c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe
Size

931KB
MD5

a05f8bc2140308f71166c48616120b5f
SHA1

859839975fd63309273c7905faa4e1973a25d822
SHA256

c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f
SHA512

e8415ad43a94311bc08b8038643d4c48f1cb155e54986106761bf190f26e8d578816c76118248df38ac644f0df9a0173a772428f382791505d7b68f0926f7003
SSDEEP

24576:h1OYdaOHCZ/iWCvu/2sWsJA/jlt+DHhsq:h1OsRCpYO/dJJDHhsq

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

yPVTHtESzS6eRNa.exe

pid process

2140 yPVTHtESzS6eRNa.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

yPVTHtESzS6eRNa.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefdigjejgmnbkghcnfgljckhedgbolo\2.0\manifest.json	yPVTHtESzS6eRNa.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefdigjejgmnbkghcnfgljckhedgbolo\2.0\manifest.json	yPVTHtESzS6eRNa.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefdigjejgmnbkghcnfgljckhedgbolo\2.0\manifest.json	yPVTHtESzS6eRNa.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefdigjejgmnbkghcnfgljckhedgbolo\2.0\manifest.json	yPVTHtESzS6eRNa.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefdigjejgmnbkghcnfgljckhedgbolo\2.0\manifest.json	yPVTHtESzS6eRNa.exe

Drops file in System32 directory 4 IoCs

Processes:

yPVTHtESzS6eRNa.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	yPVTHtESzS6eRNa.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	yPVTHtESzS6eRNa.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	yPVTHtESzS6eRNa.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	yPVTHtESzS6eRNa.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

yPVTHtESzS6eRNa.exe

pid	process
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe
2140	yPVTHtESzS6eRNa.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

yPVTHtESzS6eRNa.exe

description	pid	process
Token: SeDebugPrivilege	2140	yPVTHtESzS6eRNa.exe
Token: SeDebugPrivilege	2140	yPVTHtESzS6eRNa.exe
Token: SeDebugPrivilege	2140	yPVTHtESzS6eRNa.exe
Token: SeDebugPrivilege	2140	yPVTHtESzS6eRNa.exe
Token: SeDebugPrivilege	2140	yPVTHtESzS6eRNa.exe
Token: SeDebugPrivilege	2140	yPVTHtESzS6eRNa.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe

description	pid	process	target process
PID 1956 wrote to memory of 2140	1956	c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe	yPVTHtESzS6eRNa.exe
PID 1956 wrote to memory of 2140	1956	c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe	yPVTHtESzS6eRNa.exe
PID 1956 wrote to memory of 2140	1956	c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe	yPVTHtESzS6eRNa.exe

C:\Users\Admin\AppData\Local\Temp\c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe
"C:\Users\Admin\AppData\Local\Temp\c287c31b10f75b951dd9bc9af90da75fbe39cb4465777856101e3e338342616f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\yPVTHtESzS6eRNa.exe
.\yPVTHtESzS6eRNa.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\daZzLyaDO@ys.org\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\daZzLyaDO@ys.org\chrome.manifest
Filesize
35B

MD5
a4e181cbafb5fd2ff1cb7af472a87441

SHA1
ba90df37f5956768099ed33f88a62bceb6ac2919

SHA256
473512cb27aa287f9ed7d281bb633e751db77ca0e92abc4b8232f5ffb80ae534

SHA512
053f6374b2c6de3a86e9fed2576f1e2e590c86c5a9f42cd26219a28cf45b40d42935c38faac7fd824e9562c873f306498b1995c69976b08ca812045cbea2f648

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\daZzLyaDO@ys.org\content\bg.js
Filesize
8KB

MD5
92ea93023a010ad028309c44b928dde5

SHA1
18cf3be0e36115340c838f0488ffc42cd6950ed7

SHA256
0ae60e4f996a0a6936bd6022ab5bd4a6473f6ac765fd22dc216a9622d6ce163c

SHA512
59b30de5a68205c2b991f11976351c6675dea2014b7db4cbbd11ba0ef6592248c90f98f60dd03a9847d048ad42ec7e732b6edd3197e7b92d67712191315e5fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\daZzLyaDO@ys.org\install.rdf
Filesize
599B

MD5
db19472bf43373639195100a9099031f

SHA1
66b5c729e4038cf9a5f47decaaf8c0b72a01f3bb

SHA256
e85ebd6893243a7e08a21f3890ab38448c33cf405ada00049ce7c03b33ac091a

SHA512
4fffee2b648babc0ef6e80597c0f4737aeba19b29c01013b2f4c319ab54b9b991b5c13e0a4554688ff7cd42c016efbb325b563093823b0897a3dc7641bbe9be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\background.html
Filesize
142B

MD5
54093e76716fc48da03e77d73319833d

SHA1
b34227bc9c171dbd8d0f3332d9eac9be8c5574ff

SHA256
0ebfaf4e2f4f855f436d4cdaf9ae79d0e0e70388501bcf431d16d9015f45ab1f

SHA512
d361ca5955ca9d84d2b8d105d8d265a4032c77d4640e11e5076ff0fa50e4cd45bb419f7a04cba4e35667e98cf8c78b1cd1fc8080dd42be256cf43450dc0ac4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\cxaFq.js
Filesize
6KB

MD5
d4c41cc45145a82bd19026af794a6415

SHA1
b6e258a0561477cc6c6eff21ad072fbcf4588029

SHA256
c3bb149b5a990023d52a15e9f77d66a9bf09e9d4a3315c8d0462cf85023ab9d3

SHA512
abe99d4b95abdd7400e0b98647928db5a0a42c120aee8adcc87ea5bfde5c1e0a1345fa8b05d7baebd2032fa365908c422057b04d13f070516dd351125ff92a9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\pefdigjejgmnbkghcnfgljckhedgbolo\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\yPVTHtESzS6eRNa.dat
Filesize
1KB

MD5
322d127b2dd59f1d88a1b225d8c486dd

SHA1
aba347efecf9d4fbfe18809c03f1f240787cad88

SHA256
3a614cd85ecbb0cd2ad726ef10a7e855995f47809ceebd5addadf9d766f5260a

SHA512
7bda9ab1eefaa90a631d4aa634e6be663217b9e0da9302fc9634fda9378baa69d4c92939b9dfa9028b2ad75ce3ca4668ba7a32551628cae88307c741a041e069

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\yPVTHtESzS6eRNa.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9501.tmp\yPVTHtESzS6eRNa.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/2140-132-0x0000000000000000-mapping.dmp

Download