c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4

Analysis

max time kernel
110s
max time network
197s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe
Size

931KB
MD5

ebf2d837b38657cd51c910be491d1a5b
SHA1

de0b8366d95b35c7bd7af464e4697c311ecc127d
SHA256

c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4
SHA512

941fd17128e1fb3581928dd88c3b3b86b686e9f5b4cd5eb88854347eff1ac82e88220ec661c85f5f81b9d72836f302c4a2aabf9adfd1e21388a8d3d433447a97
SSDEEP

24576:h1OYdaOhCZ/iWCvu/2sWsJA/jlt+DHhs7:h1OszCpYO/dJJDHhs7

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

MMu65LXr731QlP5.exe

pid process

1044 MMu65LXr731QlP5.exe
Loads dropped DLL 1 IoCs

Processes:

c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe

pid process

1164 c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1164	c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe

Drops Chrome extension 3 IoCs

Processes:

MMu65LXr731QlP5.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\phffjklhcahjbgllkccjihbbjgmndjoa\2.0\manifest.json	MMu65LXr731QlP5.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\phffjklhcahjbgllkccjihbbjgmndjoa\2.0\manifest.json	MMu65LXr731QlP5.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\phffjklhcahjbgllkccjihbbjgmndjoa\2.0\manifest.json	MMu65LXr731QlP5.exe

Drops file in System32 directory 4 IoCs

Processes:

MMu65LXr731QlP5.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	MMu65LXr731QlP5.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	MMu65LXr731QlP5.exe
File opened for modification	C:\Windows\System32\GroupPolicy	MMu65LXr731QlP5.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	MMu65LXr731QlP5.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

MMu65LXr731QlP5.exe

pid	process
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe
1044	MMu65LXr731QlP5.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

MMu65LXr731QlP5.exe

description	pid	process
Token: SeDebugPrivilege	1044	MMu65LXr731QlP5.exe
Token: SeDebugPrivilege	1044	MMu65LXr731QlP5.exe
Token: SeDebugPrivilege	1044	MMu65LXr731QlP5.exe
Token: SeDebugPrivilege	1044	MMu65LXr731QlP5.exe
Token: SeDebugPrivilege	1044	MMu65LXr731QlP5.exe
Token: SeDebugPrivilege	1044	MMu65LXr731QlP5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe

description	pid	process	target process
PID 1164 wrote to memory of 1044	1164	c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe	MMu65LXr731QlP5.exe
PID 1164 wrote to memory of 1044	1164	c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe	MMu65LXr731QlP5.exe
PID 1164 wrote to memory of 1044	1164	c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe	MMu65LXr731QlP5.exe
PID 1164 wrote to memory of 1044	1164	c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe	MMu65LXr731QlP5.exe

C:\Users\Admin\AppData\Local\Temp\c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe
"C:\Users\Admin\AppData\Local\Temp\c0e1e7e952cc43274a1ceaa6d78966918f2ff80cf3fb49ddb6a473fcd46066d4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1164

C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\MMu65LXr731QlP5.exe
.\MMu65LXr731QlP5.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\MMu65LXr731QlP5.dat
Filesize
1KB

MD5
7d6e9fad7298837513e89e6f34ba0b2e

SHA1
514dfe212aace9c996a9e6400412d6e0eaf88446

SHA256
80b96227b8fa8407ed74795c76bbe62b6affbc2c5767145a37dc5f6404f662de

SHA512
8235f94bb3c29c302a7ead4c8d876c8c81ba4a4117187af15aad626b1054896ee7c3e68e1bd95de4e1cc117e893779f447ec3c50bc8a1d0143c351ac56ede2a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\MMu65LXr731QlP5.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
783fc2c9b25229acb7c3fc4b3282ac33

SHA1
bfb4904952a2bc61bd2a97f9c50d174813c0e0d2

SHA256
87097377d28ffc47b3fd014d4c5d6370c85f3b0f95a9bbf8d02b54ccdc917e47

SHA512
1b463e33809564b86959dde355ebd355a7964ad778147753beca1fb851b7b592c793671e6f1934a2103bf2f9150b9194f9b11bc46e1f6b2e4703c3870f023440

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
e92e3ec666b6840203021f5e7fcaa021

SHA1
77722c49637f7a264248f9a83b825de4d14346e4

SHA256
e1ac9fb84eb3958e1a2bcdf74c61c02f89a4d73090f3f743030b047dc1a8dafd

SHA512
a7ca4841c8e40e09db2f28f85e6a0f029b83958674606831e1c14c7779e5f1ab227d5d9fbdf92d88a888ed24a9e83a081227cba67fc72d71554ef127a63f53c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\[email protected]\install.rdf
Filesize
591B

MD5
3bdb189fc80dfa978cf22ab750bcab19

SHA1
68f071b3769c12d8eb701baf887ace18fe26a6f3

SHA256
72f77013482e926ebd6c7927153f8fd1f778cdba0308f258f7004c47b3196356

SHA512
bc69e58d2a6f15f2677d3f5a4d045011e01120999351beb062382a77bbe794f87e88bd7cec8163781f5e6f740c2422d72ecfa0dd3b95491e5f5075c8f2685520

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\phffjklhcahjbgllkccjihbbjgmndjoa\MMFOR.js
Filesize
6KB

MD5
543bd9052daef9e283a660766453e4a8

SHA1
cfa59c8f007eca34db09287d66d8685b68749398

SHA256
f0bf97b5f9131ce6ab54ba96edaa5d9adf3a10fff8a66e7f9c4ea208b7bd5ad1

SHA512
5fed2d2ea2a4b657e97c58daca9ee4bc65fc5b173551dcaab5f682849d78bf499277610807028469bb1dee168ec547a10977e703c800e93659bcccb4279c1b98

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\phffjklhcahjbgllkccjihbbjgmndjoa\background.html
Filesize
142B

MD5
1d2b3b996c6df920e95ba864768825f8

SHA1
f387b93b11a9e4511e3f649826eb1d0af33993ab

SHA256
0338ef6f81bab0e8875543abdd4610020346d5400c4559ff12bfc939c73efe0a

SHA512
8c3de8f10eb26c45ae6897f66fff4a055f8544dad05a759f383be65240bfe9ad4a01bd3df05348bb6bf59e37ec888d4b91041b453f857f7affffc9a7b454cb80

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\phffjklhcahjbgllkccjihbbjgmndjoa\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\phffjklhcahjbgllkccjihbbjgmndjoa\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\phffjklhcahjbgllkccjihbbjgmndjoa\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7B68.tmp\MMu65LXr731QlP5.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1044-56-0x0000000000000000-mapping.dmp

Download
memory/1164-54-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads