Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 21:18
Static task
static1
Behavioral task
behavioral1
Sample
a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43.exe
Resource
win7-20221111-en
General
-
Target
a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43.exe
-
Size
931KB
-
MD5
26529e29e345d92f6ca360f12d394511
-
SHA1
8b15041a5c001172f9a051b11ef1b6c93cddaaa2
-
SHA256
a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43
-
SHA512
becdd5ae6ec44facbb340ecd2c6a0232876a10ba9947cdf7f4e3ff4887d6094e88f1a4fc17a6de08a6c6cfa98c2335c1ce790da23b978adf5b957c441721533e
-
SSDEEP
24576:h1OYdaO/CZ/iWCvu/2sWsJA/jlt+DHhss:h1OsxCpYO/dJJDHhss
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
B4wzAV4rTaxJazc.exepid process 4872 B4wzAV4rTaxJazc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
B4wzAV4rTaxJazc.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfkmnijhchfgihlmpmlmlcmnbnkolkel\2.0\manifest.json B4wzAV4rTaxJazc.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfkmnijhchfgihlmpmlmlcmnbnkolkel\2.0\manifest.json B4wzAV4rTaxJazc.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfkmnijhchfgihlmpmlmlcmnbnkolkel\2.0\manifest.json B4wzAV4rTaxJazc.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfkmnijhchfgihlmpmlmlcmnbnkolkel\2.0\manifest.json B4wzAV4rTaxJazc.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfkmnijhchfgihlmpmlmlcmnbnkolkel\2.0\manifest.json B4wzAV4rTaxJazc.exe -
Drops file in System32 directory 4 IoCs
Processes:
B4wzAV4rTaxJazc.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy B4wzAV4rTaxJazc.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini B4wzAV4rTaxJazc.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol B4wzAV4rTaxJazc.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI B4wzAV4rTaxJazc.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
B4wzAV4rTaxJazc.exepid process 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe 4872 B4wzAV4rTaxJazc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
B4wzAV4rTaxJazc.exedescription pid process Token: SeDebugPrivilege 4872 B4wzAV4rTaxJazc.exe Token: SeDebugPrivilege 4872 B4wzAV4rTaxJazc.exe Token: SeDebugPrivilege 4872 B4wzAV4rTaxJazc.exe Token: SeDebugPrivilege 4872 B4wzAV4rTaxJazc.exe Token: SeDebugPrivilege 4872 B4wzAV4rTaxJazc.exe Token: SeDebugPrivilege 4872 B4wzAV4rTaxJazc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43.exedescription pid process target process PID 4984 wrote to memory of 4872 4984 a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43.exe B4wzAV4rTaxJazc.exe PID 4984 wrote to memory of 4872 4984 a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43.exe B4wzAV4rTaxJazc.exe PID 4984 wrote to memory of 4872 4984 a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43.exe B4wzAV4rTaxJazc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43.exe"C:\Users\Admin\AppData\Local\Temp\a466881849f9be7370d35bb14158ce974dddf73fc0893f08aef94d5c2f528c43.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\B4wzAV4rTaxJazc.exe.\B4wzAV4rTaxJazc.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\B4wzAV4rTaxJazc.datFilesize
1KB
MD53c1d7391cea6f5ae61ab226695a69518
SHA19df664ac83386203bbec949a677a6e04483b088f
SHA2569b44ad65c763a499c0ed49795e4033dfb01f436f87f29a81a29548d8bc710d77
SHA51212baf5166cbe3e55b793721067acaefc43dda282f907e7f1d5af715435e427c2c64c544905d5a4faf1374662912c831b7b80e785f5e1abc4642132b697f0a90b
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\B4wzAV4rTaxJazc.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\B4wzAV4rTaxJazc.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\nfkmnijhchfgihlmpmlmlcmnbnkolkel\background.htmlFilesize
145B
MD527ec4275d73c55eb6fbfadd77ee480f7
SHA1d4e4ef90a762df3251d26704e4ce20e182595ce9
SHA256c0314c2e28e16a00927a7020f8861ce6350492d6815e25e854cc97aabcf354cc
SHA5127d2f8dd0c71608bc2c33dba29fea94e53ac186b921aba7eee880324f4f0c94a939d063e8405a3971cc45b692d930a6edfaf1971219eb511a4997a553eb9fa598
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\nfkmnijhchfgihlmpmlmlcmnbnkolkel\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\nfkmnijhchfgihlmpmlmlcmnbnkolkel\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\nfkmnijhchfgihlmpmlmlcmnbnkolkel\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\nfkmnijhchfgihlmpmlmlcmnbnkolkel\s77suGkv.jsFilesize
6KB
MD5f6ba9a9fb45677c8a26e23da7c308a29
SHA14b950499996f208dd123ef8815d49d2f83ac0264
SHA25603903519e6fd61968de42438b5d3d10c45a15a36fdfed611e50237ac7e8dd2bc
SHA5128bbb580031a4a30103df4b874d0184aee10e6e8baaec4273f46cf63739fe366b9b18be55625f8eca999bcd021ab89b4ddeccb94a227fc2100a271a0799a96b53
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\[email protected]\chrome.manifestFilesize
35B
MD55d8b97d39ca0c0fdc002e1645ab42f78
SHA1d401cad5a1bfaecc098119ff405a213cf22bef67
SHA2564bbc9301c7f9dc914b7ee7d03ec011184999a59a78806f1a83c24001cd236b55
SHA5128c14debc1c261b6102c073497d5a1fb058a2bb1f1fb75ff65348cea4fa8d45a49a4bd417753131c49f93172dbe59cfb80d0c951abced3635ea68198999108358
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\[email protected]\content\bg.jsFilesize
8KB
MD51b80aae4845c79e20dd67d4cab18e9c4
SHA1b1a71fd13d8e8186ed28c7c2afa18d910c0a5cc9
SHA256f901da96c1ea6f410f2d1e42b0f68eb746226ef916587486b0c37f32f1db3dea
SHA5124d266900e02df6acff8099b20e22d528afe7c99fd3c1019ff14b3020e60950b5fb6094999255e4102fb675774e706c26530690cbd21335832ad2f732324d8728
-
C:\Users\Admin\AppData\Local\Temp\7zS5AD.tmp\[email protected]\install.rdfFilesize
593B
MD5ef95df780a882057f8dd3635301d4cb4
SHA1d70a3e20a30fc48e45be673d17df9a112b926c6d
SHA256eff12e21195a7777683e2e9e88e405020dd69e5d69867e1c6b4b07896cf249fa
SHA512c8e8a0565d9fed1da0fb830e6dfa2509067f53cf6a1e0584fc386724637e2c195e3e24c5409cbc6241397e82e8c6a7fa83d60275f0f826b05afe727eb950a41d
-
memory/4872-132-0x0000000000000000-mapping.dmp