Analysis
-
max time kernel
8s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:44
Static task
static1
Behavioral task
behavioral1
Sample
c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe
Resource
win7-20220812-en
General
-
Target
c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe
-
Size
920KB
-
MD5
26148578412c00af19fa1ad9a79fe548
-
SHA1
852ccdca4bebb53ea6e07cc24a974309cd810b76
-
SHA256
c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d
-
SHA512
0d52fcd8c961caf5e657b70e25b6a38047d5b6c66bdaab9bc50e0a6a47d63f6fc2f80302063ae338a22f4846ca4a0d577c0709c46395cbb1470515c473db91b0
-
SSDEEP
24576:h1OYdaOxMtdHAqcdDVhYwiei7+EpFAh/kKZ:h1OsQPHVmVhYwiLtKkKZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
eqfFYoGr0NKgOJa.exepid process 1520 eqfFYoGr0NKgOJa.exe -
Loads dropped DLL 1 IoCs
Processes:
c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exepid process 1628 c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
eqfFYoGr0NKgOJa.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omcppbgjibmflhaijoihcemoakojbaoh\2.0\manifest.json eqfFYoGr0NKgOJa.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\omcppbgjibmflhaijoihcemoakojbaoh\2.0\manifest.json eqfFYoGr0NKgOJa.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\omcppbgjibmflhaijoihcemoakojbaoh\2.0\manifest.json eqfFYoGr0NKgOJa.exe -
Drops file in System32 directory 4 IoCs
Processes:
eqfFYoGr0NKgOJa.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy eqfFYoGr0NKgOJa.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini eqfFYoGr0NKgOJa.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol eqfFYoGr0NKgOJa.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI eqfFYoGr0NKgOJa.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
eqfFYoGr0NKgOJa.exepid process 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe 1520 eqfFYoGr0NKgOJa.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
eqfFYoGr0NKgOJa.exedescription pid process Token: SeDebugPrivilege 1520 eqfFYoGr0NKgOJa.exe Token: SeDebugPrivilege 1520 eqfFYoGr0NKgOJa.exe Token: SeDebugPrivilege 1520 eqfFYoGr0NKgOJa.exe Token: SeDebugPrivilege 1520 eqfFYoGr0NKgOJa.exe Token: SeDebugPrivilege 1520 eqfFYoGr0NKgOJa.exe Token: SeDebugPrivilege 1520 eqfFYoGr0NKgOJa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exedescription pid process target process PID 1628 wrote to memory of 1520 1628 c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe eqfFYoGr0NKgOJa.exe PID 1628 wrote to memory of 1520 1628 c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe eqfFYoGr0NKgOJa.exe PID 1628 wrote to memory of 1520 1628 c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe eqfFYoGr0NKgOJa.exe PID 1628 wrote to memory of 1520 1628 c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe eqfFYoGr0NKgOJa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe"C:\Users\Admin\AppData\Local\Temp\c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\eqfFYoGr0NKgOJa.exe.\eqfFYoGr0NKgOJa.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\JH@v.edu\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\JH@v.edu\chrome.manifestFilesize
35B
MD5868058810ae01ee63cd4417f1a10f095
SHA1550ec059f0490159523b7a2135acbd0e3b17704d
SHA256184eec8dd6110e5fb0aa68894a7f873a2c5d0a7c650ac26060d899e8b0ccebb7
SHA5123069019f453015bf275d79aaca41a52384f2698394abf2062df68d5ec8711d95be6cea138f3b34fa75ccfe3ffa55dbfdf2727b1271ede8e85b0259875786dee6
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\JH@v.edu\content\bg.jsFilesize
8KB
MD53ce743120504454d4c0306d4542de8e7
SHA198fbd3d0a3c6ba1ee484b960ab8e0fd3ceb29c81
SHA25615666888e6fee28534b0a2719a56c67f6796a7fd76ff1485b2fa0e23573c0a9e
SHA512764183cf8093bb63ead6dfa64a98ea7896f9e58b28fa2f3e7fcf0059ffc9d5e6342eb1ace9abe618d39b2b04edc10794acd0778f382a514bdb4a2cb9a7ba4369
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\JH@v.edu\install.rdfFilesize
590B
MD57b7217e61dc4d897dee2c265981098f4
SHA1abda438e6fb53c8473a5106f81c86ab5351ca006
SHA256d1fd0d5225016d133d163e8c2b4cc5e575dd28fbfe99ca931945bdd7aab7544e
SHA5123c3b6c260ee537bca928f9396098e15b24e966284a939bc7c6fb68221c6f77867f6faece9da5ba4b9b33cf6c3d74b73eda22247fff8cd3fb5ae1c82a6a509af9
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\eqfFYoGr0NKgOJa.datFilesize
1KB
MD5a4929ce808284ce017878b61f3d35ce4
SHA1ff03922edb0e74484ee58222a1cd91b215744e96
SHA25662ee001ba524e017092747a3289ef242781835f5d6047b890e3380be2a284f29
SHA51230e79984902a7fdc4cb11a4a47d280aadd9f54f89f0dd27506629fbb6671dc6642b2e43bf2d64e9ae99060a929f4eab7f6dede6b00ac419cfab6e18b4d1ca407
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\eqfFYoGr0NKgOJa.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\omcppbgjibmflhaijoihcemoakojbaoh\B.jsFilesize
6KB
MD5ec470857e5505ab70ff300b42b23217b
SHA1e4bd27022bae8519bf311673611daaa29f9345f6
SHA256e80e5867dfa8ee6119ea99aceed77ee811654bb9d06e076d60ed59d6cd75c8fe
SHA512f12283fd6e8ade68eb39eb4d327230f562de43afe84609b9cf3418f1a61e0ded31c094f2345679c6a841ed2acdd0b45d069d88f89f8fc32cba8ff78c20c71a5d
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\omcppbgjibmflhaijoihcemoakojbaoh\background.htmlFilesize
138B
MD5ecc7692f5e5d2ac328b6585fbffef9bb
SHA105a55705ab0a85a481fab94ef4ab98745e0e54ae
SHA256c46d8b1e0a0b08d8eeeec335402bfdec048efc95255c26cff2cd552453b77f09
SHA512369956733c512f7174e7d51ee8f498f95b39dc3f4f8574f5c7a11ca8871f6b3855a7496d19d8d070b68f4f13e9bc745ba317ecabd92aea9b351db9957450f6de
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\omcppbgjibmflhaijoihcemoakojbaoh\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\omcppbgjibmflhaijoihcemoakojbaoh\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS9426.tmp\omcppbgjibmflhaijoihcemoakojbaoh\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zS9426.tmp\eqfFYoGr0NKgOJa.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/1520-56-0x0000000000000000-mapping.dmp
-
memory/1628-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB