Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:21
Static task
static1
Behavioral task
behavioral1
Sample
c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985.exe
Resource
win7-20221111-en
General
-
Target
c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985.exe
-
Size
931KB
-
MD5
86ef5f32fb92b8a34a83d945d333fdac
-
SHA1
d842b02419ce9e40f5af3bd2ed101f8358b7428e
-
SHA256
c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985
-
SHA512
dc8465521c639783a9e86472afd2d78b6445c8736f6c08131256270f8e4de5b4efa5645e2e2c6b3de5104380e75da01723408d6225ae02de1ab65c2ac4e07b61
-
SSDEEP
24576:h1OYdaO4CZ/iWCvu/2sWsJA/jlt+DHhsE:h1OsCCpYO/dJJDHhsE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
a7SImx8BzmwBQNw.exepid process 4068 a7SImx8BzmwBQNw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
a7SImx8BzmwBQNw.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffclndfidhbcajjlldkgakbaefmanald\2.0\manifest.json a7SImx8BzmwBQNw.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffclndfidhbcajjlldkgakbaefmanald\2.0\manifest.json a7SImx8BzmwBQNw.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffclndfidhbcajjlldkgakbaefmanald\2.0\manifest.json a7SImx8BzmwBQNw.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffclndfidhbcajjlldkgakbaefmanald\2.0\manifest.json a7SImx8BzmwBQNw.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffclndfidhbcajjlldkgakbaefmanald\2.0\manifest.json a7SImx8BzmwBQNw.exe -
Drops file in System32 directory 4 IoCs
Processes:
a7SImx8BzmwBQNw.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy a7SImx8BzmwBQNw.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini a7SImx8BzmwBQNw.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol a7SImx8BzmwBQNw.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI a7SImx8BzmwBQNw.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
a7SImx8BzmwBQNw.exepid process 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe 4068 a7SImx8BzmwBQNw.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
a7SImx8BzmwBQNw.exedescription pid process Token: SeDebugPrivilege 4068 a7SImx8BzmwBQNw.exe Token: SeDebugPrivilege 4068 a7SImx8BzmwBQNw.exe Token: SeDebugPrivilege 4068 a7SImx8BzmwBQNw.exe Token: SeDebugPrivilege 4068 a7SImx8BzmwBQNw.exe Token: SeDebugPrivilege 4068 a7SImx8BzmwBQNw.exe Token: SeDebugPrivilege 4068 a7SImx8BzmwBQNw.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985.exedescription pid process target process PID 2820 wrote to memory of 4068 2820 c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985.exe a7SImx8BzmwBQNw.exe PID 2820 wrote to memory of 4068 2820 c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985.exe a7SImx8BzmwBQNw.exe PID 2820 wrote to memory of 4068 2820 c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985.exe a7SImx8BzmwBQNw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985.exe"C:\Users\Admin\AppData\Local\Temp\c8f4f38f49a12dcb37beec985cc138a9bc8e1bbe69041377e064a5f6c19c6985.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\a7SImx8BzmwBQNw.exe.\a7SImx8BzmwBQNw.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\[email protected]\chrome.manifestFilesize
35B
MD5df25a58e60e6e0feae507f3a46bf789c
SHA1e643219c5e0f66ca735878de514efcea86c6e362
SHA256574fc6e9daaceffeffc3de4aa10a54bf955cc22d00eb8ce98110131cc05c742e
SHA512002b9f15e7d039786fdc0f792af055d4084080d1c779aeb57ea806185f60175f85540642cd0cc09f73fc2929b67651cd83296a8541db538bbc136a3c48005926
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\[email protected]\content\bg.jsFilesize
8KB
MD580626202f6c53651600be14c57c770d2
SHA1317c3abc9019b598bc17cf189c647971d240ac9b
SHA25641b6224a9b3c890e96d9c94abd7779bc68e7e9edebf1ba7f5f1f136407589dca
SHA5125938f184037e669b134813d10b1bdc90a4cf63977b8f93d1ea969dc6d4e51aedddb5fb52ea86a3030ea4bf1487df7ee6c79ec04d82df9755a32d2045b5664013
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\[email protected]\install.rdfFilesize
591B
MD53cbf5634e7532eb6be5930094580c0ea
SHA13373fe51d861d094d25afeb765dfaa8dc2645b9c
SHA256fe707e56753f9f4b034656c0b42753630ddd8bcfd175d526f2ef8ba9f94b86c5
SHA512ee2dbb60f8065497c5d907de8c904e228c6f9a89e712f263a105e31ee3586a7de74d0f065e8194978f2fb29f2f897bf7aa7ae3892901046f520bb035556ebb2e
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\a7SImx8BzmwBQNw.datFilesize
1KB
MD554fb58a5236dd0326b527982535080e5
SHA1e6d1022a0af95e1fbc3f2fe28571423a8da0b1d1
SHA256662a315534ba20ef942cd5cd7819c1df1d909b3e9352837ac1da29801791b5d7
SHA51289bc80dfd710980d80ad9ac0b173862bf870b7e90fd1593e05e67c8d0779d99487f547dcf16d40769b8f89e0dfdf17034636c93825e1c71629e0a33db4811eec
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\a7SImx8BzmwBQNw.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\a7SImx8BzmwBQNw.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\ffclndfidhbcajjlldkgakbaefmanald\Dm7i7LY08f.jsFilesize
6KB
MD5d5acd8864fd6951b55ee6b4d15d46407
SHA175847a6960f56e5fcb2a332980380be8fea1248f
SHA256a83f12fc2e43bc52c1c1298e35ce32f6c90bbcfc0da7439464ebd271cacfde1f
SHA512f4c7ba62d137d4dfaed9dda062a85a56a1d0e0fde1dc1f39129a8141958e16fe933c0d16b9599cc586a91132f8d5bf6b73bb30040997b1fea9387fd41e15d7ca
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\ffclndfidhbcajjlldkgakbaefmanald\background.htmlFilesize
147B
MD5f7b4dcd2f4e96e768e802d074fd0c3dc
SHA158e8fd0a26356bfc787f3c9a93aef1166382bb42
SHA25645b44f57b6868fe7820d3b3de831e7671736b9e26e032df1db72b1f9831a891b
SHA5126ae69f3a1fac8897cfe6224f5c380ac5cb0b845f2ada2858602a2f8334bf130e6284b85b65f808c31b2f725512260b8b75215be5b2bb3e2a1e8f5007a1cfd150
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\ffclndfidhbcajjlldkgakbaefmanald\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\ffclndfidhbcajjlldkgakbaefmanald\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS669E.tmp\ffclndfidhbcajjlldkgakbaefmanald\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/4068-132-0x0000000000000000-mapping.dmp