ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280

Analysis

max time kernel
193s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280.exe
Size

2.5MB
MD5

a27758cdb52ab6ebace14db19a72b6af
SHA1

b35bdd878be7caaef7bccdb5ccf9ff748a0ef51d
SHA256

ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280
SHA512

3c5b788e1bb9cf45cdbef6dfda69632e682fe41a7e1a8720a685d073f958a98f36269276894a81690847310933f7e74f8a4e716f3aa4a04031ebb0510a383416
SSDEEP

49152:h1Os0CpYO/dJJDHhs6oxRkNfehWfNs4VGufZ9JODSTz4bk1:h1O6ly7kNfrNq41

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ZxPuOlooCqZ6u72.exe

pid process

4944 ZxPuOlooCqZ6u72.exe
Loads dropped DLL 3 IoCs

Processes:

ZxPuOlooCqZ6u72.exeregsvr32.exeregsvr32.exe

pid process

4944 ZxPuOlooCqZ6u72.exe
224 regsvr32.exe
3476 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4944	ZxPuOlooCqZ6u72.exe

pid	process
4944	ZxPuOlooCqZ6u72.exe
224	regsvr32.exe
3476	regsvr32.exe

Drops Chrome extension 5 IoCs

Processes:

ZxPuOlooCqZ6u72.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmhmpehgcnnnfeekbbkpmlkocfgjleog\200\manifest.json	ZxPuOlooCqZ6u72.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmhmpehgcnnnfeekbbkpmlkocfgjleog\200\manifest.json	ZxPuOlooCqZ6u72.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmhmpehgcnnnfeekbbkpmlkocfgjleog\200\manifest.json	ZxPuOlooCqZ6u72.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmhmpehgcnnnfeekbbkpmlkocfgjleog\200\manifest.json	ZxPuOlooCqZ6u72.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmhmpehgcnnnfeekbbkpmlkocfgjleog\200\manifest.json	ZxPuOlooCqZ6u72.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

ZxPuOlooCqZ6u72.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	ZxPuOlooCqZ6u72.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	ZxPuOlooCqZ6u72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	ZxPuOlooCqZ6u72.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	ZxPuOlooCqZ6u72.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe

Drops file in Program Files directory 8 IoCs

Processes:

ZxPuOlooCqZ6u72.exe

description	ioc	process
File created	C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.dll	ZxPuOlooCqZ6u72.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.dll	ZxPuOlooCqZ6u72.exe
File created	C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.tlb	ZxPuOlooCqZ6u72.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.tlb	ZxPuOlooCqZ6u72.exe
File created	C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.dat	ZxPuOlooCqZ6u72.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.dat	ZxPuOlooCqZ6u72.exe
File created	C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.x64.dll	ZxPuOlooCqZ6u72.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.x64.dll	ZxPuOlooCqZ6u72.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ZxPuOlooCqZ6u72.exe

pid process

4944 ZxPuOlooCqZ6u72.exe
4944 ZxPuOlooCqZ6u72.exe

pid	process
4944	ZxPuOlooCqZ6u72.exe
4944	ZxPuOlooCqZ6u72.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280.exeZxPuOlooCqZ6u72.exeregsvr32.exe

description	pid	process	target process
PID 1524 wrote to memory of 4944	1524	ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280.exe	ZxPuOlooCqZ6u72.exe
PID 1524 wrote to memory of 4944	1524	ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280.exe	ZxPuOlooCqZ6u72.exe
PID 1524 wrote to memory of 4944	1524	ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280.exe	ZxPuOlooCqZ6u72.exe
PID 4944 wrote to memory of 224	4944	ZxPuOlooCqZ6u72.exe	regsvr32.exe
PID 4944 wrote to memory of 224	4944	ZxPuOlooCqZ6u72.exe	regsvr32.exe
PID 4944 wrote to memory of 224	4944	ZxPuOlooCqZ6u72.exe	regsvr32.exe
PID 224 wrote to memory of 3476	224	regsvr32.exe	regsvr32.exe
PID 224 wrote to memory of 3476	224	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280.exe
"C:\Users\Admin\AppData\Local\Temp\ca22bc6fab3f404efbc9c9aff749335b102a7785f3638296f4be25e43e1cd280.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\ZxPuOlooCqZ6u72.exe
.\ZxPuOlooCqZ6u72.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.x64.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.x64.dll"
4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:3476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.dat
Filesize
6KB

