Analysis
-
max time kernel
175s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:34
Static task
static1
Behavioral task
behavioral1
Sample
c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0.exe
Resource
win7-20220901-en
General
-
Target
c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0.exe
-
Size
931KB
-
MD5
8d97d8b18f0ca725500ab655d40b2baa
-
SHA1
e7ff12d5af02d77b88d67053c29646b6f751ee50
-
SHA256
c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0
-
SHA512
a17cc4fb7a3c415da55afaa1a16234114cd170582370257ffb37530e24affecf1b329e0b226728fba85b947a386e6b5e4d7415a895806bd82ec3699fecf4fc2d
-
SSDEEP
24576:h1OYdaOSCZ/iWCvu/2sWsJA/jlt+DHhsv:h1OssCpYO/dJJDHhsv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
9jiGTL7bjV86c84.exepid process 4672 9jiGTL7bjV86c84.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
9jiGTL7bjV86c84.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbofphbhhfcckaoocgapfaghgiembdjc\2.0\manifest.json 9jiGTL7bjV86c84.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbofphbhhfcckaoocgapfaghgiembdjc\2.0\manifest.json 9jiGTL7bjV86c84.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbofphbhhfcckaoocgapfaghgiembdjc\2.0\manifest.json 9jiGTL7bjV86c84.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbofphbhhfcckaoocgapfaghgiembdjc\2.0\manifest.json 9jiGTL7bjV86c84.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbofphbhhfcckaoocgapfaghgiembdjc\2.0\manifest.json 9jiGTL7bjV86c84.exe -
Drops file in System32 directory 4 IoCs
Processes:
9jiGTL7bjV86c84.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 9jiGTL7bjV86c84.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 9jiGTL7bjV86c84.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 9jiGTL7bjV86c84.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 9jiGTL7bjV86c84.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
9jiGTL7bjV86c84.exepid process 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe 4672 9jiGTL7bjV86c84.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
9jiGTL7bjV86c84.exedescription pid process Token: SeDebugPrivilege 4672 9jiGTL7bjV86c84.exe Token: SeDebugPrivilege 4672 9jiGTL7bjV86c84.exe Token: SeDebugPrivilege 4672 9jiGTL7bjV86c84.exe Token: SeDebugPrivilege 4672 9jiGTL7bjV86c84.exe Token: SeDebugPrivilege 4672 9jiGTL7bjV86c84.exe Token: SeDebugPrivilege 4672 9jiGTL7bjV86c84.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0.exedescription pid process target process PID 2304 wrote to memory of 4672 2304 c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0.exe 9jiGTL7bjV86c84.exe PID 2304 wrote to memory of 4672 2304 c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0.exe 9jiGTL7bjV86c84.exe PID 2304 wrote to memory of 4672 2304 c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0.exe 9jiGTL7bjV86c84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0.exe"C:\Users\Admin\AppData\Local\Temp\c4d16ca4b75b204fd33a6c249ba10624299a0ce15304826a87d2833b053bd1e0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\9jiGTL7bjV86c84.exe.\9jiGTL7bjV86c84.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\9jiGTL7bjV86c84.datFilesize
1KB
MD591f53f2852f06b91f2cf29722e29ba3d
SHA152c478401b8eddd6d3fbdd1db2744b1a963babb1
SHA256e3acc6666d9bf7a05bdbdbed9fe82ac2462ef112b331a584e6da4d18f2c93478
SHA512c8ea21bc6fa739f45dfd62a7888a9fb482d3bb1c891040e1d642ab6a91f1698bc97743cbcc4bd90e04bbc7679ad409f33c0337532c6cb085a7b940dfa178eb1a
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\9jiGTL7bjV86c84.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\9jiGTL7bjV86c84.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\cbofphbhhfcckaoocgapfaghgiembdjc\background.htmlFilesize
147B
MD57a7a333ba0109f6071df683c38512cd8
SHA1055d671e8cda44e0a98ca41832ccb3263c612fb2
SHA25686fa98fdc6bececca87d4b5ee3ca95c7d84156065ff3df458ce58b2b5aec50ab
SHA512a74489ecbe593104840efc6807cc593995b33c40567ba41a11d1c3c3b3d7d0ba6afac95be12f552b649aa97710f35f4f316c292f9cc77f5dc45b3f0ca774e4a2
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\cbofphbhhfcckaoocgapfaghgiembdjc\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\cbofphbhhfcckaoocgapfaghgiembdjc\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\cbofphbhhfcckaoocgapfaghgiembdjc\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\cbofphbhhfcckaoocgapfaghgiembdjc\nBfcpJ8gW5.jsFilesize
6KB
MD589c50615d231c001ae18dbfe977df7e4
SHA1e32caccc5207d175d81eb5f1d4a39c34323dc94e
SHA256cd127ba2d6232ad2e73e45e97e791406ffec9b9039da2dcd8cab1179ad35de4f
SHA512ca53192e899c4eff1089a88d0e23f1b637aeb0050fd6af68300cad1bd30d8d2762d2e66bb7f03afb1a2db16477636e1f13e4b54f0ef11bf11d64af6815c03bbc
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\[email protected]\chrome.manifestFilesize
35B
MD509817d9ab88410ebaf992ed9805494c4
SHA1eafd8acdbefff532581c45b6c3bcdad4588bdfd7
SHA2564becbdc74e11ed7b6d4bc5eda54496484cc0aee8af95f5af149e93c7bdb86ce7
SHA512ea73b08860fc127d6ca50b9540a99f24d691bc4bb3fd323db04f2a5645553bb6f7d52483625f9304d8aae9b2d77f3cfd95efda60b03c84c4328c1328ceaf4408
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5065239a93d254be94f7137cf4cab191d
SHA1ddf4cce632e8e6f1d0f30be73d4fd934722fd3f5
SHA256bcb294bbbb5ffd6123bb7b2e227fb924cbfb9c525ad04cd3cb674160e6c0de05
SHA5125b22040bae909624a63e9fa99507c9064174167438f182df92491595dac1d556a52e1b361e28a6d35537a11982ab28355153bfa912e183c5e181e6982ec53018
-
C:\Users\Admin\AppData\Local\Temp\7zSF90B.tmp\[email protected]\install.rdfFilesize
596B
MD5bd8c55874bf94204436de660d43cf5ca
SHA1010ec76c69149372e45f81fd8792cbb012bbdf9b
SHA25618ec1b7063fb6c15a95a7df1115435633a8a167810e6fceb83353d9b08cc8483
SHA512f4a391a8de37ea2256acff2e74f5398b4872e7b9fd06085ebb7b41f8b7bc5705b9a6432714daa42ea07c563878d58fed66459dd8c0311ceea2edcd2b79c85b8d
-
memory/4672-132-0x0000000000000000-mapping.dmp