a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d

Analysis

max time kernel
135s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d.exe
Size

920KB
MD5

821c55c7a9b50d984dd7720e0f1a7a71
SHA1

7741343a1c5f16889e5598fb898b152ef99bda50
SHA256

a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d
SHA512

d7eee9f4c5b5c9862c77371ceeeeb76926d9c02a33d872d9409aa45de8d54a640770d20b444fc74896d4a725442b54876a9773f848eece53f9482a45ceb6976f
SSDEEP

24576:h1OYdaO4MtdHAqcdDVhYwiei7+EpFAh/kKP:h1OsZPHVmVhYwiLtKkKP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

TLlf7zWb9MiXDZl.exe

pid process

3624 TLlf7zWb9MiXDZl.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

TLlf7zWb9MiXDZl.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\figgpamjiapomgaccjankfaaphkacojb\2.0\manifest.json	TLlf7zWb9MiXDZl.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\figgpamjiapomgaccjankfaaphkacojb\2.0\manifest.json	TLlf7zWb9MiXDZl.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\figgpamjiapomgaccjankfaaphkacojb\2.0\manifest.json	TLlf7zWb9MiXDZl.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\figgpamjiapomgaccjankfaaphkacojb\2.0\manifest.json	TLlf7zWb9MiXDZl.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\figgpamjiapomgaccjankfaaphkacojb\2.0\manifest.json	TLlf7zWb9MiXDZl.exe

Drops file in System32 directory 4 IoCs

Processes:

TLlf7zWb9MiXDZl.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	TLlf7zWb9MiXDZl.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	TLlf7zWb9MiXDZl.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	TLlf7zWb9MiXDZl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	TLlf7zWb9MiXDZl.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

TLlf7zWb9MiXDZl.exe

pid	process
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe
3624	TLlf7zWb9MiXDZl.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

TLlf7zWb9MiXDZl.exe

description	pid	process
Token: SeDebugPrivilege	3624	TLlf7zWb9MiXDZl.exe
Token: SeDebugPrivilege	3624	TLlf7zWb9MiXDZl.exe
Token: SeDebugPrivilege	3624	TLlf7zWb9MiXDZl.exe
Token: SeDebugPrivilege	3624	TLlf7zWb9MiXDZl.exe
Token: SeDebugPrivilege	3624	TLlf7zWb9MiXDZl.exe
Token: SeDebugPrivilege	3624	TLlf7zWb9MiXDZl.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d.exe

description	pid	process	target process
PID 2288 wrote to memory of 3624	2288	a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d.exe	TLlf7zWb9MiXDZl.exe
PID 2288 wrote to memory of 3624	2288	a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d.exe	TLlf7zWb9MiXDZl.exe
PID 2288 wrote to memory of 3624	2288	a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d.exe	TLlf7zWb9MiXDZl.exe

C:\Users\Admin\AppData\Local\Temp\a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d.exe
"C:\Users\Admin\AppData\Local\Temp\a926a9726b166581783739e10ce75b6c702fdfb340356b1107c8c80208f2662d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\TLlf7zWb9MiXDZl.exe
.\TLlf7zWb9MiXDZl.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
7fa53733ceb53e2b4623ccb4997c2429

SHA1
de209f0e844a1326bdf6e3a5480b4f5eb4e100be

SHA256
3bc81f546dd5b3c9fff49302627e0d68a8ee5cbfa9682de5ff30a35630537beb

SHA512
1c2ad387f46294ce9ff3034ff890489abb4b4eb4af71ead806d377999a3cf6001f2512d715ed1bda877d65d7e023e92874d692178617c91d52c85ebae064c6f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
9fde7cf5785ccecfe992542104bda8d9

SHA1
edbd319d85da60eba046a09748a8ff6f780b40be

SHA256
cef7a8b0b14e3e7f4e1958487ad8d99068b22f3d2914f15a42e4bd48fc88230d

SHA512
fb54e9f6211983cb0e9d8706fc61b2c601496dc9988bc155c77dd0fe62917708d9a915e0e33fdf333d597532db769089b38000912e54c43a8a374b3e110e28f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\[email protected]\install.rdf
Filesize
597B

MD5
3b000e847e41ed8a3dc75fa076be9349

SHA1
9acc50f455a9875ec8474b949027295ee6c839c6

SHA256
857d6a205ab57d2c5256c5c00a3dc48155ca354b4e8507039e2c45865fd55007

SHA512
7a4cc000c98fbbb3f9c47ac50d04aa1dc3cc6446a04ab96d5ec95b13eac26a935ee6004dbf0426572baed1d698bf61b952117ef8bbe9196e42b62e4401be8d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\TLlf7zWb9MiXDZl.dat
Filesize
1KB

MD5
a887178a2925174fd66fe577f51cc956

SHA1
220377b2daa7eeb8855ba3f9c35b6239b5fa6aec

SHA256
23201f7b29f6ffa53d4aca2519a3cee7f4ea9dc65f576f3fafc89768d16be136

SHA512
513bb02d073451cf7ba8219f238a8062772f746219ca66cab6dfbeaa0fd8666509a043402e8d96754e2e46bf4271eed2ce19082e44bf020b722eeb517854c258

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\TLlf7zWb9MiXDZl.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\TLlf7zWb9MiXDZl.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\figgpamjiapomgaccjankfaaphkacojb\HooyvHwl.js
Filesize
6KB

MD5
c8370993e4384a102bef146ee538b61b

SHA1
ee2e45f94dfafc331aaba1448f0553b3ac69bc17

SHA256
a31bef78bae3fa56dcd3ef481fd36bb6ab27802227703f7037d56f9c98ca9ff0

SHA512
749eb2cba510f6badb9e1c53811bbd2773d9c9697649b9343907f9328f808a27345550e369eb135f9aeb7342494c5f9a3b51b42ad0febb9f014fe9d179fe0ba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\figgpamjiapomgaccjankfaaphkacojb\background.html
Filesize
145B

MD5
56137767b57198c2c0e2854f92f4b0f9

SHA1
53a8f3a4e34da26972a76ff4fba78662ddca0857

SHA256
7603dc02bc22f2b118cb4f981b3ade380f2ccab6ef83c76822f1366d84d4c799

SHA512
99c724dd6d7a5b59e9ae39773ab2a11151062e716e38692bd3dbbdd78a3d93406fea8d2e9c7a07757ba0c464465e2586359caa0ac3458424b3c7edb8c6fa0fd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\figgpamjiapomgaccjankfaaphkacojb\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\figgpamjiapomgaccjankfaaphkacojb\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDCD.tmp\figgpamjiapomgaccjankfaaphkacojb\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/3624-132-0x0000000000000000-mapping.dmp

Download