a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3.exe
Size

932KB
MD5

6e5c38355e25f6838e9547e20696e804
SHA1

a67300b74071ac4a0ec7f2acff673b98aba862a8
SHA256

a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3
SHA512

8290ff7536ad29d72bf590521fbfcf0d05d8d0e6f0f24ed4bca27a174f28311357b1bb5e76409afb8558229601cf3dbf1c5561e81073e2b6b3ee8860a64c7c8c
SSDEEP

24576:h1OYdaONCZ/iWCvu/2sWsJA/jlt+DHhsW:h1Os/CpYO/dJJDHhsW

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

7q36xOEgIT0oVd3.exe

pid process

1336 7q36xOEgIT0oVd3.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

7q36xOEgIT0oVd3.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bljccnjlamgbbdebkbahdhmakofgifnk\2.0\manifest.json	7q36xOEgIT0oVd3.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bljccnjlamgbbdebkbahdhmakofgifnk\2.0\manifest.json	7q36xOEgIT0oVd3.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bljccnjlamgbbdebkbahdhmakofgifnk\2.0\manifest.json	7q36xOEgIT0oVd3.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bljccnjlamgbbdebkbahdhmakofgifnk\2.0\manifest.json	7q36xOEgIT0oVd3.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bljccnjlamgbbdebkbahdhmakofgifnk\2.0\manifest.json	7q36xOEgIT0oVd3.exe

Drops file in System32 directory 4 IoCs

Processes:

7q36xOEgIT0oVd3.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	7q36xOEgIT0oVd3.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	7q36xOEgIT0oVd3.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	7q36xOEgIT0oVd3.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	7q36xOEgIT0oVd3.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

7q36xOEgIT0oVd3.exe

pid	process
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe
1336	7q36xOEgIT0oVd3.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7q36xOEgIT0oVd3.exe

description	pid	process
Token: SeDebugPrivilege	1336	7q36xOEgIT0oVd3.exe
Token: SeDebugPrivilege	1336	7q36xOEgIT0oVd3.exe
Token: SeDebugPrivilege	1336	7q36xOEgIT0oVd3.exe
Token: SeDebugPrivilege	1336	7q36xOEgIT0oVd3.exe
Token: SeDebugPrivilege	1336	7q36xOEgIT0oVd3.exe
Token: SeDebugPrivilege	1336	7q36xOEgIT0oVd3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3.exe

description	pid	process	target process
PID 5028 wrote to memory of 1336	5028	a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3.exe	7q36xOEgIT0oVd3.exe
PID 5028 wrote to memory of 1336	5028	a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3.exe	7q36xOEgIT0oVd3.exe
PID 5028 wrote to memory of 1336	5028	a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3.exe	7q36xOEgIT0oVd3.exe

C:\Users\Admin\AppData\Local\Temp\a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3.exe
"C:\Users\Admin\AppData\Local\Temp\a4a41961c4c465b9e3ffe1283e70bde4f06239220b78f5a8af1ec52f9a36c4e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\7q36xOEgIT0oVd3.exe
.\7q36xOEgIT0oVd3.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\7q36xOEgIT0oVd3.dat

Filesize
1KB

MD5
1c424e6ad31825cd991e7f8e6a1dc0b3

SHA1
c120f9ed1f571212e33acf0ee524849bfd833603

SHA256
b5887aeb9947566a490374be3640cf115a2eef4ee780955d687aab072f576848

SHA512
e9d2ab7be243d71ca960991bd2ee35c5cb19fabc53c3027147a0076f9254edf99ba7e5602d313219811db76139baf4e9513f83dd52b087569a80c81b1e596931

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\7q36xOEgIT0oVd3.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\7q36xOEgIT0oVd3.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
ccd1db2ab95c63c0cb7e35631edb8454

SHA1
197651ae6b37149e87230fafbb75861ab7355e02

SHA256
9be21c430d36a2b0d4cdf5c907bcc7708bee028851493adca7e705bc129ca09f

SHA512
caa29820df81fc6218fcb68a696a9bfdebe3e45428aab226932bc3a504cbcc2c611726930fbae8628ca0d89a0d0290464e0b96bae9365b746aae5d783c9b968d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
bc6e3f431b7516ce6144e814ab5dbc74

SHA1
c64c36ee42f48d6f7972726a83c8abcd95569552

SHA256
7c639e66aba733705bc08495af9fa2a8aa731d3e32d4de884b18ab59b831d1c6

SHA512
5148ac4a86e128cf7b169add43169176331ba325e84d1effc1dad2890d2a73b3c32b92f1c679524a4af0fed1ba23783fce0db2f9d6962d1df1ba36efc41a763d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\[email protected]\install.rdf

Filesize
592B

MD5
7ae8f29d02d09d4d7e2192189d337933

SHA1
1b3e722c5575653a7105885aad5a5902bba7b86e

SHA256
07a800ea9fbef576825fb4601e57cd7b17d8ac1293f1e2b6b3ce7314f5681619

SHA512
8c93354911c31a13b1f8d1ad8f2f2d923d2462c3906e194763123645f8adcb7c4519a66f3f04521805beaf80daedd399b848ee1d42d7fbd96c3811750f27524c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\bljccnjlamgbbdebkbahdhmakofgifnk\EjudVnR7k.js

Filesize
6KB

MD5
38401b77bd05df2f8387c2982bf8de1e

SHA1
6b635ae8232583ff5ea210442a44507cddc2780c

SHA256
af2ddf2ac99353b039e858db5a3ea714c6b0343f3c825499029c9db4b15c6c1d

SHA512
85adc091c676d3ff3f425c49e8be7d405c779ab7d96453fbf7cca338ce3b5b43d3dd875b11068a3aa54bafff02912dd631b7fa7ea1a356241594b409ec88ce77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\bljccnjlamgbbdebkbahdhmakofgifnk\background.html

Filesize
146B

MD5
7466b3a1f973f720d5890a1c28d96d79

SHA1
92b1fbbd5aa13f6f0378ac5809bbe6a92ea6f5f3

SHA256
64f7c6202fc2cd8de8d429dbe678f8a0ca72841d458d3037606224104a09239b

SHA512
deaae72bc88aa8c58f162aec0195943726f784e52932568a6e40d549fe98295af7495e83982add7c0c28dc719a7d8ea0b45d6dbd88479025e98627871e838af3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\bljccnjlamgbbdebkbahdhmakofgifnk\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\bljccnjlamgbbdebkbahdhmakofgifnk\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSACB0.tmp\bljccnjlamgbbdebkbahdhmakofgifnk\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1336-135-0x0000000000000000-mapping.dmp

Download