c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0.exe
Size

932KB
MD5

bf01fd4b0e9ade21049336239510dc33
SHA1

282805163d06e61883602290e802210b2eadbda1
SHA256

c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0
SHA512

3da26e47b3fe98e6483475f2fad1fc5060f69077610acbfb6b076480c4a1a0336e6cc335d3f8505f214cfc2cca0fe025bba5f011404a818e1b2ed93677088eb9
SSDEEP

24576:h1OYdaO9CZ/iWCvu/2sWsJA/jlt+DHhs5:h1OszCpYO/dJJDHhs5

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

I3wevHTpvweqjmd.exe

pid process

4232 I3wevHTpvweqjmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

I3wevHTpvweqjmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\2.0\manifest.json	I3wevHTpvweqjmd.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\2.0\manifest.json	I3wevHTpvweqjmd.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\2.0\manifest.json	I3wevHTpvweqjmd.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\2.0\manifest.json	I3wevHTpvweqjmd.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\2.0\manifest.json	I3wevHTpvweqjmd.exe

Drops file in System32 directory 4 IoCs

Processes:

I3wevHTpvweqjmd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	I3wevHTpvweqjmd.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	I3wevHTpvweqjmd.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	I3wevHTpvweqjmd.exe
File opened for modification	C:\Windows\System32\GroupPolicy	I3wevHTpvweqjmd.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

I3wevHTpvweqjmd.exe

pid	process
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe
4232	I3wevHTpvweqjmd.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

I3wevHTpvweqjmd.exe

description	pid	process
Token: SeDebugPrivilege	4232	I3wevHTpvweqjmd.exe
Token: SeDebugPrivilege	4232	I3wevHTpvweqjmd.exe
Token: SeDebugPrivilege	4232	I3wevHTpvweqjmd.exe
Token: SeDebugPrivilege	4232	I3wevHTpvweqjmd.exe
Token: SeDebugPrivilege	4232	I3wevHTpvweqjmd.exe
Token: SeDebugPrivilege	4232	I3wevHTpvweqjmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0.exe

description	pid	process	target process
PID 4660 wrote to memory of 4232	4660	c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0.exe	I3wevHTpvweqjmd.exe
PID 4660 wrote to memory of 4232	4660	c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0.exe	I3wevHTpvweqjmd.exe
PID 4660 wrote to memory of 4232	4660	c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0.exe	I3wevHTpvweqjmd.exe

C:\Users\Admin\AppData\Local\Temp\c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0.exe
"C:\Users\Admin\AppData\Local\Temp\c4fef886aa160025abd49ce6c58e19c24caaf0297a8ce2630f81945e5eea38e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660

C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\I3wevHTpvweqjmd.exe
.\I3wevHTpvweqjmd.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
62c41f5a5ba72145916ff11eaea028bd

SHA1
580038a211b8830296eff572fcb2f6c0e590fa65

SHA256
1fa2a5adb85387c41fca15c1062de8428c038fd75492bc989a8957ec478c668a

SHA512
1ea6c30bbd46f6e2c6169db8e5730f0a12813c9c83a367a241233689d7dae3a6759777afa838610b2fdb3ac44247c053d026ad86a38c6dbad983850534bf6a01

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
1c540f1387a6e7e7897ec8f1392a16d8

SHA1
3ca8f38d4c5ed61142e58f28d96ebbdde4ac31d6

SHA256
da003df44698b3697f322ec5189e484808082ec65a5aa2aba5b895835957c31c

SHA512
c7038e944215b29a8d21da2e0a4bc186483f80424ece2942b46b7ee71e6699a5a08ad854f66e7e18cdea4b5987311d937eeb6fe8136fe194e35e60e63db0c5ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\[email protected]\install.rdf
Filesize
591B

MD5
d9f5967e597ea901f4a1362b06dd7659

SHA1
4f68e674358d21593e0944919cf70bc915079568

SHA256
238285fb3f93ae34e719a02b04f3c1fb2f34f1f8f78dd18b61f6ef39bd62962d

SHA512
9413f3d9409f7a137f83008766172c4b6ce96b2fbf854f4fcfe7ed04e0b534474a1277870340459ad67c4fe1f9dbd3f1257643fa48868925cd0ee612047cdad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\I3wevHTpvweqjmd.dat
Filesize
1KB

MD5
82ff3d278e8e3b2b71bcb5edc9747627

SHA1
a467a3d714969b633380b7bfb66db08c2e7310ea

SHA256
27d41f37e940332fde120806de36fb8e250c0b3026fc171a5bacf63eb61edab1

SHA512
542a2f168adfdc9408f94104f3136fff948155a47a46ff054a597ed7fe3ad52aee7c375e6eb2c9a7337294b153a8972f0efef407ca1c0814a47dd1b3591108a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\I3wevHTpvweqjmd.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\I3wevHTpvweqjmd.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\IIfoGdlsa.js
Filesize
6KB

MD5
1b8ba9c8511534d7d619604c06a41ac7

SHA1
7c162dfe6592e8f826c806cd524d872a2535aa72

SHA256
eb703d7420b3cd2f4c9dd20da4c05ce24df554f808547b65444c985e86011c59

SHA512
0ab90dce2c7e4dbf62ca3f4f733ee1cb18d38d56744e0625e2e3c33f7b2d4a3ae5011ddd5825997dc6453646959d1ea67558d5bc5f038c0efdd76377155f191b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\background.html
Filesize
146B

MD5
9ec8b6b95d8b90ee63eb76354995d46c

SHA1
dfd6ddd3ca8b126788f825f3272850f29d0452bb

SHA256
225c243d4e5aac754595d28fbe23e5e81c97588cd31be93e1eb095d4ff062d9b

SHA512
7035cc3e02acdde09d0a88310df357854e0bdb2a62c053409392becf6ba0329844a922fa154a6a42fc27966c05c00292cad6567d805826353e3b096fe4fda8f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFA2.tmp\hdfdbccjibpgpdlhgpfaonmjnjcgldjb\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4232-132-0x0000000000000000-mapping.dmp

Download