Analysis

  • max time kernel
    174s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 18:56

General

  • Target

    cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe

  • Size

    1.4MB

  • MD5

    f0c25fed7e5e2daaed69863ac7892ce4

  • SHA1

    2462299d2c1619c098831776aa631676edc0b40f

  • SHA256

    cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6

  • SHA512

    821ec108f54a766d723a765b964e1a5a12ac9d46d641d6e1fac58f3cf1078ba419bba5805a1f12a46f44465e825e861f9737e808508fea67e5c672fa61155617

  • SSDEEP

    24576:tS6fJHL4InjKF9JWkioht3BxfN+kOQc4qAgHxJqzn6j6YitfuEq0438XKotZZ9:t74QKF9EoPfNfOQc4lgHPqr6j6FOsbT

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Registers COM server for autorun 1 TTPs 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe
    "C:\Users\Admin\AppData\Local\Temp\cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Users\Admin\AppData\Local\Temp\17325d53\9OsR3.exe
      "C:\Users\Admin\AppData\Local\Temp/17325d53/9OsR3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5052
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\SaveClicker\wXCP.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\SaveClicker\wXCP.x64.dll"
          4⤵
          • Registers COM server for autorun
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:1304
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:420
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:3624

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\SaveClicker\wXCP.dat

        Filesize

        4KB

        MD5

        558ec4bc163a2779f932df6d72243e40

        SHA1

        3e7d2b3839e9b1980d5ae31d6831cb7ea92314df

        SHA256

        e6b77447ad9a55d9551fed335d5a9e28655a47291752668f9fe826eb46b50704

        SHA512

        8dc7d4d453ca8e1a6e1c0f980a3d87689d4e899654b588b554851c150f562e71f42d2af3240b96db1b435b07ce76cc556435a89e54108ce1d1ace7d4076fc901

      • C:\Program Files (x86)\SaveClicker\wXCP.dll

        Filesize

        325KB

        MD5

        d316153e6feea98b96650c4f05e2f31a

        SHA1

        21ef422afe7f9bcbd86f0381b296a8f2d2f66fe4

        SHA256

        c22e935a2b45bf48d94ee2f268b163d73b1b0c6c10f5ef6737591ec3da7c1578

        SHA512

        9a9752d3cb544c3cbad053aa93e44e95892094099181a15b40b8dcf200180eb72eadd4fb1cd6792434d20e60d9ae433370a47ed19753317078e51e616438514c

      • C:\Program Files (x86)\SaveClicker\wXCP.tlb

        Filesize

        3KB

        MD5

        736f8e927a2bc98863a50a76ac7a0973

        SHA1

        fe78f86dc43442192b9f4e56dfdb35e36d23cfbb

        SHA256

        b7fb683bbb4c444b7121ad4cb00a4b8f247ea32ee367a4d0bc6ea05e6803c45f

        SHA512

        321e777413ee96dd05b3c412fd90b0e78ea8a9550a8d7af27d7a1530302833c97eb7e41b018e7bb89e82c8987e2527094b88ac94b74a3b5cc4b8bea1a0ef287e

      • C:\Program Files (x86)\SaveClicker\wXCP.x64.dll

        Filesize

        389KB

        MD5

        7cd46176b71eda0ecb89413ed185e606

        SHA1

        58f24d30eb5251a553ec7dac81f3fc2398e3e63e

        SHA256

        b959f8550304467338e0b2975acf36b6c530e575d3cc6847f82fa7576fb86bb7

        SHA512

        217eee22ebf8ca536e49378a6c831f71e0bdf6ef637d14395e8e765a9f2e1b98bbda0a9bf273592dc9665d9e63f72aa58fd9dbd66ede56f8855ee500c67becdd

      • C:\Program Files (x86)\SaveClicker\wXCP.x64.dll

        Filesize

        389KB

        MD5

        7cd46176b71eda0ecb89413ed185e606

        SHA1

        58f24d30eb5251a553ec7dac81f3fc2398e3e63e

        SHA256

        b959f8550304467338e0b2975acf36b6c530e575d3cc6847f82fa7576fb86bb7

        SHA512

        217eee22ebf8ca536e49378a6c831f71e0bdf6ef637d14395e8e765a9f2e1b98bbda0a9bf273592dc9665d9e63f72aa58fd9dbd66ede56f8855ee500c67becdd

      • C:\Program Files (x86)\SaveClicker\wXCP.x64.dll

        Filesize

        389KB

        MD5

        7cd46176b71eda0ecb89413ed185e606

        SHA1

        58f24d30eb5251a553ec7dac81f3fc2398e3e63e

        SHA256

        b959f8550304467338e0b2975acf36b6c530e575d3cc6847f82fa7576fb86bb7

        SHA512

        217eee22ebf8ca536e49378a6c831f71e0bdf6ef637d14395e8e765a9f2e1b98bbda0a9bf273592dc9665d9e63f72aa58fd9dbd66ede56f8855ee500c67becdd

