c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027

Analysis

max time kernel
127s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027.exe
Size

931KB
MD5

dae4cd4c7d45b7e423c75be20a8c097e
SHA1

660fc9baec79b2c51082c97e60e8bab753b874b1
SHA256

c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027
SHA512

e853f1b4b4c594b93fd8dd2377d968b8b01cbe24e75a3487378f67255f764e6ab9de79f937939fd4b16f3edbd54b14f3b6b8c7503a879edbc41b66987fe770cf
SSDEEP

24576:h1OYdaOMCZ/iWCvu/2sWsJA/jlt+DHhsW:h1OsaCpYO/dJJDHhsW

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

fj3bdaELVpnuctK.exe

pid process

4756 fj3bdaELVpnuctK.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

fj3bdaELVpnuctK.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfhknlfodgghkclbakoeenedplhakjm\2.0\manifest.json	fj3bdaELVpnuctK.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfhknlfodgghkclbakoeenedplhakjm\2.0\manifest.json	fj3bdaELVpnuctK.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfhknlfodgghkclbakoeenedplhakjm\2.0\manifest.json	fj3bdaELVpnuctK.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfhknlfodgghkclbakoeenedplhakjm\2.0\manifest.json	fj3bdaELVpnuctK.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfhknlfodgghkclbakoeenedplhakjm\2.0\manifest.json	fj3bdaELVpnuctK.exe

Drops file in System32 directory 4 IoCs

Processes:

fj3bdaELVpnuctK.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	fj3bdaELVpnuctK.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	fj3bdaELVpnuctK.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	fj3bdaELVpnuctK.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	fj3bdaELVpnuctK.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

fj3bdaELVpnuctK.exe

pid	process
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe
4756	fj3bdaELVpnuctK.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

fj3bdaELVpnuctK.exe

description	pid	process
Token: SeDebugPrivilege	4756	fj3bdaELVpnuctK.exe
Token: SeDebugPrivilege	4756	fj3bdaELVpnuctK.exe
Token: SeDebugPrivilege	4756	fj3bdaELVpnuctK.exe
Token: SeDebugPrivilege	4756	fj3bdaELVpnuctK.exe
Token: SeDebugPrivilege	4756	fj3bdaELVpnuctK.exe
Token: SeDebugPrivilege	4756	fj3bdaELVpnuctK.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027.exe

description	pid	process	target process
PID 2320 wrote to memory of 4756	2320	c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027.exe	fj3bdaELVpnuctK.exe
PID 2320 wrote to memory of 4756	2320	c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027.exe	fj3bdaELVpnuctK.exe
PID 2320 wrote to memory of 4756	2320	c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027.exe	fj3bdaELVpnuctK.exe

C:\Users\Admin\AppData\Local\Temp\c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027.exe
"C:\Users\Admin\AppData\Local\Temp\c8d882f7cbaca366c8a86fc0a0799ffe6531b1c0f1e20ff825f70e472d42a027.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\fj3bdaELVpnuctK.exe
.\fj3bdaELVpnuctK.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
11f490446afcaa725bd3720a0156d4e5

SHA1
fbe097819b989582b0cce385c043bb9bf6d0001d

SHA256
115342397d9a464a08773a4ab00e5bcde07c15dc916824104975404a98b3d564

SHA512
7d02ed1dc8c3f632b7119b03570725692bbf8b4a8f0f8f23e7f86f7510bbb7332625476ff937e39b12beee3aef25cb4d38343f6d8f965eca54d656faa3876c80

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
bc85e34eab09b73e0b53e3a14db09e54

SHA1
6e72984c39b860a5d3d44ed842cee5275ec95480

SHA256
671793665140e5a6a09dbed0b1bf3e520577c3f6f987cbce4f99519e05e4fe46

SHA512
38dd5d26f70eaf2d22d8370314fa92ce0e5036ac16caae9fef684267bfdc336fe31d8d4ea32101628f3f5a343175a493d6d0845fff0b48b07f8c203b8c2eeabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\[email protected]\install.rdf
Filesize
594B

MD5
3d6756184f9533537b00960eae0e4389

SHA1
f4ed848277cbb903322b825789bdb1aa38fb3a7f

SHA256
443f4fdeb2551d42d4aa7e6f89130f33bd684f37ec783ca8cab6b2fa553ddcec

SHA512
4563e3b067bd907b9fad552c86aa3955f9acc3be0dd981c9729185b47b95ebdaa6114931277d76f9aebad46e670eb007b39a084db763f75f957e00bb3eedce82

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\fj3bdaELVpnuctK.dat
Filesize
1KB

MD5
5e41bbaf073fecb0423ce83420c9f19c

SHA1
049f6f0469704d9c70ca8ba5176311b67c62497a

SHA256
f77f51288f6398555f35aa5a5ac78049a5eaa0e70d21f3140980b606b2b9a5a5

SHA512
8bd0a20140bba28cc5beeab21c0d648a01729619941a61826cd5fd5293d43bf6a751848fdc739a424696b8289df86ff2a424ffe6a8bab57118a08fc1b3c07df2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\fj3bdaELVpnuctK.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\fj3bdaELVpnuctK.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\ogfhknlfodgghkclbakoeenedplhakjm\avOuD0Bui1.js
Filesize
6KB

MD5
e66bb30269c971966474f144bb05e082

SHA1
78a6d81f80fd68b4534fb6df9c6686e067e2176e

SHA256
fe0b4c87b14fcb0032917be9180dbea89128e078e444cbd0b4fad69cfcd00af4

SHA512
34c47284a77832b78f6450b565a96296ea686971fc384acf9832c56abe92cd67e777f9e0cc5ca85766e354450b515cc5c0dc73d01ac26c6bae78b0430b1af2dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\ogfhknlfodgghkclbakoeenedplhakjm\background.html
Filesize
147B

MD5
8130cc3bf423feb462eea7064b636e08

SHA1
685655c8ee93fa15c066df9265e07274e6b29840

SHA256
fac50ef43f0d61767686d6d1efa02af55dcfdf55115a8b37ab03485284ee083e

SHA512
0c6a9eb02bb6630a5caf700e961cc49c57ca065972422cc9bfa6bdcb221cc659ade3fe83950025ff1e4e798b932ac5a95df76909cd1d3b47c241cd2ed8208fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\ogfhknlfodgghkclbakoeenedplhakjm\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\ogfhknlfodgghkclbakoeenedplhakjm\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA55D.tmp\ogfhknlfodgghkclbakoeenedplhakjm\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4756-132-0x0000000000000000-mapping.dmp

Download