Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:16
Static task
static1
Behavioral task
behavioral1
Sample
ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc.exe
Resource
win7-20220812-en
General
-
Target
ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc.exe
-
Size
931KB
-
MD5
9942461ee5fca4054f920822e307af4f
-
SHA1
4fe9d98dec0e40969b460c563470abd13b1402ef
-
SHA256
ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc
-
SHA512
ed1b73fe7e2626a5819dc81963c6d9f12dc6f198219541432309a7015a8bb695428971b8adf2ea97dcd35fe018715168365a8da2e996768e4950003c4ad11ebc
-
SSDEEP
24576:h1OYdaOyCZ/iWCvu/2sWsJA/jlt+DHhs/:h1OsECpYO/dJJDHhs/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
hpSM1R58xLeraVh.exepid process 1512 hpSM1R58xLeraVh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
hpSM1R58xLeraVh.exedescription ioc process File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahbhhalnpidphdpeocdlbbjkagcfbcpa\2.0\manifest.json hpSM1R58xLeraVh.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahbhhalnpidphdpeocdlbbjkagcfbcpa\2.0\manifest.json hpSM1R58xLeraVh.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahbhhalnpidphdpeocdlbbjkagcfbcpa\2.0\manifest.json hpSM1R58xLeraVh.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahbhhalnpidphdpeocdlbbjkagcfbcpa\2.0\manifest.json hpSM1R58xLeraVh.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahbhhalnpidphdpeocdlbbjkagcfbcpa\2.0\manifest.json hpSM1R58xLeraVh.exe -
Drops file in System32 directory 4 IoCs
Processes:
hpSM1R58xLeraVh.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy hpSM1R58xLeraVh.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini hpSM1R58xLeraVh.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol hpSM1R58xLeraVh.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI hpSM1R58xLeraVh.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
hpSM1R58xLeraVh.exepid process 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe 1512 hpSM1R58xLeraVh.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
hpSM1R58xLeraVh.exedescription pid process Token: SeDebugPrivilege 1512 hpSM1R58xLeraVh.exe Token: SeDebugPrivilege 1512 hpSM1R58xLeraVh.exe Token: SeDebugPrivilege 1512 hpSM1R58xLeraVh.exe Token: SeDebugPrivilege 1512 hpSM1R58xLeraVh.exe Token: SeDebugPrivilege 1512 hpSM1R58xLeraVh.exe Token: SeDebugPrivilege 1512 hpSM1R58xLeraVh.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc.exedescription pid process target process PID 4736 wrote to memory of 1512 4736 ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc.exe hpSM1R58xLeraVh.exe PID 4736 wrote to memory of 1512 4736 ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc.exe hpSM1R58xLeraVh.exe PID 4736 wrote to memory of 1512 4736 ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc.exe hpSM1R58xLeraVh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc.exe"C:\Users\Admin\AppData\Local\Temp\ca184f8ef0161e4a5d1fb46962e8fdbae8a10e923d0e632d4172c511bce6b7dc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\hpSM1R58xLeraVh.exe.\hpSM1R58xLeraVh.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\WZGOdky@Y.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\WZGOdky@Y.com\chrome.manifestFilesize
35B
MD51422b525aa28d2f1966ac54c68855a62
SHA13761247220feff9e3e75e2077a4644da90fc4d4d
SHA256ee5ba459b6b88a7d8dd1ba4c92fa91aa86e919ce5a9bb53535c2363e7ad69e95
SHA51288f91ef747cac41a6443624a73ec2df6fe511f0f704ad24b1da25473825863586f81c9e64e71295accf12e11f489ff2845a3555df95c3a8e97607eb1aec0b3ca
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\WZGOdky@Y.com\content\bg.jsFilesize
8KB
MD572822ea0de401cf7b7f648db7fdd1a06
SHA19cb15cd7456bc967d8f89268b78d799724375cae
SHA2561a0f68f157e8ec9c6cccc6b4ed75d5873ad6f674eaa721f92c485334cd5675f0
SHA5125e1b88a932953166b698db6f27c97fb80487b6ce8e55868d00df0aad9eeb794e1a3506c22649a15bb04a924700f93bb45d2d7c3d280562404c120e4981b904d3
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\WZGOdky@Y.com\install.rdfFilesize
595B
MD51335b175b8f44d0be48921cbdf1c7e13
SHA11693f135ba7058f61408551080dd20accefbf716
SHA25627558f69c0ca6fbc8d410ea400d4708f4106ecfa52556a928495edadd8757b16
SHA51219ba8a2443b321b23fe4704844e764e847ff5f02311c68f442158b48c517c1a5b91df1f9bf0c710c60584765b145c1e753a42489f05198e5751ceb0d9cda1db2
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\ahbhhalnpidphdpeocdlbbjkagcfbcpa\background.htmlFilesize
140B
MD533b50d657a8723ae3fa67a1a22e12858
SHA1755b8e2b3488c1d5de4161fe8de0e0e59a271585
SHA2566590cc8cb76c743274451d46b1fc909dc6e8465219bfebf9fa5a106716b34878
SHA512c6c6b31cafee4161f8d45a3ce0fc2122ae7cd8266cea5c64267e0ce86c53fd5ae6fc20af62a22654304e689b843fe2b26846ab374e77199056c4ceafc6b2f602
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\ahbhhalnpidphdpeocdlbbjkagcfbcpa\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\ahbhhalnpidphdpeocdlbbjkagcfbcpa\e6v.jsFilesize
6KB
MD5e2f4c091a2dff408f768c9e2ee441111
SHA14ab83aaec646fb75f5158270cf6e53c4bbece90c
SHA256d62b220a9385dfe249027ac1f98f9dd34f4993fdb804c569df61313c54a28bb3
SHA5126abe952b5570c5f98371c8a1938aa910d94aa2a24648056aa78c06de489871bc574e77b54d7e1d23d8b5a7de00c9baf43d821e1d077905b05e2554224e4e4be5
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\ahbhhalnpidphdpeocdlbbjkagcfbcpa\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\ahbhhalnpidphdpeocdlbbjkagcfbcpa\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\hpSM1R58xLeraVh.datFilesize
1KB
MD55e856e5b9abfc25cb33430e0237dc6e0
SHA15c7d60652d635b0c29c3670264102df1293ebba9
SHA2564c69c80e3ba38d51ea7e63eb6d0f0236a3bb95ddd408b72afa908ae412d18a09
SHA5127d163adc92c7320fdc2849b233a7d83a2d4ad9606d242f4dafd0ad325df122a250a66fc897af0e69437afa1d07eedac859658e94ee60b30f3f42f6fc3863bcf8
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\hpSM1R58xLeraVh.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS7266.tmp\hpSM1R58xLeraVh.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/1512-132-0x0000000000000000-mapping.dmp