a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce

Analysis

max time kernel
178s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce.exe
Size

920KB
MD5

26e29547a738556c496afe82c0b798cb
SHA1

f6149845c56cf9a42f55fcae3042a35ba945cd4f
SHA256

a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce
SHA512

11765c24be596b43a94ac8a7cc29c1fe7db5e2fafdf16421a40dcb4ff9776c4c9faec2ae8819d3f407d9bfaacacf207f45a8600ccf66cc62769ba075afafc5ec
SSDEEP

24576:h1OYdaOfMtdHAqcdDVhYwiei7+EpFAh/kKD:h1OsiPHVmVhYwiLtKkKD

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

2eAiMVg5YF8ODZE.exe

pid process

2280 2eAiMVg5YF8ODZE.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

2eAiMVg5YF8ODZE.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpjaaofbhhknnejnjoghihajhonppapk\2.0\manifest.json	2eAiMVg5YF8ODZE.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpjaaofbhhknnejnjoghihajhonppapk\2.0\manifest.json	2eAiMVg5YF8ODZE.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpjaaofbhhknnejnjoghihajhonppapk\2.0\manifest.json	2eAiMVg5YF8ODZE.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpjaaofbhhknnejnjoghihajhonppapk\2.0\manifest.json	2eAiMVg5YF8ODZE.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpjaaofbhhknnejnjoghihajhonppapk\2.0\manifest.json	2eAiMVg5YF8ODZE.exe

Drops file in System32 directory 4 IoCs

Processes:

2eAiMVg5YF8ODZE.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	2eAiMVg5YF8ODZE.exe
File opened for modification	C:\Windows\System32\GroupPolicy	2eAiMVg5YF8ODZE.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	2eAiMVg5YF8ODZE.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	2eAiMVg5YF8ODZE.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

2eAiMVg5YF8ODZE.exe

pid	process
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe
2280	2eAiMVg5YF8ODZE.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

2eAiMVg5YF8ODZE.exe

description	pid	process
Token: SeDebugPrivilege	2280	2eAiMVg5YF8ODZE.exe
Token: SeDebugPrivilege	2280	2eAiMVg5YF8ODZE.exe
Token: SeDebugPrivilege	2280	2eAiMVg5YF8ODZE.exe
Token: SeDebugPrivilege	2280	2eAiMVg5YF8ODZE.exe
Token: SeDebugPrivilege	2280	2eAiMVg5YF8ODZE.exe
Token: SeDebugPrivilege	2280	2eAiMVg5YF8ODZE.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce.exe

description	pid	process	target process
PID 5084 wrote to memory of 2280	5084	a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce.exe	2eAiMVg5YF8ODZE.exe
PID 5084 wrote to memory of 2280	5084	a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce.exe	2eAiMVg5YF8ODZE.exe
PID 5084 wrote to memory of 2280	5084	a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce.exe	2eAiMVg5YF8ODZE.exe

C:\Users\Admin\AppData\Local\Temp\a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce.exe
"C:\Users\Admin\AppData\Local\Temp\a6254b1e23b8809c542108b0731626981ed669716253167c0cb2d7381195efce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\2eAiMVg5YF8ODZE.exe
.\2eAiMVg5YF8ODZE.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\2eAiMVg5YF8ODZE.dat
Filesize
1KB

MD5
8458d26632f1a3b3fe24247554d3e10b

SHA1
99bbe081720813d86a4c65498b8247677a6d3cab

SHA256
db32524459576941c7be4b9b0b2453d7e549f5d985a687821915e9496d9e7030

SHA512
1d2ce3f2290fe282350ad73216f1240fbb798b88940bf93c4b1093b95488287e3c7edf5f860120da9e90c9289eaa7c1872fc4a177dec4de30fd5bfe1cdfd3f58

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\2eAiMVg5YF8ODZE.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\2eAiMVg5YF8ODZE.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\jpjaaofbhhknnejnjoghihajhonppapk\background.html
Filesize
141B

MD5
7eb4bf7e2da9d2b7839f70e1506a7db6

SHA1
2980a619c2bb4f97c4b12f337c36a21f7a4c5e68

SHA256
4c2a88157db12f385f7c9edc0a8d6b718d00443d8407b41137551574367acaea

SHA512
47b3af5f6371d7d4dc3eb568778db23c54dc2b0e840b9c45b485274e184248b754d548d804b8e8645ca488fe39d5e225c2fc45c62906cb93f104dd2b001ca0c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\jpjaaofbhhknnejnjoghihajhonppapk\cb0X.js
Filesize
6KB

MD5
6e5d5940e26a7cd58ecfe99eb487587e

SHA1
8db66687fff3e9bad00289ecf743f2dfc562fd5c

SHA256
266b771dfae67b7fe096ef1f36b6c117c1066b236ae87a58f63aea1cd0f99f1d

SHA512
dd8ccc352e904d254916c4352fda9a4b90ffc99a403c5d2b946c064201efa0d7b6737aaaab4d05bab0e8b7d21d4b1c95c32a1758ca0c7fda062b45af01f01a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\jpjaaofbhhknnejnjoghihajhonppapk\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\jpjaaofbhhknnejnjoghihajhonppapk\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\jpjaaofbhhknnejnjoghihajhonppapk\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
26b315fa6a5266ca40edbea857481ab8

SHA1
a9e0af509f3d22a9a98c2f025c8e5b3f880d4861

SHA256
e9766f4af69f8b0d1f5ed1e6fbc0ab2441a8b1507d1faef97449ac68c804de2d

SHA512
29cadd6082417785fdf7fdd5f5876d5507cc0439f224e879656ebbb3f5faa68a845ae2f36fa9a207db88623df1a759ada5d1e99ae3817e5ab7c8efc3f930bb80

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
ddbc52b3dc5c1b0ab08a94e5f9306aef

SHA1
012861edcc530b676f38dd2de549d845ac96d767

SHA256
55b0c342ef4d8fd41ea7626416e5b290559a55bbd5da903412b4d2dea6ec1f63

SHA512
cae157fc58ecdcb60f84f3f5140ad1198ea468c2ca87f9de08ac5f8dd53563eb2797c3cd97f542d8fd476fb30c5d60dd1969ac656e957410887e8558500ec6c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC85.tmp\[email protected]\install.rdf
Filesize
593B

MD5
8cc4cc44c6615c364f1f4cae7c45c243

SHA1
6748d981c95b70310bdd0ae6dac602db4d2d97e8

SHA256
78b09620520d45f933fde005dd2322a39ff419a50c9c2affc7f3abba87d2f368

SHA512
8fc9bef8b71062672d1e68aa1e770487ec4128286afa044a1955c29465a9c39f02319d8ee2552dbc4f15b26ed395a66df86f803707c8232ce48f88106102197e

Download Submit
memory/2280-132-0x0000000000000000-mapping.dmp

Download