IkQFWm.exe
Token: SeDebugPrivilege	2780	LonfCjWy8IkQFWm.exe
Token: SeDebugPrivilege	2780	LonfCjWy8IkQFWm.exe
Token: SeDebugPrivilege	2780	LonfCjWy8IkQFWm.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb.exe

description	pid	process	target process
PID 5036 wrote to memory of 2780	5036	fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb.exe	LonfCjWy8IkQFWm.exe
PID 5036 wrote to memory of 2780	5036	fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb.exe	LonfCjWy8IkQFWm.exe
PID 5036 wrote to memory of 2780	5036	fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb.exe	LonfCjWy8IkQFWm.exe

C:\Users\Admin\AppData\Local\Temp\fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb.exe
"C:\Users\Admin\AppData\Local\Temp\fd71e07873184a4dc0af69438995b99f3a8142e2801277aebd7aa731efaf54cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\LonfCjWy8IkQFWm.exe
.\LonfCjWy8IkQFWm.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\LonfCjWy8IkQFWm.dat
Filesize
1KB

MD5
30f9244ed6680ed8cf7776a2ac2975ae

SHA1
bfae8a36f37bc4cad308550e69e26c0004553730

SHA256
af2786095e57d93ba4064948ac03a6a590ed1f2c90abc672bfb9fc7b50f673a7

SHA512
1a53da5829e417333f0713f6357b5c043592c07b71f482c6865c3c579d0bc6246f57433669f7237918c2b3d5c9ed4a582f6037b017788c741426f185e44c00af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\LonfCjWy8IkQFWm.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\LonfCjWy8IkQFWm.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\femonmheiajgmkfcnlcgikminkgeihff\background.html
Filesize
138B

MD5
e610c64fcaf46c1f10309b2165f49370

SHA1
76168e031e1d07d2d52630bf76bc4907c6bbc9ae

SHA256
b31e69345000bb479ddcb3ca8005ee5f81636e82211e5028613ec0baae6f046f

SHA512
7d0a7933b4e5be05cf9a6476498051dbfba61be13e7fedc4d8fb694193c3045dc6564c5d607d63bfe657cedc6a0e86ff31317b9eb7492d34ef5aa9054d2374a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\femonmheiajgmkfcnlcgikminkgeihff\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\femonmheiajgmkfcnlcgikminkgeihff\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\femonmheiajgmkfcnlcgikminkgeihff\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\femonmheiajgmkfcnlcgikminkgeihff\q.js
Filesize
6KB

MD5
df7ec750ff9cfb1e3c816c19e7438a9a

SHA1
03d15a7fbc6566b7c945bceb783abbee0c83f4fc

SHA256
ed5dd58bcde4dda1e8550d9b363664631c5e0d2e6df6f4cf5ce7c00253be9a18

SHA512
1f06eebc6ac76797d4e489d42dd449e24485149b30d6624bcb900d26cf7d3606b70c29e7c60df35a920ab0225820035637ac4b4f04b676850d59a5d360a59903

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
74e52ff8eec7f62d50ee73cbec0716c3

SHA1
8ff252064015a78f3c2ce67b3bea9a3c1c6102e2

SHA256
61679708f66d2d6b41c1b19bb587983ad6ebb712a3da68107816ea238a1cd73e

SHA512
4128600b5331d33d22f8a2e7b6be87b301663db877bc06ffe6185d0ed70fa8ed53a89edb803e33c348e6d81ba48717e8787338a788e904f6c8e572910099c110

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
a606ec86127fc6261d37fa39fb847393

SHA1
d422993f19b067063b7aaa44e17f6fdcc1f76336

SHA256
541c80196064aeede76b3b78dc352ffd5aae0e3742fa4b1b9fce24a9eb26f400

SHA512
3c91731fde119f2466be56960d1cbc8918892eaf2ed40eb02d825816eea83d2d0a64a689c75cb75b550e173abdfbd39c12b9631cecb27138c5b57847b7c3e935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8707.tmp\[email protected]\install.rdf
Filesize
599B

MD5
07dfff17e9d003048edc87ed051cc931

SHA1
25275c277ac448012ee910dd2e71011e3879da11

SHA256
4af767e0287d2e05e5da65decf07081122a08f568166008483bf5150906c7300

SHA512
a50e8a226f33c33b5acc3424dfe54c3d810d398b4e1361b6c48723d8f7f30b0f1b699494e3238515c4f8160b364d2aea9da1731ed5fa9c3d0dab80f1171dae4d

Download Submit
memory/2780-132-0x0000000000000000-mapping.dmp

Download