Analysis
-
max time kernel
3s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:12
Static task
static1
Behavioral task
behavioral1
Sample
a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe
Resource
win7-20221111-en
General
-
Target
a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe
-
Size
931KB
-
MD5
cb0ae06b7b6355884bd5cc24e4232719
-
SHA1
6bf440fdbcb0314f3d1e85edab40e6e83d65b277
-
SHA256
a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a
-
SHA512
d6e7ea5f004302ae66442e8afe1eef8588d8bd2180da79eadefca490515b885307d0ffd1a0512938ab4f4043ab25ed39a149c63683a214c0e5dc39dcce7edc97
-
SSDEEP
24576:h1OYdaORCZ/iWCvu/2sWsJA/jlt+DHhs+:h1OsPCpYO/dJJDHhs+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pzs8nMUS78RrTDZ.exepid process 896 pzs8nMUS78RrTDZ.exe -
Loads dropped DLL 1 IoCs
Processes:
a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exepid process 1408 a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
pzs8nMUS78RrTDZ.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\aamcbjilppfckadkihmdefofjhppcbcn\2.0\manifest.json pzs8nMUS78RrTDZ.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aamcbjilppfckadkihmdefofjhppcbcn\2.0\manifest.json pzs8nMUS78RrTDZ.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aamcbjilppfckadkihmdefofjhppcbcn\2.0\manifest.json pzs8nMUS78RrTDZ.exe -
Drops file in System32 directory 4 IoCs
Processes:
pzs8nMUS78RrTDZ.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy pzs8nMUS78RrTDZ.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini pzs8nMUS78RrTDZ.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol pzs8nMUS78RrTDZ.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI pzs8nMUS78RrTDZ.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
pzs8nMUS78RrTDZ.exepid process 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe 896 pzs8nMUS78RrTDZ.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
pzs8nMUS78RrTDZ.exedescription pid process Token: SeDebugPrivilege 896 pzs8nMUS78RrTDZ.exe Token: SeDebugPrivilege 896 pzs8nMUS78RrTDZ.exe Token: SeDebugPrivilege 896 pzs8nMUS78RrTDZ.exe Token: SeDebugPrivilege 896 pzs8nMUS78RrTDZ.exe Token: SeDebugPrivilege 896 pzs8nMUS78RrTDZ.exe Token: SeDebugPrivilege 896 pzs8nMUS78RrTDZ.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exedescription pid process target process PID 1408 wrote to memory of 896 1408 a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe pzs8nMUS78RrTDZ.exe PID 1408 wrote to memory of 896 1408 a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe pzs8nMUS78RrTDZ.exe PID 1408 wrote to memory of 896 1408 a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe pzs8nMUS78RrTDZ.exe PID 1408 wrote to memory of 896 1408 a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe pzs8nMUS78RrTDZ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe"C:\Users\Admin\AppData\Local\Temp\a684217851407774acdabbe04add40e13d54039410bbbb04a4516f9e3057528a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\pzs8nMUS78RrTDZ.exe.\pzs8nMUS78RrTDZ.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\aamcbjilppfckadkihmdefofjhppcbcn\background.htmlFilesize
142B
MD5881f10c6e433212ae0177d08e592489b
SHA10cbeca5966f74840ebb4fc64131aeeeb6ce0dadd
SHA2564148b6e07e51560cbb9d145ad3ffcd9b5639da6e378e364b0dffd450d33a1dec
SHA512b70131bcafe834a4635400ec226ae01301f885df7748f85600e4956662e9f19d97d5cbd0c89c5d11bd4aeaa222eeb9369a8fb671034899a8199dca590e0731a5
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\aamcbjilppfckadkihmdefofjhppcbcn\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\aamcbjilppfckadkihmdefofjhppcbcn\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\aamcbjilppfckadkihmdefofjhppcbcn\mXocC.jsFilesize
6KB
MD5cc2bcbb34965db36426dfa6635972b77
SHA1ff0ae4cd32a46dd39bbe745b67aefb3fcccfebf7
SHA256fecc03fc22a51f6c3d9bb622a7546134bf80418f8ca511177058426c5b77139c
SHA5128cee8604f034dd2fafbb9be878f550fa48e56d561e44468e0b1f1e6beca34be87ad4e28e82faeb2080f57b98ed5a3afa458769631d5b374ed13b735dd4d44375
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\aamcbjilppfckadkihmdefofjhppcbcn\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\[email protected]\chrome.manifestFilesize
35B
MD56d961943098a6a475f80ec0dac185dd0
SHA16e511200a3098834fae3495e1def2096e0c5b3da
SHA25681c5980f541c8e36356ebbd687d2366360f622f70726747c1c5b65bf3ac21048
SHA51239490df7b7296438ce3b5bff891d83191a9a0e4e0be20fc750f3e1f016ede8d115a08ea761a36345aafbc300856f19b609263f85bb1bafde01d0301549fbdcb5
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\[email protected]\content\bg.jsFilesize
8KB
MD553f20fd974e46f89ea1dbde299cd4d89
SHA1a935372eac852c3ee09a94b6b2fbf1d9747d3091
SHA2565d471263839452b04ae068733ea72bff31ec6175322f96af165971b323bc242b
SHA5127800042e369abdeff02ba36664a2cf5d8ea160c3f1677f1476bed57ee883cfd0d90a402b23c0500e7838f5262459744ae8b154d6e2d0f25fde9cc72aa30e3157
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\[email protected]\install.rdfFilesize
593B
MD59b8d1cc165f4263b3dffe84f0996125a
SHA179d3425ea353431e1a29db9fe8a362baaffd0e40
SHA25681e2044c526ff6e7804926e0e0a1e5370d3925032d6a85c9ca24a6b578909a1c
SHA51266d44a8465baad775cc7ffa75a913255ce793f47d2b5736e876acf4ae725127db43d2260d2d43dcca637d3fcc7369cba93028e7d1092dd9ba316378661d55db0
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\pzs8nMUS78RrTDZ.datFilesize
1KB
MD569f48197a114140d4e72b66398d6e556
SHA15db1089dcf0ccb71049d56476100266d024f0a40
SHA256480f3b638f4f73287705193e4f4dbe3a2f6079c98ab539d209286287960e5b49
SHA5125a7868eec11390634fa1a4d640da9320b20761c8b84f65ed01082979548aaf3571d89e3183b81032db4e143fccb0f1ba7e7f4fca0d888994aca2a1da80bd847d
-
C:\Users\Admin\AppData\Local\Temp\7zS9770.tmp\pzs8nMUS78RrTDZ.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
\Users\Admin\AppData\Local\Temp\7zS9770.tmp\pzs8nMUS78RrTDZ.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/896-56-0x0000000000000000-mapping.dmp
-
memory/1408-54-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB