a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff.exe
Size

932KB
MD5

e03ba73b6726f006c2b4f49112c728b0
SHA1

4a5e0e8ac6b541e3bb9c97e01c588432ce0cf8e5
SHA256

a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff
SHA512

27fc01927ed2dc057a8e9e85ad071c536df4d1b14e326a95a6c37d64fcac1b83158af1551f2fd0016f35a555d413118e27346f6ca8100c77bc7307078a4fba5b
SSDEEP

24576:h1OYdaOpCZ/iWCvu/2sWsJA/jlt+DHhsa:h1OsvCpYO/dJJDHhsa

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

KfSupj3tlRwTygM.exe

pid process

4708 KfSupj3tlRwTygM.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

KfSupj3tlRwTygM.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmmagklghbdjpmehejjafigeiflkplci\2.0\manifest.json	KfSupj3tlRwTygM.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmmagklghbdjpmehejjafigeiflkplci\2.0\manifest.json	KfSupj3tlRwTygM.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmmagklghbdjpmehejjafigeiflkplci\2.0\manifest.json	KfSupj3tlRwTygM.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmmagklghbdjpmehejjafigeiflkplci\2.0\manifest.json	KfSupj3tlRwTygM.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmmagklghbdjpmehejjafigeiflkplci\2.0\manifest.json	KfSupj3tlRwTygM.exe

Drops file in System32 directory 4 IoCs

Processes:

KfSupj3tlRwTygM.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	KfSupj3tlRwTygM.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	KfSupj3tlRwTygM.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	KfSupj3tlRwTygM.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	KfSupj3tlRwTygM.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

KfSupj3tlRwTygM.exe

pid	process
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe
4708	KfSupj3tlRwTygM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

KfSupj3tlRwTygM.exe

description	pid	process
Token: SeDebugPrivilege	4708	KfSupj3tlRwTygM.exe
Token: SeDebugPrivilege	4708	KfSupj3tlRwTygM.exe
Token: SeDebugPrivilege	4708	KfSupj3tlRwTygM.exe
Token: SeDebugPrivilege	4708	KfSupj3tlRwTygM.exe
Token: SeDebugPrivilege	4708	KfSupj3tlRwTygM.exe
Token: SeDebugPrivilege	4708	KfSupj3tlRwTygM.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff.exe

description	pid	process	target process
PID 4988 wrote to memory of 4708	4988	a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff.exe	KfSupj3tlRwTygM.exe
PID 4988 wrote to memory of 4708	4988	a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff.exe	KfSupj3tlRwTygM.exe
PID 4988 wrote to memory of 4708	4988	a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff.exe	KfSupj3tlRwTygM.exe

C:\Users\Admin\AppData\Local\Temp\a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff.exe
"C:\Users\Admin\AppData\Local\Temp\a86a33da4dff82753bcf27d8934999834cde44e07f9441b83783d2871f56aeff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\KfSupj3tlRwTygM.exe
.\KfSupj3tlRwTygM.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\KfSupj3tlRwTygM.dat
Filesize
1KB

MD5
ae66a10ffdfc0057a89f187161618b97

SHA1
edda9023c602922f490f6e8f6595005ee251908f

SHA256
2b54c988e2aaadcf2893e7e76c3206edd1ea3390ad6e698bd3f75c3d33a8a7d7

SHA512
ac23ca49911cb86d9c74ce62f2269ff674c4cf4ef058a23a588cf343a93b0c9074686eee6b9c95af9f1bdf4c1d4f1c8433b69f0536da35f5fc8e867b15e95ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\KfSupj3tlRwTygM.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\KfSupj3tlRwTygM.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
781162abd055488990dcdb53f4d76f78

SHA1
7f29e705da3c80abb423d85b03979019e99089f6

SHA256
380111bde6fa48d4c57db0f653c9e182c1eb616b4f6c315572920bc61791e373

SHA512
5adff7b44b5383965781f8f85baf045428f29c96ed7456b03f9be85a63474d3fa6b86302cc8cf2664a026a678308b01b8872af1fcb8f26324da8d380074133fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
e3a0300912e216d3f23fc568b47aae0d

SHA1
775347a2ba87790127771e2cc969b9739ced54bd

SHA256
53c787c8a43e3774e0d1018967a041f408f14612a565baf36fdba27bb536673f

SHA512
d51dcc0f5f24df2d859f1d4d55874b548020ba6d82c699bb1666ced1cc23004c4577092443f454218ea820626d1c179a4fdd9c0a3f1cdab6d9fd1bbfea2b13f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\[email protected]\install.rdf
Filesize
591B

MD5
e857780a675bdeebc13ec5bf634da98a

SHA1
bf1e81c2c0e54b19d7269eec3a71fda6ae462852

SHA256
4e67cbd168f1e6350e40632a95535b5be10d2d9be79c365d6b5b7b0f059d8461

SHA512
8c3f7cac8419efaa6a5df77f355fa6c26abb4e03005dcde0b21fd012b87633f9dc52fcc8b86166c798b8a14ef912cbd813d7bbf834f973dc729948697ef1803c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\jmmagklghbdjpmehejjafigeiflkplci\background.html
Filesize
140B

MD5
43b1dbdfd0809f50e70d6e0876a88c74

SHA1
356c4113d0db7b3a1f2f517bdfc3f6c8a2ddef9c

SHA256
8fb2844814e0468302236c5d4dc30e85e9ce4fcacf1b3cc890de68d2d43fb7be

SHA512
7bff1f81636b68c52e9760c573a43703f5c8628280005844ad3d990c5dc0b0f6b497f814d0d44e8827ed1482521981898e4e8b0113e17ddecd734a6c03a17ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\jmmagklghbdjpmehejjafigeiflkplci\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\jmmagklghbdjpmehejjafigeiflkplci\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\jmmagklghbdjpmehejjafigeiflkplci\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CB9.tmp\jmmagklghbdjpmehejjafigeiflkplci\yXj.js
Filesize
6KB

MD5
4ae209df4f36cdee3b2e78344515a0ec

SHA1
5880403a49dd514e9c2738a3a2c473f924492ed5

SHA256
459f7a2e7e55534383bc54ac317c4216449b57ef1094859654967a8d14d1a381

SHA512
2c15744d5273e23d64cc47d4272670ec4ea2d4770799994291f78abdcc731ab29e494090b37feed62c3568d00632e12c97565ae87225eab2936e373e9c2a09a7

Download Submit
memory/4708-132-0x0000000000000000-mapping.dmp

Download