c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323.exe
Size

920KB
MD5

bd6491ff8dcc464755d7e8ac4ee5347d
SHA1

2e1b1480c3a24479119931e50fbd104a11fe53a0
SHA256

c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323
SHA512

388c36fd51dbbe19cb9451e868d60dc6000ba33e867c9dc08fe3c49189c9d2cb8061342e8074b0c7af237523ad6b322e034413b337dfa13b1ede6dd1f62de538
SSDEEP

24576:h1OYdaO9MtdHAqcdDVhYwiei7+EpFAh/kKs:h1OssPHVmVhYwiLtKkKs

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ZZRIWgSJBHb7WjD.exe

pid process

1892 ZZRIWgSJBHb7WjD.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

ZZRIWgSJBHb7WjD.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jldajglcipbfmlnmgfpeoenfnbnlianb\2.0\manifest.json	ZZRIWgSJBHb7WjD.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jldajglcipbfmlnmgfpeoenfnbnlianb\2.0\manifest.json	ZZRIWgSJBHb7WjD.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jldajglcipbfmlnmgfpeoenfnbnlianb\2.0\manifest.json	ZZRIWgSJBHb7WjD.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jldajglcipbfmlnmgfpeoenfnbnlianb\2.0\manifest.json	ZZRIWgSJBHb7WjD.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jldajglcipbfmlnmgfpeoenfnbnlianb\2.0\manifest.json	ZZRIWgSJBHb7WjD.exe

Drops file in System32 directory 6 IoCs

Processes:

svchost.exeZZRIWgSJBHb7WjD.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E7CF3917-F897-456D-927C-8DA849B77FF0}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D7385A00-3317-45E8-A161-3A47D2BA93F7}.catalogItem	svchost.exe
File opened for modification	C:\Windows\System32\GroupPolicy	ZZRIWgSJBHb7WjD.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ZZRIWgSJBHb7WjD.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ZZRIWgSJBHb7WjD.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ZZRIWgSJBHb7WjD.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

ZZRIWgSJBHb7WjD.exe

pid	process
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe
1892	ZZRIWgSJBHb7WjD.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ZZRIWgSJBHb7WjD.exe

description	pid	process
Token: SeDebugPrivilege	1892	ZZRIWgSJBHb7WjD.exe
Token: SeDebugPrivilege	1892	ZZRIWgSJBHb7WjD.exe
Token: SeDebugPrivilege	1892	ZZRIWgSJBHb7WjD.exe
Token: SeDebugPrivilege	1892	ZZRIWgSJBHb7WjD.exe
Token: SeDebugPrivilege	1892	ZZRIWgSJBHb7WjD.exe
Token: SeDebugPrivilege	1892	ZZRIWgSJBHb7WjD.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323.exe

description	pid	process	target process
PID 1512 wrote to memory of 1892	1512	c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323.exe	ZZRIWgSJBHb7WjD.exe
PID 1512 wrote to memory of 1892	1512	c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323.exe	ZZRIWgSJBHb7WjD.exe
PID 1512 wrote to memory of 1892	1512	c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323.exe	ZZRIWgSJBHb7WjD.exe

C:\Users\Admin\AppData\Local\Temp\c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323.exe
"C:\Users\Admin\AppData\Local\Temp\c805ef649b3075541da6f3548d18343ad79b15369b588f6b8e9e11cefc269323.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\ZZRIWgSJBHb7WjD.exe
.\ZZRIWgSJBHb7WjD.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:5048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
cce144a571eddd6e8d2429accf13820d

SHA1
e573ddf89348bfe4f8a558b205c8d2b78a07fd80

SHA256
084a59ab0def3d8fc07e6cc8324610920327f67b5ad1289991b0ef1a51eb02fe

SHA512
337d1695cac777fa8e5c7b0ca8f45ccb741e5fcd97ef6ef993ac866e4ed1880af4517795bcbed605eb58c232694d2145c7b92f83875565e132495e350d3a53e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
a67ebe4372fb0577b6c8ba2ba2c0dbb7

SHA1
0d63b05f16ebf407a6a732f16e262e1e5a7e66ab

SHA256
2d489c4f61c9d9b40ea12d8d0843fd4d8f88af0db8aa5abd48372ba911d16103

SHA512
926c1874ee40bf1e93faf08fdef83865c9f62fc8de5cf8444e3e4d7deb1ca1bbf172f90ae3f66bea0a65ea8ae5161f1da61f7a6a3a2f19af41f5d8dff8a475e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\[email protected]\install.rdf
Filesize
597B

MD5
0d5512b5b8582c382a1fcecaa3e3701a

SHA1
b49ea64d5beb8c05852d473a3004686403ad75b4

SHA256
0ff39066ef42162a5388b21197893911630f3d4850c80b869609577b4a0a974a

SHA512
35526720da2b99aaf6b458cf8aa7bcce63281a17aea9b19f25412a8c2f3e5932a72721dfb0fea609db2819185f4f7a1240961837ff790e635a52e57c3f2599c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\ZZRIWgSJBHb7WjD.dat
Filesize
1KB

MD5
f6515721ff7c4d8005177cac50014c3e

SHA1
af1933b1399fcc838a9f29426fb7f0a7fd55e3b0

SHA256
1ce183c6c4fb056521d72300c7280ff1916823cc94b5860b2244de48048a298a

SHA512
601e061cca09acec2d1e9dc573cdcbd0d7f2b10ec40b6419c79b3f272e5add910430cc07e5325eefd4be066a212a9dc1c5c80256f2abf95c5297ad1cd03ac150

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\ZZRIWgSJBHb7WjD.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\ZZRIWgSJBHb7WjD.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\jldajglcipbfmlnmgfpeoenfnbnlianb\Fw8z.js
Filesize
6KB

MD5
144b2dac4a3f21e88bd28a3d7da5f3ee

SHA1
9c494039ee33567034791a088704fb6c788fb571

SHA256
25add330f6d610ca74a0eade95bd3ed687ca454330da14cb98fd9654934b751c

SHA512
300ecc3d5537b35a7bdf602cdabca3abbde0c99016f3b7e7c89507cd442dde4e12936b9c6bb66c5d626452c2d10a4eacce4025b188def01343f2cd5844f617c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\jldajglcipbfmlnmgfpeoenfnbnlianb\background.html
Filesize
141B

MD5
48d140173a91465dffa90bafef2b5036

SHA1
36e7199736aeea673b30b3d4abe46b240bda8749

SHA256
43dd09b0dbd3f0a039cecc1c406fd422c87746e2047a31caa59abe2ab0fb0230

SHA512
aa8f069e4aa4654b8a0b40ef4a2c5303d8614dffe5095dfe684e80060313da113f50a9e4ee0a189cca7418085891c1a17269fca37f701eaf9eab01bdc45e71d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\jldajglcipbfmlnmgfpeoenfnbnlianb\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\jldajglcipbfmlnmgfpeoenfnbnlianb\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA91.tmp\jldajglcipbfmlnmgfpeoenfnbnlianb\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1892-132-0x0000000000000000-mapping.dmp

Download