c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99

Analysis

max time kernel
150s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99.exe
Size

931KB
MD5

cf486b4775e4b8a21d642cf172539f2a
SHA1

14b17c911e51c202ab665a52493ef5915ffaf7df
SHA256

c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99
SHA512

72dfa0f5fe5c64f94e2d6f39e58d0ac2d9083f783509146d29f412d08056b05b3363e373d3d9cab8673146bf18b2cc6c76f37a32a4249bf991f9cfdc5cbd3c76
SSDEEP

24576:h1OYdaOYCZ/iWCvu/2sWsJA/jlt+DHhs0:h1OsKCpYO/dJJDHhs0

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Gp7CV92QEsKMRYU.exe

pid process

4864 Gp7CV92QEsKMRYU.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

Gp7CV92QEsKMRYU.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckhgbhpjghemojdhnelncljkmiackcci\2.0\manifest.json	Gp7CV92QEsKMRYU.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckhgbhpjghemojdhnelncljkmiackcci\2.0\manifest.json	Gp7CV92QEsKMRYU.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckhgbhpjghemojdhnelncljkmiackcci\2.0\manifest.json	Gp7CV92QEsKMRYU.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckhgbhpjghemojdhnelncljkmiackcci\2.0\manifest.json	Gp7CV92QEsKMRYU.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckhgbhpjghemojdhnelncljkmiackcci\2.0\manifest.json	Gp7CV92QEsKMRYU.exe

Drops file in System32 directory 4 IoCs

Processes:

Gp7CV92QEsKMRYU.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Gp7CV92QEsKMRYU.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Gp7CV92QEsKMRYU.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Gp7CV92QEsKMRYU.exe
File opened for modification	C:\Windows\System32\GroupPolicy	Gp7CV92QEsKMRYU.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

Gp7CV92QEsKMRYU.exe

pid	process
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe
4864	Gp7CV92QEsKMRYU.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Gp7CV92QEsKMRYU.exe

description	pid	process
Token: SeDebugPrivilege	4864	Gp7CV92QEsKMRYU.exe
Token: SeDebugPrivilege	4864	Gp7CV92QEsKMRYU.exe
Token: SeDebugPrivilege	4864	Gp7CV92QEsKMRYU.exe
Token: SeDebugPrivilege	4864	Gp7CV92QEsKMRYU.exe
Token: SeDebugPrivilege	4864	Gp7CV92QEsKMRYU.exe
Token: SeDebugPrivilege	4864	Gp7CV92QEsKMRYU.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99.exe

description	pid	process	target process
PID 4424 wrote to memory of 4864	4424	c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99.exe	Gp7CV92QEsKMRYU.exe
PID 4424 wrote to memory of 4864	4424	c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99.exe	Gp7CV92QEsKMRYU.exe
PID 4424 wrote to memory of 4864	4424	c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99.exe	Gp7CV92QEsKMRYU.exe

C:\Users\Admin\AppData\Local\Temp\c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99.exe
"C:\Users\Admin\AppData\Local\Temp\c3362ffae8162fd232f4d7fe93ce91404def2a4d20c618937129aeca82ed0b99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424

C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\Gp7CV92QEsKMRYU.exe
.\Gp7CV92QEsKMRYU.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\1U9r@sKIU96.org\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\1U9r@sKIU96.org\chrome.manifest
Filesize
35B

MD5
20839c891471bc4ade48c9a278f2e083

SHA1
d24e6f07846cda75c2156fc32fc380c9b292f221

SHA256
dba3f430100445e9e6c198a2654069eb5aea7180b24d6ca6b1216b3ca5b3f396

SHA512
cca5d0b5836f3c720292d6a3d177cfe82c675a68481dcadcd180df4ad4462d6c17767d397e8f7827d72ca4af905e6488c7f14d16ef720560e73d01c3cc72fd9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\1U9r@sKIU96.org\content\bg.js
Filesize
8KB

MD5
9ef0498a097c718ca363009c92228fac

SHA1
a211d4256d2803d4f6e6e7dc1e2f2854746f0aa8

SHA256
47364721a3f56b77aacb5f6646e9d26c87a5bd81d753ea91fb5c723706322954

SHA512
14aacb5850a42ffc30816fc723722c35db8a0d3e25dd6409300b9b6c881a9b9664b9023af4e09b3dbc4622a8cc64ab1ea90da7ca4559dfc89e1dbaf380b2b944

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\1U9r@sKIU96.org\install.rdf
Filesize
597B

MD5
45256ab749297a2c8452fccde6e3dc82

SHA1
025e67a0e3bb0f4728ef286191daefa9bce11dce

SHA256
e00426936c986ad097d3bb0fa34eab8717fd2d03aeabc534daeace1473be34f1

SHA512
715eba1ae68dc37c50124bc16268931de2798efad70bed2d739c595907d5ae739d2e2dc02e39024c7af84add5487ec120d0201b5367c777b4591293a76871b6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\Gp7CV92QEsKMRYU.dat
Filesize
1KB

MD5
9ce27b80561e6a5e6de2528d08fb1936

SHA1
d8945b63b7f823eece304303f1c3808f162bba8a

SHA256
5c91ede416aca706eaec98207c67879d78fa7e45903cd4d0a1d433d6a9918b95

SHA512
94b31191a105ebd9bc8c80fc6d27d62df3651adf5281a197a3a7c50f4d8ff146c881ee698c69286a60e0d07b6415c9a7cd1ac75be9703b92700c72fbc630463f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\Gp7CV92QEsKMRYU.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\Gp7CV92QEsKMRYU.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\ckhgbhpjghemojdhnelncljkmiackcci\B4Q9URn0Q.js
Filesize
6KB

MD5
a3a166496e160adb38f5f26277f3b3db

SHA1
7f1a45bc5614cc25538407a1cd00cc0f9dbe4776

SHA256
d841b9cbe9b7a5f0a729d4d22df9de64d6a10e83f5c57b198597a3b29fea3b01

SHA512
563c444d11685b3a05d1608b916ba868cb242e8103e0eac0267eddaaa8ce06e7e2c33745eb175900fc2b8e571a3f2018bf5b2069e5657b82b7857ac24c54585b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\ckhgbhpjghemojdhnelncljkmiackcci\background.html
Filesize
146B

MD5
d9207ad535d9d413fb8edcf8f8a884c6

SHA1
2f8f95dffaec3f7cf1048ef51f9d190dff35944d

SHA256
fe2202ab6344c986c853b05e380b3a2aa8a77405b27181dcece44d84c4387fab

SHA512
edb424e9067c8d8ff6183d83a951004ee8ec94fa075e5cd80eca8f20563f9ece9165287ad776b40af3d2d1974d985d0d073d367db7fc89a55cf58fad764ff37a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\ckhgbhpjghemojdhnelncljkmiackcci\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\ckhgbhpjghemojdhnelncljkmiackcci\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD71B.tmp\ckhgbhpjghemojdhnelncljkmiackcci\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4864-132-0x0000000000000000-mapping.dmp

Download