a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9.exe
Size

920KB
MD5

fce34931134559fce5a4779ae083a589
SHA1

a6b7b59c40d6ace29d92ef04ff6943867abf6da8
SHA256

a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9
SHA512

da768c35f4a9568da75819232e924eba01ced473190c746079baa93b50d11503e40ab84a64be712882cfda0998c24b84805eb2cf012e955a754497f7d07a0c19
SSDEEP

24576:h1OYdaOlMtdHAqcdDVhYwiei7+EpFAh/kKR:h1OsoPHVmVhYwiLtKkKR

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

t7R7ZNjVTNpOyaC.exe

pid process

4680 t7R7ZNjVTNpOyaC.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

t7R7ZNjVTNpOyaC.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdddplkglbcepeeohcimakmghpcckdli\2.0\manifest.json	t7R7ZNjVTNpOyaC.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdddplkglbcepeeohcimakmghpcckdli\2.0\manifest.json	t7R7ZNjVTNpOyaC.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdddplkglbcepeeohcimakmghpcckdli\2.0\manifest.json	t7R7ZNjVTNpOyaC.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdddplkglbcepeeohcimakmghpcckdli\2.0\manifest.json	t7R7ZNjVTNpOyaC.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdddplkglbcepeeohcimakmghpcckdli\2.0\manifest.json	t7R7ZNjVTNpOyaC.exe

Drops file in System32 directory 4 IoCs

Processes:

t7R7ZNjVTNpOyaC.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	t7R7ZNjVTNpOyaC.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	t7R7ZNjVTNpOyaC.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	t7R7ZNjVTNpOyaC.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	t7R7ZNjVTNpOyaC.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

t7R7ZNjVTNpOyaC.exe

pid	process
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe
4680	t7R7ZNjVTNpOyaC.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

t7R7ZNjVTNpOyaC.exe

description	pid	process
Token: SeDebugPrivilege	4680	t7R7ZNjVTNpOyaC.exe
Token: SeDebugPrivilege	4680	t7R7ZNjVTNpOyaC.exe
Token: SeDebugPrivilege	4680	t7R7ZNjVTNpOyaC.exe
Token: SeDebugPrivilege	4680	t7R7ZNjVTNpOyaC.exe
Token: SeDebugPrivilege	4680	t7R7ZNjVTNpOyaC.exe
Token: SeDebugPrivilege	4680	t7R7ZNjVTNpOyaC.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9.exe

description	pid	process	target process
PID 4400 wrote to memory of 4680	4400	a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9.exe	t7R7ZNjVTNpOyaC.exe
PID 4400 wrote to memory of 4680	4400	a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9.exe	t7R7ZNjVTNpOyaC.exe
PID 4400 wrote to memory of 4680	4400	a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9.exe	t7R7ZNjVTNpOyaC.exe

C:\Users\Admin\AppData\Local\Temp\a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9.exe
"C:\Users\Admin\AppData\Local\Temp\a5b73b11fbaa4af219453c143ab638638015144233a75bb10e8e88d5509696d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4400

C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\t7R7ZNjVTNpOyaC.exe
.\t7R7ZNjVTNpOyaC.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
90b5fdc5012c28e650fd6e9d2543d16d

SHA1
fcda0adb17db3600a15668bfda2ce96b69a9ce5f

SHA256
05b5982844cf1baeba39d9f034992880bc437a44a36831c565e1be5e809b1d0c

SHA512
af93c6259d42f0b51e3d5445f0f0d1fa6000ecbf601b7fd80b9749a11155dc9f7b40fdefcd64e21edbccdb48a0f57bd10322cafb60ffe1beddf7f7cd316ec995

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
e26f406c594d40e4dd10f8a7baec6720

SHA1
9b60dae18e7c6c8560a5b93db17b871359286881

SHA256
c866a6a0e4ba1f61a0bc078fe5dc8916b449284565b23808e0e0278930edadc0

SHA512
e33a279338c2d82c5f9bacb905680b49abbcbd62955ab456e4308a5bb3644d72fafeec202e81160bdd5e7538effac1062320dbe7bc9c10eb0acb8117b3236038

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\[email protected]\install.rdf

Filesize
591B

MD5
5cc14057332cef342b8a98e3841f4818

SHA1
50e7c52334ba6672ea87bf44d24db1d437de1a8b

SHA256
4d6cd4af8223f4385f9881de262445b9c104d7171893b44ef2ead593fe7a9d10

SHA512
982ee547bff2a620c5481f9d02a65534a66d767586ac38cf37e83f38fa87f1765def325400bebbd5d59d7d4c06513072204117383802dd985d7d27a1e49954f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\hdddplkglbcepeeohcimakmghpcckdli\background.html

Filesize
146B

MD5
0f69cb55ac261736ed947456a5440836

SHA1
2bb5417be865191587b14eaac037b92b3fff88be

SHA256
8616d3c59f0a51da925b07210dc4a443fe7a27805a88f4bbaa8406a3149f68b5

SHA512
e0b4e3564cc8385861557f60af8fd80ab2355610575f1ed21726c46c6e80afd660ef2bbaa519d53e16e9a4c7b7d985fa2d1d1e7a0d2230e93656814ed44f0ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\hdddplkglbcepeeohcimakmghpcckdli\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\hdddplkglbcepeeohcimakmghpcckdli\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\hdddplkglbcepeeohcimakmghpcckdli\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\hdddplkglbcepeeohcimakmghpcckdli\rFE1pleWx.js

Filesize
6KB

MD5
8abae85f84fd2fe57d0bd452fc346ee4

SHA1
7e9945333bd37238cc6bf575f6cf4bc79978c327

SHA256
850c5c282c5a9e4aa2966de9c799b11ee8d8b1106e203639fb2365b0a4def557

SHA512
26e37f257651d3f0d09a3b69e5c70006d44ddee1308c9ff7c5f96eeff4ec083e2002455085a2acdda6e1d8769f956bb30057c6e93feaaad82b4a679750483767

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\t7R7ZNjVTNpOyaC.dat

Filesize
1KB

MD5
31bb9919b99b402d28129c072b77db6d

SHA1
de4702f70b52d845a894c4837d71d65edd4338f4

SHA256
6b49edcfa5709d91de78ae05feab8f7b1fdaec81d4b087bb54285db314f9213b

SHA512
674f1648af69f071995ee4e7213293c95c48f00472631ecb2f0a59e4f3f1911ec406457fde50ad8fe430e6fef0f53c8e63c3bf573d4704e36c77379ca37a10d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\t7R7ZNjVTNpOyaC.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFF83.tmp\t7R7ZNjVTNpOyaC.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/4680-132-0x0000000000000000-mapping.dmp

Download