Analysis
-
max time kernel
153s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:38
Static task
static1
Behavioral task
behavioral1
Sample
c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a.exe
Resource
win7-20221111-en
General
-
Target
c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a.exe
-
Size
920KB
-
MD5
ca72f7bb5ac79ce1f61c673f196cfc56
-
SHA1
52c1ef4032f812fc7add8342f8530e206330e1a7
-
SHA256
c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a
-
SHA512
1565e72e9680dfe365177d6642b2cdcafb09d915b745ec2f4d5fe9cf480eb38b15d0af3ff3fdc77f93bf31b2cc31203c27afd73df90acf573085ee0dbb6d54f7
-
SSDEEP
24576:h1OYdaOqMtdHAqcdDVhYwiei7+EpFAh/kKz:h1OsLPHVmVhYwiLtKkKz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
aPR0mFaVVA4p6O6.exepid process 2916 aPR0mFaVVA4p6O6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
aPR0mFaVVA4p6O6.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdidmpmknhinjkmahippkabfmkfkpnkj\2.0\manifest.json aPR0mFaVVA4p6O6.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdidmpmknhinjkmahippkabfmkfkpnkj\2.0\manifest.json aPR0mFaVVA4p6O6.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdidmpmknhinjkmahippkabfmkfkpnkj\2.0\manifest.json aPR0mFaVVA4p6O6.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdidmpmknhinjkmahippkabfmkfkpnkj\2.0\manifest.json aPR0mFaVVA4p6O6.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdidmpmknhinjkmahippkabfmkfkpnkj\2.0\manifest.json aPR0mFaVVA4p6O6.exe -
Drops file in System32 directory 4 IoCs
Processes:
aPR0mFaVVA4p6O6.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI aPR0mFaVVA4p6O6.exe File opened for modification C:\Windows\System32\GroupPolicy aPR0mFaVVA4p6O6.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini aPR0mFaVVA4p6O6.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol aPR0mFaVVA4p6O6.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
aPR0mFaVVA4p6O6.exepid process 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe 2916 aPR0mFaVVA4p6O6.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
aPR0mFaVVA4p6O6.exedescription pid process Token: SeDebugPrivilege 2916 aPR0mFaVVA4p6O6.exe Token: SeDebugPrivilege 2916 aPR0mFaVVA4p6O6.exe Token: SeDebugPrivilege 2916 aPR0mFaVVA4p6O6.exe Token: SeDebugPrivilege 2916 aPR0mFaVVA4p6O6.exe Token: SeDebugPrivilege 2916 aPR0mFaVVA4p6O6.exe Token: SeDebugPrivilege 2916 aPR0mFaVVA4p6O6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a.exedescription pid process target process PID 5064 wrote to memory of 2916 5064 c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a.exe aPR0mFaVVA4p6O6.exe PID 5064 wrote to memory of 2916 5064 c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a.exe aPR0mFaVVA4p6O6.exe PID 5064 wrote to memory of 2916 5064 c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a.exe aPR0mFaVVA4p6O6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a.exe"C:\Users\Admin\AppData\Local\Temp\c39598525474434fab65f4cc30189931c132d8ba1ea59902551abf16b355ce7a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\aPR0mFaVVA4p6O6.exe.\aPR0mFaVVA4p6O6.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\[email protected]\chrome.manifestFilesize
35B
MD515e2094ac7fd0e52d7b68892dd407c44
SHA1d44a25493ee74a2684a1a0de32de82fda46e4562
SHA25675eeeb766ebf1e4ba0cb86c9753cd34acf5b50cd040a66af09a223db0bfcfdca
SHA512b17ad0dea5b6afc95cde61e04b581e784aca3ec9948f158cbf3c1ef35a665747f3f95bec3048c772505556c111ea4d2bb51467ab3f40a46cfcf3b8f31a4cd0b8
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5325bf05ce854e08ce27864fd3a5c3b9e
SHA1401ae8ebb09872fcb7f5d55e91923230209cc100
SHA256545fee3c7d28fa8700dff931e4745e7c71b5b932c9cd2790659d0d4d1de7bfbd
SHA51205d557fa6461c22d7c59a2d50ec0fa8a77c2dbcb88d6e4501ab28e007adb490a82a237db06133e420780011b2a9391cca415bd43c1150eb8e042099308823496
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\[email protected]\install.rdfFilesize
598B
MD5bb3cb701f2d111bde8aeac845932e8da
SHA13c9fa588f4ebe276ecefba613d0d5e2c7bf0b5ac
SHA256b429eab076454cba6ba8486c5f5eb3d0d5f44c3fa3acac77bb3d20aeef3db689
SHA5122ce24f47209ce17df9c7d10fcd24b838113d253e9f0b3dcbce11fb30486e5a8415753807266dbab3b1c7fec33f10ea84925184da3cec6f2bf16df285fbf208cd
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\aPR0mFaVVA4p6O6.datFilesize
1KB
MD5e3323f39b514f11203b347f423f46a2c
SHA17ecfad7ca07ac0d133527087b1a2e6fa2b000f90
SHA25663457154c4143408812ce5d3e997fb377381569c9f33c8dcddbf21e1affd5e62
SHA5128bb913862a805015e15bd9b6052a23904df9d99b40fe739bd07bbbcd80d995bf783d392eeacbcd1b38657be3df083801ac13038034dbc5d2cce0f595160662ad
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\aPR0mFaVVA4p6O6.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\aPR0mFaVVA4p6O6.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\cdidmpmknhinjkmahippkabfmkfkpnkj\GzUfZ03.jsFilesize
6KB
MD564cf49d48b9b62107a3cdb93fe434639
SHA134b65ca17bac661bece0fd920013cd19da575e9a
SHA2569172da965249e283c2c3a21624298f3e112bb3352438e0ec6e6a869e1730413f
SHA5128a4aeb5b7edd7ccab717efb92dd891de8aa550c5c0669e832046be5fefdbc8eb0e3a848a9190803e7b557b0e58d05cdb7621b73f529119028fc2379341d47f66
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\cdidmpmknhinjkmahippkabfmkfkpnkj\background.htmlFilesize
144B
MD5d7e2b811a5dfbb30a0beeea7749613f2
SHA1cf0d0957994679f6f615afda3e16e8d4dde4697b
SHA256889b92251f4e48a6b5f3f68e318015ac80f8c325d94b8c0bb036547110da6780
SHA51295ae595c642e07dfd9d6a77743687a753e9e7a391db3677c6601dd364dcdb439a20344e0f0537bec1d10f042d72955794fb583ed057d47d9892558372345b011
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\cdidmpmknhinjkmahippkabfmkfkpnkj\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\cdidmpmknhinjkmahippkabfmkfkpnkj\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSCB2.tmp\cdidmpmknhinjkmahippkabfmkfkpnkj\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/2916-132-0x0000000000000000-mapping.dmp