Analysis
-
max time kernel
57s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:21
Static task
static1
Behavioral task
behavioral1
Sample
c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe
Resource
win7-20221111-en
General
-
Target
c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe
-
Size
932KB
-
MD5
7279bf304bf49f4959dc8be1dc555463
-
SHA1
85689ff3e54a554e5a7daff000b441126b130031
-
SHA256
c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09
-
SHA512
a4e0a2962f4f1be7df2807870d35dd10d4a6830666548b08882aa93e50253871245910484098cef6432e808c4c8b4a405909d1267759aa87b10ad3beb9266a73
-
SSDEEP
24576:h1OYdaOBn0M9n0MmCZ/iWCvu/2sWsJA/jlt+DHhsj:h1OsgCpYO/dJJDHhsj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cZh3fN8wPy0chr9.exepid process 556 cZh3fN8wPy0chr9.exe -
Loads dropped DLL 1 IoCs
Processes:
c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exepid process 2020 c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
cZh3fN8wPy0chr9.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpjnncdfjifmmocnlifamihnpcaflanb\2.0\manifest.json cZh3fN8wPy0chr9.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpjnncdfjifmmocnlifamihnpcaflanb\2.0\manifest.json cZh3fN8wPy0chr9.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpjnncdfjifmmocnlifamihnpcaflanb\2.0\manifest.json cZh3fN8wPy0chr9.exe -
Drops file in System32 directory 4 IoCs
Processes:
cZh3fN8wPy0chr9.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI cZh3fN8wPy0chr9.exe File opened for modification C:\Windows\System32\GroupPolicy cZh3fN8wPy0chr9.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini cZh3fN8wPy0chr9.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol cZh3fN8wPy0chr9.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
cZh3fN8wPy0chr9.exepid process 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe 556 cZh3fN8wPy0chr9.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cZh3fN8wPy0chr9.exedescription pid process Token: SeDebugPrivilege 556 cZh3fN8wPy0chr9.exe Token: SeDebugPrivilege 556 cZh3fN8wPy0chr9.exe Token: SeDebugPrivilege 556 cZh3fN8wPy0chr9.exe Token: SeDebugPrivilege 556 cZh3fN8wPy0chr9.exe Token: SeDebugPrivilege 556 cZh3fN8wPy0chr9.exe Token: SeDebugPrivilege 556 cZh3fN8wPy0chr9.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exedescription pid process target process PID 2020 wrote to memory of 556 2020 c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe cZh3fN8wPy0chr9.exe PID 2020 wrote to memory of 556 2020 c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe cZh3fN8wPy0chr9.exe PID 2020 wrote to memory of 556 2020 c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe cZh3fN8wPy0chr9.exe PID 2020 wrote to memory of 556 2020 c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe cZh3fN8wPy0chr9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe"C:\Users\Admin\AppData\Local\Temp\c9077943b97cf1784e08f5616f23268750a7e07711e46816852dbfd1e374ef09.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\cZh3fN8wPy0chr9.exe.\cZh3fN8wPy0chr9.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\[email protected]\chrome.manifestFilesize
35B
MD57675d1e7c41f869018a37787c19a13ba
SHA1b2b289aa681e0ae6e484549698b21db789f4bde6
SHA2566bf8a87cb98b6781c4ee6be18310e7cecd2840c1674020621f8dafa799c205a8
SHA5127ec4b9a27aaa93409262fc4e36161c56203c96715ef962516d4f99cff505b62527a3a20af740afbf8c27a5fb2d2805d4314a1b221a07eb375dfbd5497f5b688e
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\[email protected]\content\bg.jsFilesize
9KB
MD521e410506665f0ad0e883f2d4218b7bd
SHA1d029d9d0bb54fb9280f1fe6adc8376134836fb21
SHA2561b5270c27c3a8e0b582285fbf3fb48d6bd83c7e7b30a0894b486cfb08b28043b
SHA5129266dc516ae273809d95c3e8d1f47495e14727a4e7bbcca9ff3c00695cab68eb7ead396971d4fac1ce7314851622e6033e31522ee5cf5d05b1265bc6494e647d
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\[email protected]\install.rdfFilesize
590B
MD53483537b807afa4ee5ef96415add10f1
SHA149376dbe16fe220847ad169f83346875d939ad08
SHA2567dc91ee43bbbe0d25da6805b0e5339f6eb32c6ac9e8c0936f9fbdffb3db372f4
SHA5121cb55547501a36e3dc59b4dc73d1186850750bdf7c59ce5f0a412cb250dfb83f76669972684b9bec1170afe8216826347844416bcc4cd4b438ddfd96726565cd
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\cZh3fN8wPy0chr9.datFilesize
1KB
MD5b13ab3efc0223b4046ddc2d861b3d2f3
SHA19e3a84ae7f3a504ba34404613dfc27de4f36d326
SHA25610260866f888d24254b162d59cd309adf5d51a4051f8dfd880035cbb89f36aad
SHA512d0c38a035cb77c9d0444eb971c935b8a77bfdd5495fa791c65bfec0b764fa0f2b67a8e82d4cb4b71ef5ef270e3728937aa9b76453a1972e9688a78ccbf1fae52
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\cZh3fN8wPy0chr9.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\dpjnncdfjifmmocnlifamihnpcaflanb\background.htmlFilesize
143B
MD5722db2af01ff7f4c177039d1da4b8163
SHA1c07cd9ae3136a160213109bd1613bd55ab25c997
SHA25669045e65834b68f742b6143115e82b9831d64e6675d02b4f768355fcd3b2612c
SHA5129fe944a7bf2d63e6c87c903e61bda5ac23e6e60b322f5a63cec44a59087e2b571876ead4e610c2a3c6d847d395fe636cb0c4b105f9d527e851203cd5cfc8fe1e
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\dpjnncdfjifmmocnlifamihnpcaflanb\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\dpjnncdfjifmmocnlifamihnpcaflanb\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\dpjnncdfjifmmocnlifamihnpcaflanb\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSE061.tmp\dpjnncdfjifmmocnlifamihnpcaflanb\nbkAWx.jsFilesize
6KB
MD57dfbd82cdeafd7d6c54ee1be747e691a
SHA11506c3b2da7b194cd907bfcfdee76a8de454124b
SHA256245eeb0cd34de3785543e0d7d069d3dcbb556a4acf5b7ba5a81ee44efca91af2
SHA51257739fd8e763e0c8f823d5d68b25d7390ab30d94d92f57c9e17bc74ef2b2c299795eeaea99ececad588fa99e419a9323cb93bf50f952d2108bae29371384592d
-
\Users\Admin\AppData\Local\Temp\7zSE061.tmp\cZh3fN8wPy0chr9.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/556-56-0x0000000000000000-mapping.dmp
-
memory/2020-54-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB