Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:40
Static task
static1
Behavioral task
behavioral1
Sample
c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe
Resource
win7-20220812-en
General
-
Target
c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe
-
Size
2.5MB
-
MD5
4aa9f18d719ae1309620dd3042ad867f
-
SHA1
a1ce3d9ce39b7c045090f1634ced3428a4960ee7
-
SHA256
c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc
-
SHA512
193e75f08fb3345b2c8c7d7e392a349920c02dd62d76b03d193479256d6226df617eb54c1e8290e1848285bd99c94bbcd72483cfd18cfd6ee847d58156a0f9b3
-
SSDEEP
49152:h1OsuUc3R1YQeb1bR9qMS3te/+E+kzkeRutdQ3L3V/A9VeF:h1O/bRsTWe/ZH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AnxvmsNVwo9NHSs.exepid process 960 AnxvmsNVwo9NHSs.exe -
Loads dropped DLL 4 IoCs
Processes:
c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exeAnxvmsNVwo9NHSs.exeregsvr32.exeregsvr32.exepid process 1492 c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe 960 AnxvmsNVwo9NHSs.exe 1956 regsvr32.exe 1720 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
AnxvmsNVwo9NHSs.exedescription ioc process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjbdmfmjohdacdgnjfmnkhmcdalpnmcc\1.0\manifest.json AnxvmsNVwo9NHSs.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjbdmfmjohdacdgnjfmnkhmcdalpnmcc\1.0\manifest.json AnxvmsNVwo9NHSs.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjbdmfmjohdacdgnjfmnkhmcdalpnmcc\1.0\manifest.json AnxvmsNVwo9NHSs.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeAnxvmsNVwo9NHSs.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} AnxvmsNVwo9NHSs.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects AnxvmsNVwo9NHSs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ AnxvmsNVwo9NHSs.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} AnxvmsNVwo9NHSs.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} AnxvmsNVwo9NHSs.exe -
Drops file in Program Files directory 8 IoCs
Processes:
AnxvmsNVwo9NHSs.exedescription ioc process File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.dat AnxvmsNVwo9NHSs.exe File created C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.x64.dll AnxvmsNVwo9NHSs.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.x64.dll AnxvmsNVwo9NHSs.exe File created C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.dll AnxvmsNVwo9NHSs.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.dll AnxvmsNVwo9NHSs.exe File created C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.tlb AnxvmsNVwo9NHSs.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.tlb AnxvmsNVwo9NHSs.exe File created C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.dat AnxvmsNVwo9NHSs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AnxvmsNVwo9NHSs.exepid process 960 AnxvmsNVwo9NHSs.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exeAnxvmsNVwo9NHSs.exeregsvr32.exedescription pid process target process PID 1492 wrote to memory of 960 1492 c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe AnxvmsNVwo9NHSs.exe PID 1492 wrote to memory of 960 1492 c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe AnxvmsNVwo9NHSs.exe PID 1492 wrote to memory of 960 1492 c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe AnxvmsNVwo9NHSs.exe PID 1492 wrote to memory of 960 1492 c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe AnxvmsNVwo9NHSs.exe PID 960 wrote to memory of 1956 960 AnxvmsNVwo9NHSs.exe regsvr32.exe PID 960 wrote to memory of 1956 960 AnxvmsNVwo9NHSs.exe regsvr32.exe PID 960 wrote to memory of 1956 960 AnxvmsNVwo9NHSs.exe regsvr32.exe PID 960 wrote to memory of 1956 960 AnxvmsNVwo9NHSs.exe regsvr32.exe PID 960 wrote to memory of 1956 960 AnxvmsNVwo9NHSs.exe regsvr32.exe PID 960 wrote to memory of 1956 960 AnxvmsNVwo9NHSs.exe regsvr32.exe