      • C:\Users\Admin\AppData\Local\Temp\17325d53\9OsR3.dat

        Filesize

        4KB

        MD5

        558ec4bc163a2779f932df6d72243e40

        SHA1

        3e7d2b3839e9b1980d5ae31d6831cb7ea92314df

        SHA256

        e6b77447ad9a55d9551fed335d5a9e28655a47291752668f9fe826eb46b50704

        SHA512

        8dc7d4d453ca8e1a6e1c0f980a3d87689d4e899654b588b554851c150f562e71f42d2af3240b96db1b435b07ce76cc556435a89e54108ce1d1ace7d4076fc901

      • C:\Users\Admin\AppData\Local\Temp\17325d53\9OsR3.exe

        Filesize

        564KB

        MD5

        0e40283546a07f8655a29d2dd0eb47b2

        SHA1

        708483119bf61e380a38df9b3d951ed9fef578d5

        SHA256

        175bc9c1241f15ae0a43f6b12fdc01337cb824c9b5ce6a51fdcbea7c4c98e323

        SHA512

        56adfd58ee0314b77d8351b6ec266ade8f0f59ccf6ac48f6641531733cc9b2b836f18a0ec2952d7e6a30bd18a320c3d1d796f6619e93ae449c6ccf3195514926

      • C:\Users\Admin\AppData\Local\Temp\17325d53\9OsR3.exe

        Filesize

        564KB

        MD5

        0e40283546a07f8655a29d2dd0eb47b2

        SHA1

        708483119bf61e380a38df9b3d951ed9fef578d5

        SHA256

        175bc9c1241f15ae0a43f6b12fdc01337cb824c9b5ce6a51fdcbea7c4c98e323

        SHA512

        56adfd58ee0314b77d8351b6ec266ade8f0f59ccf6ac48f6641531733cc9b2b836f18a0ec2952d7e6a30bd18a320c3d1d796f6619e93ae449c6ccf3195514926

      • C:\Users\Admin\AppData\Local\Temp\17325d53\dicolcmbpmkdcaakdfhakdnhodklmbhe\background.html

        Filesize

        146B

        MD5

        25c8ac01b346e43e6a5d26ea60b11618

        SHA1

        9da4ae63114e484f713bfe6624560bc050775c79

        SHA256

        7357ddba4b884cce725bbf079c703be32e42dab4f14c4c42d3f4ec1e0dc53082

        SHA512

        778cacb9e2f757b321687b65e947ecb2cea3984322ab60fa7ceeb6e26486b15837ea08c24da630a97ae40291310c05a8948b0c72223c26a1330566ed0eb4a582

      • C:\Users\Admin\AppData\Local\Temp\17325d53\dicolcmbpmkdcaakdfhakdnhodklmbhe\content.js

        Filesize

        144B

        MD5

        fca19198fd8af21016a8b1dec7980002

        SHA1

        fd01a47d14004e17a625efe66cc46a06c786cf40

        SHA256

        332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

        SHA512

        60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

      • C:\Users\Admin\AppData\Local\Temp\17325d53\dicolcmbpmkdcaakdfhakdnhodklmbhe\j2iHa7rFY.js

        Filesize

        5KB

        MD5

        e95d4e3cb620f4db30624df516801e36

        SHA1

        def0519a0f53dcea49f6a33d208d8f8eb6b824aa

        SHA256

        e94251bc68b616c5e41ffb09beeec7fa88a8716435b69778373929507166285a

        SHA512

        1a3c58029abf117e7fcc3ca69f0d074e4afd2d9dfe0fe9304bc3fe45e36478a9c50085aea76a9e8501c8875eee45bf8ad029390dd5d436356362ed12ccf8ae56

      • C:\Users\Admin\AppData\Local\Temp\17325d53\dicolcmbpmkdcaakdfhakdnhodklmbhe\lsdb.js

        Filesize

        531B

        MD5

        36d98318ab2b3b2585a30984db328afb

        SHA1

        f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

        SHA256

        ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

        SHA512

        6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

      • C:\Users\Admin\AppData\Local\Temp\17325d53\dicolcmbpmkdcaakdfhakdnhodklmbhe\manifest.json

        Filesize

        503B

        MD5

        aa6fc24e028b07a032fbc6f859819dca

        SHA1

        166f2c578c4f164da313ece0e914e56e053418c2

        SHA256

        2f026100e6faf41a63ea0c5d289914bfceba28094b32c9a3566a4932b7c71038

        SHA512

        4f5328b27ace6ec4d786e7369b8a071fedf46f30e0b1d223d8fa9332d1df60914f22b84725e3055c894f027f79f05dd91d47ae5c22bebaad34c0af440f634701

