Analysis
-
max time kernel
244s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe
Resource
win7-20221111-en
General
-
Target
c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe
-
Size
920KB
-
MD5
64271621f260a23006355a1dba5c1f15
-
SHA1
0c85757fb555bd955a2624b2bd5f71b5b396430d
-
SHA256
c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036
-
SHA512
2e4ff6efbb8d2fa2b191c56c6577ac5870d463afef79f003a91586f66780272acb9b57ea02d5cad5c0e0d81157b77838d8b78c909867f1a522caa67e9cd7cc6c
-
SSDEEP
24576:h1OYdaOTMtdHAqcdDVhYwiei7+EpFAh/kKQ:h1OsuPHVmVhYwiLtKkKQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MAVOvCfCV5iDFLp.exepid process 1504 MAVOvCfCV5iDFLp.exe -
Loads dropped DLL 1 IoCs
Processes:
c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exepid process 556 c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
MAVOvCfCV5iDFLp.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhnhhelmpliiknhdloobncikdbpocdpa\2.0\manifest.json MAVOvCfCV5iDFLp.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhnhhelmpliiknhdloobncikdbpocdpa\2.0\manifest.json MAVOvCfCV5iDFLp.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhnhhelmpliiknhdloobncikdbpocdpa\2.0\manifest.json MAVOvCfCV5iDFLp.exe -
Drops file in System32 directory 4 IoCs
Processes:
MAVOvCfCV5iDFLp.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy MAVOvCfCV5iDFLp.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini MAVOvCfCV5iDFLp.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol MAVOvCfCV5iDFLp.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI MAVOvCfCV5iDFLp.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
MAVOvCfCV5iDFLp.exepid process 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe 1504 MAVOvCfCV5iDFLp.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
MAVOvCfCV5iDFLp.exedescription pid process Token: SeDebugPrivilege 1504 MAVOvCfCV5iDFLp.exe Token: SeDebugPrivilege 1504 MAVOvCfCV5iDFLp.exe Token: SeDebugPrivilege 1504 MAVOvCfCV5iDFLp.exe Token: SeDebugPrivilege 1504 MAVOvCfCV5iDFLp.exe Token: SeDebugPrivilege 1504 MAVOvCfCV5iDFLp.exe Token: SeDebugPrivilege 1504 MAVOvCfCV5iDFLp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exedescription pid process target process PID 556 wrote to memory of 1504 556 c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe MAVOvCfCV5iDFLp.exe PID 556 wrote to memory of 1504 556 c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe MAVOvCfCV5iDFLp.exe PID 556 wrote to memory of 1504 556 c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe MAVOvCfCV5iDFLp.exe PID 556 wrote to memory of 1504 556 c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe MAVOvCfCV5iDFLp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe"C:\Users\Admin\AppData\Local\Temp\c65b1fc1bb2010e09cb2f58f909b66bbf99513ad7c9cf33ac4a5152903c68036.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\MAVOvCfCV5iDFLp.exe.\MAVOvCfCV5iDFLp.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\Gb@kBWg.org\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\Gb@kBWg.org\chrome.manifestFilesize
35B
MD5aa7be2c7a606653c941f259ca57609b0
SHA1f18f9cd704426d324c0c43f62604b4d48676c583
SHA2561204f2cf5d60d4b38ff2ea3d9e149bbd5fc03b54de96f611ed617787ecac373a
SHA512e2a082266099123736d12d7d5c270914e50debfa0e9bb1ee813cbd935202aff8216a1d6937e124556670fca377e78c6fc62ecde40c4b21de4f01b33d5b6bc18b
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\Gb@kBWg.org\content\bg.jsFilesize
8KB
MD5aab7f06eba1bd5983967e677a0654cc7
SHA119e79e71c8d6379b10524452bc0b3c0f2d608f8a
SHA256edaf11b0c7da9bf508fb7c69483e3bfd5e1a485a671703365baf66aa566c9ea9
SHA512206ffd89afb1c844f7ad0e36606dde9c8fdcb622c7f814bba0d535d4c0064343e82fe01df25096a211fb4c9dcfc209f9d6b6f115c502b4d88ffda01453d86546
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\Gb@kBWg.org\install.rdfFilesize
593B
MD59e44d8c7f3bf0fe3da5faff4503eed50
SHA168263c5cd968b04e419fe611372bbc5a2ed61a74
SHA25649cc200f59b24d81028f08920c1d1dcda7f0191a02142b25807f88dc13c1fef5
SHA512727a10da33617a2cf91def72bdc9631a0dbf0b9f7d4c82dffa249954084acb2233862a99f976bf9d548adf38e7d2a9093b443f91cb240bededa4c8b3a786d1ea
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\MAVOvCfCV5iDFLp.datFilesize
1KB
MD5f12b1986a855d3a91803bcb1cc300016
SHA1a3c3397c626f95a8b4cdfb3e61d58cbd1adb7c08
SHA25656489df7b98a5f3163ec2053877d4cd5ba7b8754a0df186980d58b4d39146b05
SHA51205616c524b4e317622799b7db1d30061be850ddd0227566265320d09efe2da562a1b86cfe33d1e975ae232a0163e81bf5e32cacb649ee8ca5cea5c0b3c83d847
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\MAVOvCfCV5iDFLp.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\jhnhhelmpliiknhdloobncikdbpocdpa\background.htmlFilesize
144B
MD57a59f21b2100464ba018e321e8c38569
SHA1a2440681abc062f2a86751ea22a91fd8968d7173
SHA25681b24a5f7b3fe038685b593991ae4172ea6ce5c9a511156d7b59f17b77c392ab
SHA512e960c831543fb568146dd92ae04090da1d87d7523f9a1501c56b34e76eacd2502ac895c93f13ba51695a6948cd664297e5beaccfa311437116e4e937cffd9686
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\jhnhhelmpliiknhdloobncikdbpocdpa\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\jhnhhelmpliiknhdloobncikdbpocdpa\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\jhnhhelmpliiknhdloobncikdbpocdpa\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\jhnhhelmpliiknhdloobncikdbpocdpa\yTlE65M.jsFilesize
6KB
MD57a9fbc88f0ccd72da673124243711096
SHA15913f2b1da3feff9bc8b0430e0ebc8e5bbd77206
SHA256924cf14336f54317ebfae2a8a042568e1101d2c482b1730863e5ebb990dab60e
SHA5126689e15e5bb661671f13e33941cedaa5c6d4552b385bbe547a7d6d869dc3ac347ed7adb0d416c0d21b9f1a9be54026df5a454d5e7c92682f8daa0e0e14c5ee05
-
\Users\Admin\AppData\Local\Temp\7zSECD0.tmp\MAVOvCfCV5iDFLp.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/556-54-0x0000000075441000-0x0000000075443000-memory.dmpFilesize
8KB
-
memory/1504-56-0x0000000000000000-mapping.dmp