Analysis
-
max time kernel
58s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:17
Static task
static1
Behavioral task
behavioral1
Sample
ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe
Resource
win7-20221111-en
General
-
Target
ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe
-
Size
920KB
-
MD5
587cea0b508d1bc4ca0dc20322e1bc55
-
SHA1
e0e097af73187e63d15cd48c6e85a67c6c43ca24
-
SHA256
ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be
-
SHA512
13c016ffb2345fa8bbb7f8d8c1eb12db9c3fd45241f9626aefa64ec9bc6868694a23e54f089da2b3480b9492fa1f313089589b0918c9874d4425b20d287fcf57
-
SSDEEP
24576:h1OYdaOuMtdHAqcdDVhYwiei7+EpFAh/kKa:h1Os3PHVmVhYwiLtKkKa
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
nIKSuQw8eG33Rg3.exepid process 1884 nIKSuQw8eG33Rg3.exe -
Loads dropped DLL 1 IoCs
Processes:
ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exepid process 936 ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
nIKSuQw8eG33Rg3.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjgmkcnggpoklmhngcpfifomiiagbgmk\2.0\manifest.json nIKSuQw8eG33Rg3.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjgmkcnggpoklmhngcpfifomiiagbgmk\2.0\manifest.json nIKSuQw8eG33Rg3.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjgmkcnggpoklmhngcpfifomiiagbgmk\2.0\manifest.json nIKSuQw8eG33Rg3.exe -
Drops file in System32 directory 4 IoCs
Processes:
nIKSuQw8eG33Rg3.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy nIKSuQw8eG33Rg3.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini nIKSuQw8eG33Rg3.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol nIKSuQw8eG33Rg3.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI nIKSuQw8eG33Rg3.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
nIKSuQw8eG33Rg3.exepid process 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe 1884 nIKSuQw8eG33Rg3.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
nIKSuQw8eG33Rg3.exedescription pid process Token: SeDebugPrivilege 1884 nIKSuQw8eG33Rg3.exe Token: SeDebugPrivilege 1884 nIKSuQw8eG33Rg3.exe Token: SeDebugPrivilege 1884 nIKSuQw8eG33Rg3.exe Token: SeDebugPrivilege 1884 nIKSuQw8eG33Rg3.exe Token: SeDebugPrivilege 1884 nIKSuQw8eG33Rg3.exe Token: SeDebugPrivilege 1884 nIKSuQw8eG33Rg3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exedescription pid process target process PID 936 wrote to memory of 1884 936 ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe nIKSuQw8eG33Rg3.exe PID 936 wrote to memory of 1884 936 ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe nIKSuQw8eG33Rg3.exe PID 936 wrote to memory of 1884 936 ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe nIKSuQw8eG33Rg3.exe PID 936 wrote to memory of 1884 936 ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe nIKSuQw8eG33Rg3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe"C:\Users\Admin\AppData\Local\Temp\ca1283d03feb96ad9ad079af4313d1ac7b1ce9d66b95cd9a2710a990c68315be.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\nIKSuQw8eG33Rg3.exe.\nIKSuQw8eG33Rg3.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\gry@QdHS6HH.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\gry@QdHS6HH.com\chrome.manifestFilesize
35B
MD564dc1475962d6386bb9bfc8153e92a94
SHA112f874245bf0cf268647f0d84804f3b54c227398
SHA256f366a1dfca264af8648bd20b92fab7695b2d1861a76dd23478b15dd860ca45df
SHA512615ac903905745dbcb4fe1853833ddf061d93a5fac2d667e0310a369036854d814495ee18a00038d1b9646fe5149ddbd7a783fb5b49f22d7cba67820be0ebe9e
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\gry@QdHS6HH.com\content\bg.jsFilesize
8KB
MD5fa857c2098d3367c6a970f097bd6e5c7
SHA1785224ebd6e7e15ec742940c6af3a901685443b3
SHA256b48796067e858053c4a9264f8ea3a3ce926c3e734748563f0ba95af61ac6bbe9
SHA51243b0496ecb20265d146dd15a7a8d62c5cdbb1e64fa8cf49a387f2b3889c315be30ba4462927bdede90ca30ee5ab49f90d8b591ee09efa22d45de64a6723b09de
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\gry@QdHS6HH.com\install.rdfFilesize
598B
MD50a678d2862e3b6c8bf23f62b3bd8158f
SHA1cb85be79d09c5f6bf6319319490d0f643efbb804
SHA25657a7045bdfc6d434a0d9b9fc51bcb84f7145f4566a8f9fc1cb0080de5f5eaed1
SHA512aea026beef3caf53cfe39c57f21aa8c5b896f8578e30bc323042413d4bcfb8c246ea199c3eeb757cc40934cf15c7012c34795846a0ae8725cc8a6beb460797d5
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\mjgmkcnggpoklmhngcpfifomiiagbgmk\Uc.jsFilesize
6KB
MD552b90c43922f5a06b97cdd7e6f76d668
SHA1db2b8deb8216c052e08d3612b7b6fcbabca4a71a
SHA256ce4ca56d80297ab8bf73528c58e6e353b46413599e45f9664213fec64576c01a
SHA5125be0bd66ed92579a68abd5833c29db6ab39b75292595091bc076b6fcc7361f2624c98e0ee184395987e5ced22d1cd1e816942c6a6bb769171bb684b026cb0b31
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\mjgmkcnggpoklmhngcpfifomiiagbgmk\background.htmlFilesize
139B
MD59c29b8a1d826920a375588f3443e166e
SHA1a73a568ceec8e755a17ac657efa7ad04baa2bad6
SHA2565345934015f18d1cb0b3b4615bba7023c2ea558cdb64fccde59e9baf373cd05a
SHA5120b77c208ce2210b26eaa90ab4a546c1a38c332887c0b20c7ab3901d60f4562fc7c5afb52048a442132205f7662dec98d41146881231e9f1b6b2e0136a194dd62
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\mjgmkcnggpoklmhngcpfifomiiagbgmk\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\mjgmkcnggpoklmhngcpfifomiiagbgmk\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\mjgmkcnggpoklmhngcpfifomiiagbgmk\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\nIKSuQw8eG33Rg3.datFilesize
1KB
MD56d9579fefb76e66042b4c55521f3d9ff
SHA1e5896b42febdce6a38f461a414746eaac84ea58d
SHA25652dfac7327c1b504c4d483982d84cbbd8997989a4744454e15fc09fda84ee93d
SHA512e927d62982c1cab5776bba6956bb40ed68c482505b9126c5554f654ffea262567706736e7999d913673fcb328f8dbe08fca0b7e8d63587810dd5e7df3a0be0f0
-
C:\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\nIKSuQw8eG33Rg3.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
\Users\Admin\AppData\Local\Temp\7zSBFE6.tmp\nIKSuQw8eG33Rg3.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/936-54-0x0000000076941000-0x0000000076943000-memory.dmpFilesize
8KB
-
memory/1884-56-0x0000000000000000-mapping.dmp