      • C:\Users\Admin\AppData\Local\Temp\17325d53\[email protected]\bootstrap.js

        Filesize

        2KB

        MD5

        df13f711e20e9c80171846d4f2f7ae06

        SHA1

        56d29cda58427efe0e21d3880d39eb1b0ef60bee

        SHA256

        6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

        SHA512

        6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

      • C:\Users\Admin\AppData\Local\Temp\17325d53\[email protected]\chrome.manifest

        Filesize

        25B

        MD5

        bf4e6c4808fb406d28937a29e4d24d85

        SHA1

        80f4eb9f3f27f0d790a95911043181c36c09fa88

        SHA256

        48b4922bf9e4d278bb5ff08a9894fd45866b232f4c035d69c3d124f43d4e4420

        SHA512

        a562815fa516f45fc60dbb4b4adad60b754d1cd97fac3a746a84e0ed8e162e6eb627b20fc6bafbad6aa7d432217151c9bf051b03a11ddc44d53a9f5ca6bdc9cd

      • C:\Users\Admin\AppData\Local\Temp\17325d53\[email protected]\content\bg.js

        Filesize

        7KB

        MD5

        b5637bc8cf8f5e7ec8aa3482f52857c3

        SHA1

        a38bf0bf115fa28498ce4cad14d461ba44112e2d

        SHA256

        28f68aaa8f49c4d54e9ff7a0e0b20d68b2fca96b1ba646c1857c684e677ea9d3

        SHA512

        470db88ebf5cc2cf13fc57e4be65892e25f9a6c20a09e12c5ff951066db1f56184738a1d8f51527142aeb4d37eb3adc114a218df327aefa45c5009f7a9500d44

      • C:\Users\Admin\AppData\Local\Temp\17325d53\[email protected]\install.rdf

        Filesize

        607B

        MD5

        b0a362e7cea1b548bf555e363de1f1ef

        SHA1

        9508c12fb8cb6cec4edb5d50ae91ec3dd25cd780

        SHA256

        a3769a54c2cbe4faf88f681c2bfba894c565fe145ad2663a2cda7a7257d68a1f

        SHA512

        a18267d42da37cacaed7537df82965739dccb83279a7edf76bace34cc967296ef3e0d8c9336779b143bb5cd6586c0ce75f23e9f6b482a6cb400bda551e1ae370

      • C:\Users\Admin\AppData\Local\Temp\17325d53\wXCP.dll

        Filesize

        325KB

        MD5

        d316153e6feea98b96650c4f05e2f31a

        SHA1

        21ef422afe7f9bcbd86f0381b296a8f2d2f66fe4

        SHA256

        c22e935a2b45bf48d94ee2f268b163d73b1b0c6c10f5ef6737591ec3da7c1578

        SHA512

        9a9752d3cb544c3cbad053aa93e44e95892094099181a15b40b8dcf200180eb72eadd4fb1cd6792434d20e60d9ae433370a47ed19753317078e51e616438514c

      • C:\Users\Admin\AppData\Local\Temp\17325d53\wXCP.tlb

        Filesize

        3KB

        MD5

        736f8e927a2bc98863a50a76ac7a0973

        SHA1

        fe78f86dc43442192b9f4e56dfdb35e36d23cfbb

        SHA256

        b7fb683bbb4c444b7121ad4cb00a4b8f247ea32ee367a4d0bc6ea05e6803c45f

        SHA512

        321e777413ee96dd05b3c412fd90b0e78ea8a9550a8d7af27d7a1530302833c97eb7e41b018e7bb89e82c8987e2527094b88ac94b74a3b5cc4b8bea1a0ef287e

      • C:\Users\Admin\AppData\Local\Temp\17325d53\wXCP.x64.dll

        Filesize

        389KB

        MD5

        7cd46176b71eda0ecb89413ed185e606

        SHA1

        58f24d30eb5251a553ec7dac81f3fc2398e3e63e

        SHA256

        b959f8550304467338e0b2975acf36b6c530e575d3cc6847f82fa7576fb86bb7

        SHA512

        217eee22ebf8ca536e49378a6c831f71e0bdf6ef637d14395e8e765a9f2e1b98bbda0a9bf273592dc9665d9e63f72aa58fd9dbd66ede56f8855ee500c67becdd

      • memory/1304-152-0x0000000000000000-mapping.dmp

      • memory/2024-149-0x0000000000000000-mapping.dmp

      • memory/5052-132-0x0000000000000000-mapping.dmp