c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c.exe
Size

920KB
MD5

6c09eddd4c00ee22e33ed35003b33886
SHA1

4c858f570db055e785a3b60b5cdbcff00d798f1c
SHA256

c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c
SHA512

981fb7edd837d08fdc4375c1de39a889808fb5caae3696f98d6dcbd1a235ef7d1f3aabc7189f384f37667579e0d3f54ec8525569373c7158f332f04757a8a9c4
SSDEEP

24576:h1OYdaORMtdHAqcdDVhYwiei7+EpFAh/kK1:h1OswPHVmVhYwiLtKkK1

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

88O06HlyphcvYTL.exe

pid process

1016 88O06HlyphcvYTL.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

88O06HlyphcvYTL.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppainoacejdhajgabhbblfnnbcogdaf\2.0\manifest.json	88O06HlyphcvYTL.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppainoacejdhajgabhbblfnnbcogdaf\2.0\manifest.json	88O06HlyphcvYTL.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppainoacejdhajgabhbblfnnbcogdaf\2.0\manifest.json	88O06HlyphcvYTL.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppainoacejdhajgabhbblfnnbcogdaf\2.0\manifest.json	88O06HlyphcvYTL.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppainoacejdhajgabhbblfnnbcogdaf\2.0\manifest.json	88O06HlyphcvYTL.exe

Drops file in System32 directory 4 IoCs

Processes:

88O06HlyphcvYTL.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	88O06HlyphcvYTL.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	88O06HlyphcvYTL.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	88O06HlyphcvYTL.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	88O06HlyphcvYTL.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

88O06HlyphcvYTL.exe

pid	process
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe
1016	88O06HlyphcvYTL.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

88O06HlyphcvYTL.exe

description	pid	process
Token: SeDebugPrivilege	1016	88O06HlyphcvYTL.exe
Token: SeDebugPrivilege	1016	88O06HlyphcvYTL.exe
Token: SeDebugPrivilege	1016	88O06HlyphcvYTL.exe
Token: SeDebugPrivilege	1016	88O06HlyphcvYTL.exe
Token: SeDebugPrivilege	1016	88O06HlyphcvYTL.exe
Token: SeDebugPrivilege	1016	88O06HlyphcvYTL.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c.exe

description	pid	process	target process
PID 4876 wrote to memory of 1016	4876	c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c.exe	88O06HlyphcvYTL.exe
PID 4876 wrote to memory of 1016	4876	c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c.exe	88O06HlyphcvYTL.exe
PID 4876 wrote to memory of 1016	4876	c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c.exe	88O06HlyphcvYTL.exe

C:\Users\Admin\AppData\Local\Temp\c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c.exe
"C:\Users\Admin\AppData\Local\Temp\c02c2deec4059db79ec9f7968ba13eb738a58b8e2e8f80b437074c9d247cfd8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876

C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\88O06HlyphcvYTL.exe
.\88O06HlyphcvYTL.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
c27c9e0db25bc2a3e50bb0be5d7ecb7e

SHA1
f9cd459e44803d0506136b287f17fc108de68763

SHA256
be28cd4660430c935338d474e227910c6b595f84336ed779a03a30f94a65e9a1

SHA512
59f03b3092811b82d2a9d05394fd00f6960a0c97a4b0f80dbe413afd55da7e69972a3c1feffa5f224ef6beefc6bcb43b800c59071a74b2d2c6b08a42b8363dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
c86832adcf7e9c7aee9864c65df686cd

SHA1
2f7a4d969c6e927db71dfd20706a5373d8419222

SHA256
89d386d4120e4ef7b92fa71db48bfab5c2d4d13c605c33fd32a7a17f3c15e298

SHA512
272338316cb730b65d3d7a5d046d2357bbd67f7d94eb33000cb7d3fb72be4a7297c7d3482d27f96990958a20c9eaa3edd4e023f11709cd8c64ae1ade03d56bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\[email protected]\install.rdf
Filesize
595B

MD5
459b388cc37e388c5ceedbfdedcb814a

SHA1
78d4a97f9b19dfa636c92a8458fe0c792a8c0d6f

SHA256
84d3c0d86622fb814b7d1936b8f556063d01782a10f2972558cdabdfeb1de632

SHA512
78ca97f83d747652ef74d215f33ddb61f73684159cd85da1ffdebe21584afe4d8451c2ba560559ad2a9697dbf3369cfa252d797737d070a23eee5f4aa255baf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\88O06HlyphcvYTL.dat
Filesize
1KB

MD5
d9407bcfa34323bb9cfddde8c326db16

SHA1
b11096bf706a71c637be69d703958538121948df

SHA256
9d12010b1ad33264e368e883206fbb1714de38789d2a51c6e438beaf581e24ee

SHA512
aeb3a22305926b08e879779315b886a504a4ff152ce61398c05e926a897d9357ba3fd94951925019fa456d0be81b266f4c71abec8f83246e4c4fd39e08a7f11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\88O06HlyphcvYTL.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\88O06HlyphcvYTL.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\cppainoacejdhajgabhbblfnnbcogdaf\background.html
Filesize
146B

MD5
63fcda601a8ae09de11839bab1f01d2c

SHA1
99c558c69ec80b03e67ff94b1ef28165d707556b

SHA256
ef880c3d4972cc7c944af06403d04dd48dc56e69e2375f4f363fd03f65f4bb12

SHA512
ec373ac42753fae8a1512d52846e0c936d84b9e7f00d551aa90b99534300cc5fec50405681f014284dc2dc9ce4ff467b1872b3870769080a132a4c51c3f81491

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\cppainoacejdhajgabhbblfnnbcogdaf\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\cppainoacejdhajgabhbblfnnbcogdaf\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\cppainoacejdhajgabhbblfnnbcogdaf\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC047.tmp\cppainoacejdhajgabhbblfnnbcogdaf\ys8Tlvz1w.js
Filesize
6KB

MD5
248d09a0656950f27646ea5288b0d22d

SHA1
46840d2326bf40cf9d10fd58c41e9e4a6eecbd96

SHA256
ff69334b58e530ffca95b6f2c5b344edd1e677c51dab9d5097cce8bab9df38f7

SHA512
0910d006f5d0e361a309c535b4fe696a5aedab4a273e758699f4573ff04ffba7a9035af133abb3ec67eb3154b8eb70459e5c34c5848b72838e93d1d58ec01859

Download Submit
memory/1016-132-0x0000000000000000-mapping.dmp

Download