Analysis
-
max time kernel
29s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:42
Static task
static1
Behavioral task
behavioral1
Sample
c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe
Resource
win7-20221111-en
General
-
Target
c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe
-
Size
931KB
-
MD5
a05f8bc2140308f71166c48616120b5f
-
SHA1
859839975fd63309273c7905faa4e1973a25d822
-
SHA256
c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f
-
SHA512
e8415ad43a94311bc08b8038643d4c48f1cb155e54986106761bf190f26e8d578816c76118248df38ac644f0df9a0173a772428f382791505d7b68f0926f7003
-
SSDEEP
24576:h1OYdaOHCZ/iWCvu/2sWsJA/jlt+DHhsq:h1OsRCpYO/dJJDHhsq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
yPVTHtESzS6eRNa.exepid process 1388 yPVTHtESzS6eRNa.exe -
Loads dropped DLL 1 IoCs
Processes:
c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exepid process 1396 c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
yPVTHtESzS6eRNa.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefdigjejgmnbkghcnfgljckhedgbolo\2.0\manifest.json yPVTHtESzS6eRNa.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefdigjejgmnbkghcnfgljckhedgbolo\2.0\manifest.json yPVTHtESzS6eRNa.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefdigjejgmnbkghcnfgljckhedgbolo\2.0\manifest.json yPVTHtESzS6eRNa.exe -
Drops file in System32 directory 4 IoCs
Processes:
yPVTHtESzS6eRNa.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini yPVTHtESzS6eRNa.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol yPVTHtESzS6eRNa.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI yPVTHtESzS6eRNa.exe File opened for modification C:\Windows\System32\GroupPolicy yPVTHtESzS6eRNa.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
yPVTHtESzS6eRNa.exepid process 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe 1388 yPVTHtESzS6eRNa.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
yPVTHtESzS6eRNa.exedescription pid process Token: SeDebugPrivilege 1388 yPVTHtESzS6eRNa.exe Token: SeDebugPrivilege 1388 yPVTHtESzS6eRNa.exe Token: SeDebugPrivilege 1388 yPVTHtESzS6eRNa.exe Token: SeDebugPrivilege 1388 yPVTHtESzS6eRNa.exe Token: SeDebugPrivilege 1388 yPVTHtESzS6eRNa.exe Token: SeDebugPrivilege 1388 yPVTHtESzS6eRNa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exedescription pid process target process PID 1396 wrote to memory of 1388 1396 c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe yPVTHtESzS6eRNa.exe PID 1396 wrote to memory of 1388 1396 c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe yPVTHtESzS6eRNa.exe PID 1396 wrote to memory of 1388 1396 c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe yPVTHtESzS6eRNa.exe PID 1396 wrote to memory of 1388 1396 c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe yPVTHtESzS6eRNa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe"C:\Users\Admin\AppData\Local\Temp\c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\yPVTHtESzS6eRNa.exe.\yPVTHtESzS6eRNa.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\daZzLyaDO@ys.org\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\daZzLyaDO@ys.org\chrome.manifestFilesize
35B
MD5a4e181cbafb5fd2ff1cb7af472a87441
SHA1ba90df37f5956768099ed33f88a62bceb6ac2919
SHA256473512cb27aa287f9ed7d281bb633e751db77ca0e92abc4b8232f5ffb80ae534
SHA512053f6374b2c6de3a86e9fed2576f1e2e590c86c5a9f42cd26219a28cf45b40d42935c38faac7fd824e9562c873f306498b1995c69976b08ca812045cbea2f648
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\daZzLyaDO@ys.org\content\bg.jsFilesize
8KB
MD592ea93023a010ad028309c44b928dde5
SHA118cf3be0e36115340c838f0488ffc42cd6950ed7
SHA2560ae60e4f996a0a6936bd6022ab5bd4a6473f6ac765fd22dc216a9622d6ce163c
SHA51259b30de5a68205c2b991f11976351c6675dea2014b7db4cbbd11ba0ef6592248c90f98f60dd03a9847d048ad42ec7e732b6edd3197e7b92d67712191315e5fec
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\daZzLyaDO@ys.org\install.rdfFilesize
599B
MD5db19472bf43373639195100a9099031f
SHA166b5c729e4038cf9a5f47decaaf8c0b72a01f3bb
SHA256e85ebd6893243a7e08a21f3890ab38448c33cf405ada00049ce7c03b33ac091a
SHA5124fffee2b648babc0ef6e80597c0f4737aeba19b29c01013b2f4c319ab54b9b991b5c13e0a4554688ff7cd42c016efbb325b563093823b0897a3dc7641bbe9be2
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\background.htmlFilesize
142B
MD554093e76716fc48da03e77d73319833d
SHA1b34227bc9c171dbd8d0f3332d9eac9be8c5574ff
SHA2560ebfaf4e2f4f855f436d4cdaf9ae79d0e0e70388501bcf431d16d9015f45ab1f
SHA512d361ca5955ca9d84d2b8d105d8d265a4032c77d4640e11e5076ff0fa50e4cd45bb419f7a04cba4e35667e98cf8c78b1cd1fc8080dd42be256cf43450dc0ac4e3
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\cxaFq.jsFilesize
6KB
MD5d4c41cc45145a82bd19026af794a6415
SHA1b6e258a0561477cc6c6eff21ad072fbcf4588029
SHA256c3bb149b5a990023d52a15e9f77d66a9bf09e9d4a3315c8d0462cf85023ab9d3
SHA512abe99d4b95abdd7400e0b98647928db5a0a42c120aee8adcc87ea5bfde5c1e0a1345fa8b05d7baebd2032fa365908c422057b04d13f070516dd351125ff92a9b
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\yPVTHtESzS6eRNa.datFilesize
1KB
MD5322d127b2dd59f1d88a1b225d8c486dd
SHA1aba347efecf9d4fbfe18809c03f1f240787cad88
SHA2563a614cd85ecbb0cd2ad726ef10a7e855995f47809ceebd5addadf9d766f5260a
SHA5127bda9ab1eefaa90a631d4aa634e6be663217b9e0da9302fc9634fda9378baa69d4c92939b9dfa9028b2ad75ce3ca4668ba7a32551628cae88307c741a041e069
-
C:\Users\Admin\AppData\Local\Temp\7zS465.tmp\yPVTHtESzS6eRNa.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
\Users\Admin\AppData\Local\Temp\7zS465.tmp\yPVTHtESzS6eRNa.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/1388-56-0x0000000000000000-mapping.dmp
-
memory/1396-54-0x00000000754C1000-0x00000000754C3000-memory.dmpFilesize
8KB