ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be

Analysis

max time kernel
159s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be.exe
Size

931KB
MD5

937d78b685ac12817fbde5bb031d3d43
SHA1

cfdbb680e89cdabdec9b338153c7c34e72945e3e
SHA256

ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be
SHA512

e323cdfff47d072535ef12edcb4babeea48f55be154b032096a5e4455c7e690cfc19d0a0fda61f4c43e34f95d0064ea6d18d6ab704ebb5904eb69e14ea8e5d6b
SSDEEP

24576:h1OYdaOwCZ/iWCvu/2sWsJA/jlt+DHhsD:h1OsSCpYO/dJJDHhsD

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

VRL7jrgWHVgP4Ol.exe

pid process

3680 VRL7jrgWHVgP4Ol.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

VRL7jrgWHVgP4Ol.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pijkgjdkpafgdbclnbcenjkealappbfh\2.0\manifest.json	VRL7jrgWHVgP4Ol.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pijkgjdkpafgdbclnbcenjkealappbfh\2.0\manifest.json	VRL7jrgWHVgP4Ol.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pijkgjdkpafgdbclnbcenjkealappbfh\2.0\manifest.json	VRL7jrgWHVgP4Ol.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pijkgjdkpafgdbclnbcenjkealappbfh\2.0\manifest.json	VRL7jrgWHVgP4Ol.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pijkgjdkpafgdbclnbcenjkealappbfh\2.0\manifest.json	VRL7jrgWHVgP4Ol.exe

Drops file in System32 directory 4 IoCs

Processes:

VRL7jrgWHVgP4Ol.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	VRL7jrgWHVgP4Ol.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	VRL7jrgWHVgP4Ol.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	VRL7jrgWHVgP4Ol.exe
File opened for modification	C:\Windows\System32\GroupPolicy	VRL7jrgWHVgP4Ol.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

VRL7jrgWHVgP4Ol.exe

pid	process
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe
3680	VRL7jrgWHVgP4Ol.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

VRL7jrgWHVgP4Ol.exe

description	pid	process
Token: SeDebugPrivilege	3680	VRL7jrgWHVgP4Ol.exe
Token: SeDebugPrivilege	3680	VRL7jrgWHVgP4Ol.exe
Token: SeDebugPrivilege	3680	VRL7jrgWHVgP4Ol.exe
Token: SeDebugPrivilege	3680	VRL7jrgWHVgP4Ol.exe
Token: SeDebugPrivilege	3680	VRL7jrgWHVgP4Ol.exe
Token: SeDebugPrivilege	3680	VRL7jrgWHVgP4Ol.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be.exe

description	pid	process	target process
PID 1468 wrote to memory of 3680	1468	ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be.exe	VRL7jrgWHVgP4Ol.exe
PID 1468 wrote to memory of 3680	1468	ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be.exe	VRL7jrgWHVgP4Ol.exe
PID 1468 wrote to memory of 3680	1468	ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be.exe	VRL7jrgWHVgP4Ol.exe

C:\Users\Admin\AppData\Local\Temp\ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be.exe
"C:\Users\Admin\AppData\Local\Temp\ad4a4f45ad2c6bd73f44ead3e1bfecb0d449b8ed4118450c595a9d28feec03be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\VRL7jrgWHVgP4Ol.exe
.\VRL7jrgWHVgP4Ol.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
8c2863d472785595a940e31a8a4ff262

SHA1
4702d929f608b9124abe1075baca888627a2001c

SHA256
974a54be73dabe5beb7f8714fed5d8eea4e226b1c1165d5ac3882015bcc8c223

SHA512
f6616c4788d469a8461bd0e7090d9dedcc68f55f73a1ab9cf732c6526508cd10bda3e60f70b83b805551a6f793bb2fb02ce98ee812adc714b8930bcc97960c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
8bb56719a1108dfe2d47f6bc0d11ed53

SHA1
8dc745f5dff0fd3e8365ef16b59fa4334129a332

SHA256
93e944580ea67deefded21538bdb2e1bf357501936988df0b9b341065cf543f5

SHA512
e3f57be268ad9175180651f505b7afb55e3293c4fa43fafa41eceb3b11499dbd4f7c834766e54ede4ce084296132c8efa1fa878de1736685fc397f05c8d178db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\[email protected]\install.rdf
Filesize
594B

MD5
38d327a4098106e97f24d35453c59674

SHA1
7fa643e67882a3b6ac2f706b67f3762917458ddf

SHA256
d7c12096abd4a3f7ab06c96d9618a634835492b01875917e3b7c31449872882a

SHA512
fd181107d61362b81eec8cb361646f8b17dd2f05d24ccf908bb57041ed46c3202b148f7817d250adbceb995e1d06a452253db13f7cdcce41cfda9f93ed8a1503

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\VRL7jrgWHVgP4Ol.dat
Filesize
1KB

MD5
466101cca4fb9d80199f669ed3411ddf

SHA1
a230ebda3410b0639144ed245b984227b92942eb

SHA256
0a13ff9597e60566b90c4d823386435a6d7613574412061437d30c85fc7529cd

SHA512
014a0f971b0f993c14c988adf7d2ff00e5e1c7a712c8b56f93b6a5c576cd18c2a0d1f3dd4eec91b92b908dc0dd6cc2b01d2e56990ef14267c4a24ff44327f82b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\VRL7jrgWHVgP4Ol.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\VRL7jrgWHVgP4Ol.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\pijkgjdkpafgdbclnbcenjkealappbfh\background.html
Filesize
138B

MD5
b972c42d19ad291355009b55d5a7f2d9

SHA1
753a8b02deffbb8a3ce02d47e2b9ff55432da49f

SHA256
99f1bb13cd5c18f8480fe9ab54eef6f5d75801c133e8bd5a260536cfbdf93f21

SHA512
b1a480f39a01c31434dc14f1b51976be8f0f0e5371c5600e4cf055eb58a530b7fa7f0ac83fc98beed3eea35ef933d5d0fe25c84f28c76212ca69bc4576434cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\pijkgjdkpafgdbclnbcenjkealappbfh\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\pijkgjdkpafgdbclnbcenjkealappbfh\e.js
Filesize
6KB

MD5
a8fd3d497ea21f3d1b639347f84ae968

SHA1
f3f4407154df6838d7894c94c14c26824d9f1311

SHA256
b0b54cb58b95d615a7af61d54dea6ed816f976e132da5abf94eebeeb2dbe4a38

SHA512
bee2c47477a46866f8d457c8543c20522b1018964a03c44bfcba14f6862d091ffc603ecbe9fedc5aa3731b0e8e68b2686d4f1f710b2160535249e2571fe2e111

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\pijkgjdkpafgdbclnbcenjkealappbfh\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2069.tmp\pijkgjdkpafgdbclnbcenjkealappbfh\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/3680-132-0x0000000000000000-mapping.dmp

Download