Analysis
-
max time kernel
129s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:36
Static task
static1
Behavioral task
behavioral1
Sample
c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a.exe
Resource
win7-20220812-en
General
-
Target
c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a.exe
-
Size
932KB
-
MD5
4cac63bf4944c361928d969b769741b7
-
SHA1
0016ee766bafdaa6a3134b0efeeb96212f6f4d3e
-
SHA256
c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a
-
SHA512
361fc1fd54a7bccf261c4b5362c3c9fced40df75131da306cd07c3f3b3a313b5e59336a4b25c82b0334c8b5a9bc392455c0c89bbe2549e1f8ec589f30a52d39f
-
SSDEEP
24576:h1OYdaOYCZ/iWCvu/2sWsJA/jlt+DHhsJ:h1OsqCpYO/dJJDHhsJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
PJ1QZ73MjxV4SzB.exepid process 4964 PJ1QZ73MjxV4SzB.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
PJ1QZ73MjxV4SzB.exedescription ioc process File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\emacpjbgimkajchojmmhddkeefgmpfma\2.0\manifest.json PJ1QZ73MjxV4SzB.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\emacpjbgimkajchojmmhddkeefgmpfma\2.0\manifest.json PJ1QZ73MjxV4SzB.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\emacpjbgimkajchojmmhddkeefgmpfma\2.0\manifest.json PJ1QZ73MjxV4SzB.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\emacpjbgimkajchojmmhddkeefgmpfma\2.0\manifest.json PJ1QZ73MjxV4SzB.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\emacpjbgimkajchojmmhddkeefgmpfma\2.0\manifest.json PJ1QZ73MjxV4SzB.exe -
Drops file in System32 directory 4 IoCs
Processes:
PJ1QZ73MjxV4SzB.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy PJ1QZ73MjxV4SzB.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini PJ1QZ73MjxV4SzB.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol PJ1QZ73MjxV4SzB.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI PJ1QZ73MjxV4SzB.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
PJ1QZ73MjxV4SzB.exepid process 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe 4964 PJ1QZ73MjxV4SzB.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
PJ1QZ73MjxV4SzB.exedescription pid process Token: SeDebugPrivilege 4964 PJ1QZ73MjxV4SzB.exe Token: SeDebugPrivilege 4964 PJ1QZ73MjxV4SzB.exe Token: SeDebugPrivilege 4964 PJ1QZ73MjxV4SzB.exe Token: SeDebugPrivilege 4964 PJ1QZ73MjxV4SzB.exe Token: SeDebugPrivilege 4964 PJ1QZ73MjxV4SzB.exe Token: SeDebugPrivilege 4964 PJ1QZ73MjxV4SzB.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a.exedescription pid process target process PID 3436 wrote to memory of 4964 3436 c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a.exe PJ1QZ73MjxV4SzB.exe PID 3436 wrote to memory of 4964 3436 c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a.exe PJ1QZ73MjxV4SzB.exe PID 3436 wrote to memory of 4964 3436 c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a.exe PJ1QZ73MjxV4SzB.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a.exe"C:\Users\Admin\AppData\Local\Temp\c47401422dbec116d4884682e951ee049f4bc4bfe15afa19885fc7065f1f1b5a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\PJ1QZ73MjxV4SzB.exe.\PJ1QZ73MjxV4SzB.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\[email protected]\chrome.manifestFilesize
35B
MD570dca2cf8dd73ddc3c22cb1fd0d318e3
SHA1920246415c73f8cf3babc4dfba8a9a8c167045b2
SHA256ad68b1aeb56e7c437ffea6916a76797867c818a9117891424f72e0e82dfa86e5
SHA51256f24246cdb2a61d2a9c26c2b495ad38499c1714f62af9041308784cff8ff18b2c744a11106fd8a59081874fd5beb7030d18b9d0e4a37e44d5ee2efc1b0ea385
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\[email protected]\content\bg.jsFilesize
9KB
MD55b700d30092f060623c2b9c38a3721cc
SHA1b3d437d994c4c4d9b44a6ce63adf6efd50b78d0e
SHA256db05b4b2adc79694236818bb1a33e2ebbb084e6901a380c8e83804697ba04c82
SHA512d827f53fdf586aa4401bb734ec93ffe607177bac71f172c959ef38b6a6ad8d6f01ed7bbd7024b20f5b2981779fb336e5c70781def4d192e6deb618f7b552a0a3
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\[email protected]\install.rdfFilesize
593B
MD558c462b3d858b55892fb36bcf720649d
SHA140140f3e8ad269416945ee8e26782d7357cca32e
SHA256b1a3550b92b0e49be838c25aa8bfa2322860e145ce200c7eb11b7dde4874a704
SHA512ed31fa50bf784ab7ca1bccf39ef2449a1dcbc9ac86cc72f659718377ade1daf4b4be59f464d180337111ea111a80b32ae3fa90ac77cfda3ba9bad642ee4d00b4
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\PJ1QZ73MjxV4SzB.datFilesize
1KB
MD5accc8cfc38b58b53adb7bb499c569f88
SHA1dc0c2a3bd8017b198fa3d341bc8f3f3c83675b9f
SHA256f85803be043fd2e2f8248dac954014f7e13f57ac57883a87a4b90d8338725200
SHA512a7d4bca6de4155760da83c5b12e08d54684d1cf058994748709f2d88bced8fd1635347d760e3e0dd0ecb8cda41e04ff5bf99fb9d6814e24478e42ec12f9d92a3
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\PJ1QZ73MjxV4SzB.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\PJ1QZ73MjxV4SzB.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\emacpjbgimkajchojmmhddkeefgmpfma\background.htmlFilesize
141B
MD59fd8b8263f8abff3ccdf82b9dafb548e
SHA104dd00af7ef187648325a59acacfbacee90f33e3
SHA256e4c2575044f222a02bf9a3d37b22dc425df2d8cbbf0b32dc2df47d2543d2ca89
SHA512546662f5c2bd3c3cb27f1a1710232877a3eb4806e1081d6d52765e2a3500dd61e7e416d4e42f202dfe2e3e578e5973635bfa9ab6aa517e294f5b98b3bd208eab
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\emacpjbgimkajchojmmhddkeefgmpfma\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\emacpjbgimkajchojmmhddkeefgmpfma\enlX.jsFilesize
6KB
MD5f74745ed01628507ead6c921464b3e6b
SHA11cd0789694f706727d7ce78106871499f5057af7
SHA256a5c207e65c16ec587902b5da36dea0b32b7b74496c683bf772b93def5fd1dcaf
SHA5122d28723c0136e7c816ee16201d45230b45ff80f932f16a9c93a6716e8ebc812b99f02fd5f9f7624297d48700f2e3454304f88cfb9ff8a43a3617d05f0c7405cd
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\emacpjbgimkajchojmmhddkeefgmpfma\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSD2F5.tmp\emacpjbgimkajchojmmhddkeefgmpfma\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/4964-132-0x0000000000000000-mapping.dmp