a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc.exe
Size

931KB
MD5

7ddf746316b4bb54decc00b79b942b51
SHA1

3fcc512e262fbed42ef1be41940f32ebbc532534
SHA256

a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc
SHA512

ab71363dea0c38eae576f467b58b4f02661ec6a34d9568e3998d9cf1ef33a0f6867b3aded32e2b0f6f8d030f5613c613b144c8c4be448b629ffcc2916f47d943
SSDEEP

24576:h1OYdaOfCZ/iWCvu/2sWsJA/jlt+DHhs9:h1OsJCpYO/dJJDHhs9

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

v2uKEyGtO51l18W.exe

pid process

396 v2uKEyGtO51l18W.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

v2uKEyGtO51l18W.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iakpgmgecdmcokgalmkkkdjhlejinpgm\2.0\manifest.json	v2uKEyGtO51l18W.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\iakpgmgecdmcokgalmkkkdjhlejinpgm\2.0\manifest.json	v2uKEyGtO51l18W.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\iakpgmgecdmcokgalmkkkdjhlejinpgm\2.0\manifest.json	v2uKEyGtO51l18W.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\iakpgmgecdmcokgalmkkkdjhlejinpgm\2.0\manifest.json	v2uKEyGtO51l18W.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\iakpgmgecdmcokgalmkkkdjhlejinpgm\2.0\manifest.json	v2uKEyGtO51l18W.exe

Drops file in System32 directory 4 IoCs

Processes:

v2uKEyGtO51l18W.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	v2uKEyGtO51l18W.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	v2uKEyGtO51l18W.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	v2uKEyGtO51l18W.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	v2uKEyGtO51l18W.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

v2uKEyGtO51l18W.exe

pid	process
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe
396	v2uKEyGtO51l18W.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

v2uKEyGtO51l18W.exe

description	pid	process
Token: SeDebugPrivilege	396	v2uKEyGtO51l18W.exe
Token: SeDebugPrivilege	396	v2uKEyGtO51l18W.exe
Token: SeDebugPrivilege	396	v2uKEyGtO51l18W.exe
Token: SeDebugPrivilege	396	v2uKEyGtO51l18W.exe
Token: SeDebugPrivilege	396	v2uKEyGtO51l18W.exe
Token: SeDebugPrivilege	396	v2uKEyGtO51l18W.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc.exe

description	pid	process	target process
PID 4308 wrote to memory of 396	4308	a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc.exe	v2uKEyGtO51l18W.exe
PID 4308 wrote to memory of 396	4308	a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc.exe	v2uKEyGtO51l18W.exe
PID 4308 wrote to memory of 396	4308	a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc.exe	v2uKEyGtO51l18W.exe

C:\Users\Admin\AppData\Local\Temp\a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc.exe
"C:\Users\Admin\AppData\Local\Temp\a4f5a235685d0ad2c1f02c804cddd5de62ef5861e3e8dc8752e6e8beb4093efc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4308

C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\v2uKEyGtO51l18W.exe
.\v2uKEyGtO51l18W.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\iakpgmgecdmcokgalmkkkdjhlejinpgm\background.html
Filesize
143B

MD5
3a0d5c7a2dab6637d2e66633787cfc40

SHA1
346c7de27ead2a869a2b1bdfd9a2d8b338ae2caf

SHA256
b90a10ee8c5140804a7791df2388cf1d502ef54127d3eccd29b7a6ddedaad3e0

SHA512
cdf15e79712a213582e8c406d9990865af79f39f276f802d7fe93edee1dcbcdb99ac53fe48a782d81877256ffdd6d1df1c6c38970e62435236c2eac34bf7de35

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\iakpgmgecdmcokgalmkkkdjhlejinpgm\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\iakpgmgecdmcokgalmkkkdjhlejinpgm\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\iakpgmgecdmcokgalmkkkdjhlejinpgm\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\iakpgmgecdmcokgalmkkkdjhlejinpgm\ug6ZxB.js
Filesize
6KB

MD5
5995fe94cd0788be3144a39a9e0ac7b6

SHA1
919bca2a4748fe45c72c2d5a9ade3c97753948f9

SHA256
763742c258234da13637f85849e81d5e473fb44fc0152a6b99ab46341d52c239

SHA512
d72761045565fa3f009b5735e92b1e28b47809e6a276fbc2001dcb8448b279cbfc18387bebda338fd7456484eebdb392a421fd8c01f57a6da85a6bf1ab0c8a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
f196e516464d06402b82ece54e4125dc

SHA1
aebc93b4c601c5282328a78bc8d6fe43e9935f01

SHA256
fa1a6a582b63d76efa70cf988a1dc4101ee544b466f6f692e036d5fb843df709

SHA512
7cb1c250ef27715a623cd648bef728eea33642870debb60daa6aa98683b1facbe414fc54f9b1d54ab817986446d9d08e5b3af6ca2e1ad33c42e44504eed13d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
71145866b38fe3d4bc82787e395ce733

SHA1
187ed438e95c0c058bbb601ebed0cbc3a8e5ab71

SHA256
d5c71bfa988f67753fae2791c5fc7946903f7886fb5e6858980557a146573135

SHA512
400cfbd63a3c884ac55a95e9a5fbe451efee55528706d17c1fb8a8d83177d1a2d4c5c7ff07a5882c3dc5c0d00f8e5681ec1b754b8c999030fc87800a1fee6103

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\[email protected]\install.rdf
Filesize
591B

MD5
cdb33c13a98831c537ae3c15464ec996

SHA1
d70f107a25d47ea5e6e2742d70b87cd75adf9383

SHA256
9e856fc99bc9af37404436d0eaea364c8d4283702a83cd6882f2cb45d23d9b8f

SHA512
24a16e51e45832d28068e40dd1f366fc37665d97cd54cd63a2bae829f0f8f8aeef6ef32ae5b605011619376f6638c7df80195dd4808139cff50550e522380b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\v2uKEyGtO51l18W.dat
Filesize
1KB

MD5
81f22efc3bf88772a2e6de65c10eaaa9

SHA1
993f76f62a1025a0a25c17ba0b680f362f99506f

SHA256
9a9f3196abfd795384ba6dba73d7dda6c5bae83a334644b8b422ff77dd8cf9f6

SHA512
04eec11e85b0360c759aee3a8e6c94c27951dbc1e6d5e840214e22592bdc6fbc214d671a3ed290d277d1433d11367d2b7654e47c4d7c7e667d65aa5d77361392

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\v2uKEyGtO51l18W.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2A2.tmp\v2uKEyGtO51l18W.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/396-132-0x0000000000000000-mapping.dmp

Download