PID 960 wrote to memory of 1956 960 AnxvmsNVwo9NHSs.exe regsvr32.exe PID 1956 wrote to memory of 1720 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1720 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1720 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1720 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1720 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1720 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1720 1956 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe"C:\Users\Admin\AppData\Local\Temp\c34a75f892c427316f9b614c13892cef30a481cc38fdcb60b1b84282969175bc.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\AnxvmsNVwo9NHSs.exe.\AnxvmsNVwo9NHSs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:1720
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.datFilesize
6KB
MD5d1cdeee604bd528f0e023dad7330d0e6
SHA125dbdd94be7195bdc39f6600b428f426e4029766
SHA25653beea447ec2bb0232437a78485e1c7941221c109489387ac78c3c1e1ec1779b
SHA512f01bf2cefaa890ca741b7c4e803c73e6bf37e31a5130396136c40d3ba44504f446fd3b909e9312e1ac6cc3975caa039ce78596f2c9c2456dea2f240739fcf742
-
C:\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.x64.dllFilesize
874KB
MD5c204b63eda2256280c0d74669210c890
SHA10a66d21505519e92683ac9845c3ff9ee6e196332
SHA256505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0
SHA5121bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\AnxvmsNVwo9NHSs.datFilesize
6KB
MD5d1cdeee604bd528f0e023dad7330d0e6
SHA125dbdd94be7195bdc39f6600b428f426e4029766
SHA25653beea447ec2bb0232437a78485e1c7941221c109489387ac78c3c1e1ec1779b
SHA512f01bf2cefaa890ca741b7c4e803c73e6bf37e31a5130396136c40d3ba44504f446fd3b909e9312e1ac6cc3975caa039ce78596f2c9c2456dea2f240739fcf742
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\AnxvmsNVwo9NHSs.exeFilesize
762KB
MD5468f56fce4a9413059464fa7c9c3cc5f
SHA199dde68e6dca34b5787c1e2faeab1716f443e462
SHA2561b0cefe330725f38dd592a9900eeca832124643d3a170805ad7cd988dc312841
SHA51211bf2744d92faaa1e13bb316d3d56555fd5bb8a8248fde6bbca1f692cc55928ec901cc1cc79c09f236273e25712526dd629fd97aec4f062d469c9714d1a6a7d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\AnxvmsNVwo9NHSs.exeFilesize
762KB
MD5468f56fce4a9413059464fa7c9c3cc5f
SHA199dde68e6dca34b5787c1e2faeab1716f443e462
SHA2561b0cefe330725f38dd592a9900eeca832124643d3a170805ad7cd988dc312841
SHA51211bf2744d92faaa1e13bb316d3d56555fd5bb8a8248fde6bbca1f692cc55928ec901cc1cc79c09f236273e25712526dd629fd97aec4f062d469c9714d1a6a7d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\[email protected]\chrome.manifestFilesize
35B
MD596cfe17ab95ef95be1159c6e58a47875
SHA1014bab4f083bbdf2bf47712c0b533cf7f72b95de
SHA256b43db1ee1dca16dd26fb27d2a7e2a45c2c2160b1a684ad323329f1ab8e50ed74
SHA5124aa510be40c2251a313830d8f82dab187ce65f67b27ae5bf51ce7c84b72646d005bab14fa083257a3b92d9b8fb8902d7857300c106e730045c798f12f851cf3b
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\[email protected]\content\bg.jsFilesize
7KB
MD564c34d124966bdc114b375ba9c496c5c
SHA115cc648fba971838e1e3d046986a74e44a87bbc7
SHA2568397ed152330cfe5035bf6a452e19d09e9941a69d022301f81be558f4f009110
SHA512adae30392c91eb61c4032d52b5c92474ffcef5781109a14a296c0fffb6e575a7eb7098aa76478f2816d09a8df30708f866d9847f8edec1d1a7893d99eb7b5a50
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\[email protected]\install.rdfFilesize
603B
MD5f25a3e2ea434b1edbeba4085cdd1199d
SHA1ce3bb952ca7ee7ceeddd42756e45858b0055672d
SHA256169d07bcf6d54952fa70f5aa84da4912156b84480c215b4391f93b6b337df95f
SHA5123242276a637d7913655509ee6c42276e19586a5a417f8b3ff64e1437980bdbb3bde418337a61909bb43007464e3164b21c0ca5d5d12d56394bd5eba6236da0a2
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\mvIbXz05Q1Z3kq.dllFilesize
744KB
MD5fc8b2dfce95210e4fe59b69a454ce14a
