c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045

Analysis

max time kernel
273s
max time network
407s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045.exe
Size

920KB
MD5

6d7026c8f5d9b61af5c1f0a75ec09db9
SHA1

6b4c4c9265695443d8598254c04f17ed016e6b71
SHA256

c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045
SHA512

6478f1591c9d449006e31caf1b7897ec8c27c6605c4aa5ae512de7748a3260d613994901efac43a165d9610b70cdc33033598d2c616f00c8fd0656f2a638eb4b
SSDEEP

24576:h1OYdaOLMtdHAqcdDVhYwiei7+EpFAh/kK2:h1OsSPHVmVhYwiLtKkK2

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vtofzTMsiPalYAF.exe

pid process

4416 vtofzTMsiPalYAF.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

vtofzTMsiPalYAF.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mckcagggepemckemipkomaeffjkecflf\2.0\manifest.json	vtofzTMsiPalYAF.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mckcagggepemckemipkomaeffjkecflf\2.0\manifest.json	vtofzTMsiPalYAF.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mckcagggepemckemipkomaeffjkecflf\2.0\manifest.json	vtofzTMsiPalYAF.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mckcagggepemckemipkomaeffjkecflf\2.0\manifest.json	vtofzTMsiPalYAF.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mckcagggepemckemipkomaeffjkecflf\2.0\manifest.json	vtofzTMsiPalYAF.exe

Drops file in System32 directory 4 IoCs

Processes:

vtofzTMsiPalYAF.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	vtofzTMsiPalYAF.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	vtofzTMsiPalYAF.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	vtofzTMsiPalYAF.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	vtofzTMsiPalYAF.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

vtofzTMsiPalYAF.exe

pid	process
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe
4416	vtofzTMsiPalYAF.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

vtofzTMsiPalYAF.exe

description	pid	process
Token: SeDebugPrivilege	4416	vtofzTMsiPalYAF.exe
Token: SeDebugPrivilege	4416	vtofzTMsiPalYAF.exe
Token: SeDebugPrivilege	4416	vtofzTMsiPalYAF.exe
Token: SeDebugPrivilege	4416	vtofzTMsiPalYAF.exe
Token: SeDebugPrivilege	4416	vtofzTMsiPalYAF.exe
Token: SeDebugPrivilege	4416	vtofzTMsiPalYAF.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045.exe

description	pid	process	target process
PID 2860 wrote to memory of 4416	2860	c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045.exe	vtofzTMsiPalYAF.exe
PID 2860 wrote to memory of 4416	2860	c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045.exe	vtofzTMsiPalYAF.exe
PID 2860 wrote to memory of 4416	2860	c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045.exe	vtofzTMsiPalYAF.exe

C:\Users\Admin\AppData\Local\Temp\c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045.exe
"C:\Users\Admin\AppData\Local\Temp\c97e3772b10d31efdb9b816b7f48ec4df08a10f773203b91b54a3ac848b09045.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\vtofzTMsiPalYAF.exe
  .\vtofzTMsiPalYAF.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
62ca1f71219b1f45b40e864263d4b3a6

SHA1
a081e6781f5e543dd9b56d2ecda91759adf90107

SHA256
312233ebac5d53c69fe8c615381173022f112785f8508795290b9c6c9b0efd66

SHA512
be02094ee277fc19a6cb00a03205ab2c772432995cb034333ef9100e973d201d0ff0ea64976d80babf2b9eea29eb9fa1a05045b555e7c864b9d74b3b08ff4b41

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
5bc650a81f0c7f555dec2fa3237145f5

SHA1
b9b1c50ff9f70e5d6dd76eed40de4d1380340bf8

SHA256
089a044420247edad7b173305697e17d99c3ffdb954436bf5db5f7d4743f5edd

SHA512
f3a3320298bdeb3d49ad430067b59cb2ed15c24c6b1b4252404b1782dd200a22930d0c9623bf04d143a7c74d6b198c2f6495a1fee4b6265f8116261f582f7016

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\[email protected]\install.rdf

Filesize
592B

MD5
23bbb0f86fe6c76b54cabe7c16926e5e

SHA1
42f8d0798791ca74fba9978671f2e4a4f699b0aa

SHA256
a391236f33f19645820d1cb9c67b33f27cb56b77ee7bf12ab07d334db7452320

SHA512
82d4b84a161f581cfd05d6ab12c6de9e06df62593e0d98add732b864cf1b09de7927192dbd05be671396c01a7164c58e98b90ba424c8af51675f8ca298ce0e17

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\mckcagggepemckemipkomaeffjkecflf\H.js

Filesize
6KB

MD5
c1f21769b61438c1c9c4c0689b7f30e9

SHA1
f44844f1c796294d6bfa4d7594df4fde4857241b

SHA256
c9bcac9c64a86a6d3742af53623aebcf79a861e2897490fd3af4ef04605c5979

SHA512
19504cf93d3aa224d53c21cb8e170cee3042de288932380ef41cdd8182d78a8256d3b2a63436cd94ef632c03416554e5c1e2a6f4c08cf60da5dc65b58e10ca26

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\mckcagggepemckemipkomaeffjkecflf\background.html

Filesize
138B

MD5
6f78a9f8b3159b436ed441ca0fa88fb7

SHA1
78b91858aceb4c4b345970b7f5375bd9c5cee5e7

SHA256
df00d7c896f5836452fe07dd66a17dd46157fdec21d3c8ca886b1a7ba909165e

SHA512
f867296bae6366e6328c8bead204c16130aad48e3c8770a99bf994eb85e7d31c748ed6d219c5bbcc8b2619c0721396213dfe82e4c0072938f6135ca91d627d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\mckcagggepemckemipkomaeffjkecflf\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\mckcagggepemckemipkomaeffjkecflf\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\mckcagggepemckemipkomaeffjkecflf\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\vtofzTMsiPalYAF.dat

Filesize
1KB

MD5
7efd29fcae657ae0d14133b06b0f5f24

SHA1
f6dcd2e6549043ce7657efce48117c6f24694839

SHA256
3018ab44fc54cfed9dbd7ac43755afa553e9e8923141b09cf38a5e4bcd5c5df5

SHA512
f1542b5d311e3c1f96a3dd656bbb4e54bc072a58bbbfcfbccbda94eb0a112b1ef352c4952a16de491c38c305170fe75dc2d6d5fba0dc7e4c13eb51447a85d68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\vtofzTMsiPalYAF.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8EA.tmp\vtofzTMsiPalYAF.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/4416-132-0x0000000000000000-mapping.dmp

Download