Analysis
-
max time kernel
204s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2.exe
Resource
win7-20221111-en
General
-
Target
cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2.exe
-
Size
931KB
-
MD5
f3bdc5dc8ecec027250c4259ae77cc91
-
SHA1
c0cd4f80a4176b7be48a9092e85b4924c770b184
-
SHA256
cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2
-
SHA512
6cbfa873ffb2c9b728fb774deac96071f79da1e00fe00131fa1779de94f6fbfae87f857ade32c3505a7a52a810407582b406871c5a53a98a6d264b4800700811
-
SSDEEP
24576:h1OYdaO8CZ/iWCvu/2sWsJA/jlt+DHhsk:h1OsqCpYO/dJJDHhsk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
8XWY5ZNAkadeH9z.exepid process 1716 8XWY5ZNAkadeH9z.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
8XWY5ZNAkadeH9z.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmaaanfapcdbebjbpggndckpkbokplik\2.0\manifest.json 8XWY5ZNAkadeH9z.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmaaanfapcdbebjbpggndckpkbokplik\2.0\manifest.json 8XWY5ZNAkadeH9z.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmaaanfapcdbebjbpggndckpkbokplik\2.0\manifest.json 8XWY5ZNAkadeH9z.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmaaanfapcdbebjbpggndckpkbokplik\2.0\manifest.json 8XWY5ZNAkadeH9z.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmaaanfapcdbebjbpggndckpkbokplik\2.0\manifest.json 8XWY5ZNAkadeH9z.exe -
Drops file in System32 directory 4 IoCs
Processes:
8XWY5ZNAkadeH9z.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 8XWY5ZNAkadeH9z.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 8XWY5ZNAkadeH9z.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 8XWY5ZNAkadeH9z.exe File opened for modification C:\Windows\System32\GroupPolicy 8XWY5ZNAkadeH9z.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
8XWY5ZNAkadeH9z.exepid process 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe 1716 8XWY5ZNAkadeH9z.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
8XWY5ZNAkadeH9z.exedescription pid process Token: SeDebugPrivilege 1716 8XWY5ZNAkadeH9z.exe Token: SeDebugPrivilege 1716 8XWY5ZNAkadeH9z.exe Token: SeDebugPrivilege 1716 8XWY5ZNAkadeH9z.exe Token: SeDebugPrivilege 1716 8XWY5ZNAkadeH9z.exe Token: SeDebugPrivilege 1716 8XWY5ZNAkadeH9z.exe Token: SeDebugPrivilege 1716 8XWY5ZNAkadeH9z.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2.exedescription pid process target process PID 664 wrote to memory of 1716 664 cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2.exe 8XWY5ZNAkadeH9z.exe PID 664 wrote to memory of 1716 664 cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2.exe 8XWY5ZNAkadeH9z.exe PID 664 wrote to memory of 1716 664 cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2.exe 8XWY5ZNAkadeH9z.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2.exe"C:\Users\Admin\AppData\Local\Temp\cf3a16a1dac4827dbf12157f89268a1666121f6709468a251d847491d0f22be2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\8XWY5ZNAkadeH9z.exe.\8XWY5ZNAkadeH9z.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\8XWY5ZNAkadeH9z.datFilesize
1KB
MD50d86555f14a7bcfcb73394067578d458
SHA1b8bd739a529bfb855793a7b3a6a472752c3ba5c9
SHA2564cdbbef588b7b804033c51f7556cf5abbbf7a43630b56c20159ac67aebb42e15
SHA512489f7b12f80efc53d28dca4948fe98edcdb288a084053013f47064fa541f2746e41962b0b4fc1ef0c6e92fca6fac24a0666bff086f4e2a3dbd3e8bdc144e7f85
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\8XWY5ZNAkadeH9z.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\8XWY5ZNAkadeH9z.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\G@72q29.org\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\G@72q29.org\chrome.manifestFilesize
35B
MD540dc007566a3599689d66c026ca14928
SHA1213f3b01028c940702744ca0572ae395536ea11c
SHA256ec0ea94e6f4b7dc96181812be4758e3e3bc18bf75ecc6d4522c66cfc4362d01e
SHA512dd429dedcfb9f4c3bfd5066b32c7f534b57c285c88bb4aa64e856edf730417427a362a265fab22b5edbff30a48aff6580a102cceb533bd51b3499eda9f9f616d
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\G@72q29.org\content\bg.jsFilesize
8KB
MD5b0160c91d41718f9cd2cdd1042f0c640
SHA151c65f47380cb19dfb4b90f516b366ca5f7d12ca
SHA256b71da9a59b689c136164db6d2d671237dfe2f077a0a347ebe76af790fd25495a
SHA512a2a15dde80c7dedd7f4a43d279553f3bfea23572e40e50a1a42d201ca62a1856aa5bf3a9c2f3fdfa9dea77ba130565e79f20fd021a483b7fd0d5974daa4a2f2b
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\G@72q29.org\install.rdfFilesize
593B
MD5755ce4e05ff18cdd630d0869ac51387c
SHA1338a6d8359888f6ce52535e315b73ee7ffcc4ee3
SHA256c4d40bfee09b21053ae3a72511b413f5da10075fb57edfd410e09d1b0e2d5f8f
SHA512acbd51d453bbd146341f5a797dbb41e78a46445844b2e2ccd9a1171da41ddb8b93c3b3f3897939643e30251b5d705c882ec945297e3a317362c4d48fb77e1982
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\fmaaanfapcdbebjbpggndckpkbokplik\background.htmlFilesize
138B
MD5d99a69e7af5e44c1cf1fffe0d67d3f2a
SHA18d6cf935f6456af0de1646eae987f11d9c5d3cf2
SHA256cb915bedd6a24cb3a26f17d3c9502a700f0c2ee95b122119d66b6f2c0558be85
SHA512f242215d3090d5ab087638a523f660a086d8d7a5c98561cfb5059b1162cfdca4f54804a01832bd09d0ef0eea831b4841f787097e5a1d191ceda5ce0870e79846
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\fmaaanfapcdbebjbpggndckpkbokplik\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\fmaaanfapcdbebjbpggndckpkbokplik\g.jsFilesize
6KB
MD5dea5a1b20e658b1b9216eada82f01286
SHA12abe2e0c7175aae4f8ee7af88a1027bb1056fdad
SHA256e9f7953f13d5fd9ba32da4a29b8b3b67e23ef8577f0fd033b3c81449383109f8
SHA5121d79c566facd6bcca64c2a6c6f2b70470977c1aa876ea7afc727f9b4318640c506a54a4d5e348fd21307959339bcee0739607a17fa9c5d11936768c997b9faea
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\fmaaanfapcdbebjbpggndckpkbokplik\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS6BCA.tmp\fmaaanfapcdbebjbpggndckpkbokplik\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/1716-132-0x0000000000000000-mapping.dmp