SHA146acd69f9bc55784091a572c8aa4d4d153a874f8
SHA2563b408b96d81cfe3167926bcb62020da4d95001d8d2c3fc4d67708ec21488f189
SHA5125ba3bb3437bb523721eac4e5c510b3fcb7b15090efeccd43075c8a42a776acad0c785431d7e2287e1b812556a30cd17bdde3d0d99f505a739c2042843d2cc1bf
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\mvIbXz05Q1Z3kq.tlbFilesize
3KB
MD5662093ad59715d81e0a2b7cfbd4ac684
SHA183419c0803aa1c25a27b1fb8ad4a663d2d4878b0
SHA25668fc930e26f7f38e30df8f8f40d1232b81af62d4cf27a281a8f645788ad1f6c4
SHA5120eaffb7f011f548e1c6f8490c3d353fa05976140383df85663b5ef13be110d4847f08afe236a796a7f10a28895d29a7344e6d346389aa0780cc24af50fd66bf6
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\mvIbXz05Q1Z3kq.x64.dllFilesize
874KB
MD5c204b63eda2256280c0d74669210c890
SHA10a66d21505519e92683ac9845c3ff9ee6e196332
SHA256505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0
SHA5121bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\pjbdmfmjohdacdgnjfmnkhmcdalpnmcc\HkaXBSiO.jsFilesize
5KB
MD51a6cb5096153b276b76f6f661711c2b6
SHA1ce088176cd51d7a15cd2c686cc3af4b4283a11d6
SHA25668ae475787ecd3fb0f342e1a04c950d028617e78046674957431038fad1a8955
SHA51269995666aacb21ffca5fe652a7f84c8477a958129c204c3c914d87a420259098ddccb51394e9ce300ce691a428b6ddeaa4c1075d434926b7053f8538a79c3821
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\pjbdmfmjohdacdgnjfmnkhmcdalpnmcc\background.htmlFilesize
145B
MD54a7dd65288df875b3893efb604032dde
SHA1144f0ab90ba3e2f61e23d7220cfb6fb61646958c
SHA256c9150926e809f6677035d41e6387645eb99237421b2e8710f37142111d3eb7b2
SHA512241156de37cfcd84c1171144ec6c5a89092870544115d89ae01fc61b60d391f1fed154416cf08918098b52fb0efb1de318fe49843371214a66492d3cd222a64e
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\pjbdmfmjohdacdgnjfmnkhmcdalpnmcc\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\pjbdmfmjohdacdgnjfmnkhmcdalpnmcc\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS4819.tmp\pjbdmfmjohdacdgnjfmnkhmcdalpnmcc\manifest.jsonFilesize
507B
MD5d429395a45a9aa09e4ee9054e9196b30
SHA1c5dbab4e27650b07d4d159c305d08a9d578c3a3e
SHA256674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344
SHA5124a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e
-
\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.dllFilesize
744KB
MD5fc8b2dfce95210e4fe59b69a454ce14a
SHA146acd69f9bc55784091a572c8aa4d4d153a874f8
SHA2563b408b96d81cfe3167926bcb62020da4d95001d8d2c3fc4d67708ec21488f189
SHA5125ba3bb3437bb523721eac4e5c510b3fcb7b15090efeccd43075c8a42a776acad0c785431d7e2287e1b812556a30cd17bdde3d0d99f505a739c2042843d2cc1bf
-
\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.x64.dllFilesize
874KB
MD5c204b63eda2256280c0d74669210c890
SHA10a66d21505519e92683ac9845c3ff9ee6e196332
SHA256505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0
SHA5121bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425
-
\Program Files (x86)\YoutubeAdBlocke\mvIbXz05Q1Z3kq.x64.dllFilesize
874KB
MD5c204b63eda2256280c0d74669210c890
SHA10a66d21505519e92683ac9845c3ff9ee6e196332
SHA256505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0
SHA5121bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425
-
\Users\Admin\AppData\Local\Temp\7zS4819.tmp\AnxvmsNVwo9NHSs.exeFilesize
762KB
MD5468f56fce4a9413059464fa7c9c3cc5f
SHA199dde68e6dca34b5787c1e2faeab1716f443e462
SHA2561b0cefe330725f38dd592a9900eeca832124643d3a170805ad7cd988dc312841
SHA51211bf2744d92faaa1e13bb316d3d56555fd5bb8a8248fde6bbca1f692cc55928ec901cc1cc79c09f236273e25712526dd629fd97aec4f062d469c9714d1a6a7d0
-
memory/960-56-0x0000000000000000-mapping.dmp
-
memory/1492-54-0x0000000075921000-0x0000000075923000-memory.dmpFilesize
8KB
-
memory/1720-77-0x0000000000000000-mapping.dmp
-
memory/1720-78-0x000007FEFC371000-0x000007FEFC373000-memory.dmpFilesize
8KB
-
memory/1956-73-0x0000000000000000-mapping.dmp