MD5
ce4c6bcc74b07fe779632809e4dbb6c9

SHA1
3ef998aa0267a2295149dfdf1450fb2205266c6c

SHA256
60ee0c5bfd3d54c754bcfeed76d0230d914cecac8d6aca258a2bb99f56650d22

SHA512
5c1fea74408e251a18e0d49c331c85f948b87dbe34a2c3ec779c05e70c834b72c559f68883ce99a9fe11bd09a78871240c00c559d669fe9a68f542677ebf1661

Download Submit
C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.dll
Filesize
738KB

MD5
49961c7c9a7aef57f49adf50d1c810f6

SHA1
fc2078aeff5d5abee27c9e8a500cb2d6ae755b05

SHA256
c80abdc502d18db54137edc2680a498402c765999814b7fe1b2a7b69a64ce846

SHA512
8ad2c3dbd3b4390e4c49561f25ff2acdd4ab4468074e213f3efc81a598f71620e8f21fc87114623a6c0509997e47e1c4f5ffe703c7421ae313f7ba536df2772f

Download Submit
C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.x64.dll
Filesize
872KB

MD5
337b97dbbcc7ad4d75fb5a90652e6de3

SHA1
50e50243af1819e62a7512d85e6dd67b8e1ed103

SHA256
b501a7a1e233ac26b0ba2fbbf54cbb782f98bc5484537e584fcbf4dcf5cc3f0c

SHA512
dab62835e885457c481d7ee4d76c1bc89278d5dc22178301629c78ad3215e1a4627a95f50b03587d8978e85cbba829f31acedf21c23773f5c526b0f76c8cf09e

Download Submit
C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.x64.dll
Filesize
872KB

MD5
337b97dbbcc7ad4d75fb5a90652e6de3

SHA1
50e50243af1819e62a7512d85e6dd67b8e1ed103

SHA256
b501a7a1e233ac26b0ba2fbbf54cbb782f98bc5484537e584fcbf4dcf5cc3f0c

SHA512
dab62835e885457c481d7ee4d76c1bc89278d5dc22178301629c78ad3215e1a4627a95f50b03587d8978e85cbba829f31acedf21c23773f5c526b0f76c8cf09e

Download Submit
C:\Program Files (x86)\Browser Shop\pJOrNL9FCOWs22.x64.dll
Filesize
872KB

MD5
337b97dbbcc7ad4d75fb5a90652e6de3

SHA1
50e50243af1819e62a7512d85e6dd67b8e1ed103

SHA256
b501a7a1e233ac26b0ba2fbbf54cbb782f98bc5484537e584fcbf4dcf5cc3f0c

SHA512
dab62835e885457c481d7ee4d76c1bc89278d5dc22178301629c78ad3215e1a4627a95f50b03587d8978e85cbba829f31acedf21c23773f5c526b0f76c8cf09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\ZxPuOlooCqZ6u72.dat
Filesize
6KB

MD5
ce4c6bcc74b07fe779632809e4dbb6c9

SHA1
3ef998aa0267a2295149dfdf1450fb2205266c6c

SHA256
60ee0c5bfd3d54c754bcfeed76d0230d914cecac8d6aca258a2bb99f56650d22

SHA512
5c1fea74408e251a18e0d49c331c85f948b87dbe34a2c3ec779c05e70c834b72c559f68883ce99a9fe11bd09a78871240c00c559d669fe9a68f542677ebf1661

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\ZxPuOlooCqZ6u72.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\ZxPuOlooCqZ6u72.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\dmhmpehgcnnnfeekbbkpmlkocfgjleog\I.js
Filesize
5KB

MD5
abc7c791fc1230ec4dea021386eca0f9

SHA1
fe703de09b12a28928ec4c4da4ae85a59c6c5ac5

SHA256
f0e801432fbb09b734166f57ce7161b75c8679f6b9968a95e979d2a0366426a4

SHA512
ba1c0f33b925849b15d4caf8c040d93378a3155a6b4dd3b59244251631055f1b4c420798917be408e3969d5abed633d9bb23cbf88ddd322713ac6b9e71f61695

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\dmhmpehgcnnnfeekbbkpmlkocfgjleog\background.html
Filesize
138B

MD5
ea50135f334b15a15b3e07740f71e919

SHA1
7ad7d07cb16f590b468bd5356c12994954f58c92

SHA256
623dc65e91d7a9b2aef1866029423203ee69a6f7b0fefe440ab3aaaaa4396b02

SHA512
1105f6d5864ef2afe8ff871e545622750e460e296c0a4a936ce5c9d83e140259eebad727427243fca3f544e541ee2831b31f57ceddb17cfdc1c44479944b8d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\dmhmpehgcnnnfeekbbkpmlkocfgjleog\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\dmhmpehgcnnnfeekbbkpmlkocfgjleog\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\dmhmpehgcnnnfeekbbkpmlkocfgjleog\manifest.json
Filesize
504B

MD5
d532994175ac6e4e8fea2ae07edef6ff

SHA1
5646eab3cebc8b0a804103b63f08a63db784a77d

SHA256
f9a190f8cfafdeddfe9627366bcd108e42b7fa07c8d074f1570bd77489f39c4d

SHA512
ba6ddc11423c0b0d93de3e3ecb9eeebe29470723282165aa67de4329a5f9af7e390869a7cbd0834c1ff115a1ed0a274bed686b4b6630e98b268ec1f2a9a8dadb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\pJOrNL9FCOWs22.dll
Filesize
738KB

MD5
49961c7c9a7aef57f49adf50d1c810f6

SHA1
fc2078aeff5d5abee27c9e8a500cb2d6ae755b05

SHA256
c80abdc502d18db54137edc2680a498402c765999814b7fe1b2a7b69a64ce846

SHA512
8ad2c3dbd3b4390e4c49561f25ff2acdd4ab4468074e213f3efc81a598f71620e8f21fc87114623a6c0509997e47e1c4f5ffe703c7421ae313f7ba536df2772f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\pJOrNL9FCOWs22.tlb
Filesize
3KB

MD5
e3ab22d8beac0180520ab5289a64419b

SHA1
1456ba2c78b293e5a80185fefdf05f5dbe424937

SHA256
0d3342857b67678dd76e6a24e137f0d75ba399bb48bf5095d7e4f7dfa0bbe416

SHA512
c04163026ffa1c6fab34b4fdbf23702148c7c2a31dd356d26f9541027db078b6433aff3a5f749a209a3acbcf3a853a9b5f77984540e21be1f823ce92bcbfc4bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\pJOrNL9FCOWs22.x64.dll
Filesize
872KB

MD5
337b97dbbcc7ad4d75fb5a90652e6de3

SHA1
50e50243af1819e62a7512d85e6dd67b8e1ed103

SHA256
b501a7a1e233ac26b0ba2fbbf54cbb782f98bc5484537e584fcbf4dcf5cc3f0c

SHA512
dab62835e885457c481d7ee4d76c1bc89278d5dc22178301629c78ad3215e1a4627a95f50b03587d8978e85cbba829f31acedf21c23773f5c526b0f76c8cf09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\uJe7Fa3@t.net\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\uJe7Fa3@t.net\chrome.manifest
Filesize
35B

MD5
8b7a3a1774743278941a74987f1bb881

SHA1
7fc2f43c99f739ea9eb3c248e27585174cb21e6a

SHA256
7c43403f1f69194eca7698b89d5866a1f0f1747b4132990dbf6199bc867f0904

SHA512
78ffd18c503da126709886017b4072b7296d13349a25a4be1708b8a6432307d8abe4aaa5113b93278cb5b47247518de9fe6cb82353db6b35da5b5788b0bae592

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\uJe7Fa3@t.net\content\bg.js
Filesize
7KB

MD5
10c5f52f23ebeeac8d2f8b7ceeef0e37

SHA1
57fa08fcad67311208055b45ad10df7088fe32fb

SHA256
dddc8f880365e320434a40dc776efdf57052dfa8c5c953cf7d511ce7439a936b

SHA512
871b8b525665b42cdd491995d286df9b81cd345e8b25efdaf6f053cc3ac2a3ff6582b3acedaafa02e9903acd2e7bff355125e3ea30680bb0b2db4a527d0da239

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C7A.tmp\uJe7Fa3@t.net\install.rdf
Filesize
601B

MD5
8a44ac74b8e0bc945ae0ad7639e26a10

SHA1
7a50dfa5c34778924508cf206b93cb9d78ff1495

SHA256
0bd9a2b416036f8a7cf9a2c9cd5b2df998a3e166790cbf8f84e171b96c9809cb

SHA512
9341287121301f3e2a577b35c8f54f0199d4de5d1e44230bd584793417a0f962dce5dfc543d22551586b4fc721b7f5c55cd1b6d5188a4097e7ee27f48a722099

Download Submit
memory/224-149-0x0000000000000000-mapping.dmp

Download
memory/3476-152-0x0000000000000000-mapping.dmp

Download
memory/4944-132-0x0000000000000000-mapping.dmp

Download