a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d

Analysis

max time kernel
129s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d.exe
Size

2.5MB
MD5

30e84923bb1d491af41cd69eee326127
SHA1

d97926cb64d105af33461b1d2b3188eb09739803
SHA256

a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d
SHA512

0fd8aec8a1c6ca6c3ca51fa38a21b9798e4dec3d3fa64442cbc42be11313027009fe62cb134834b650231bb739cc00a08b12eddef52156d31e9935db055ba154
SSDEEP

49152:h1OsEPHVmVhYwiLtKkKyW4nFU0I+NP/f7I3lMOaYjdxvL0HD:h1O9HVl71RnFXINxvk

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

DVkIzQnPwozFyzT.exe

pid process

884 DVkIzQnPwozFyzT.exe
Loads dropped DLL 3 IoCs

Processes:

DVkIzQnPwozFyzT.exeregsvr32.exeregsvr32.exe

pid process

884 DVkIzQnPwozFyzT.exe
4856 regsvr32.exe
3740 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

DVkIzQnPwozFyzT.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhhmkdfhfhcpcjnmlpljllokfniopnid\1.0\manifest.json	DVkIzQnPwozFyzT.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhhmkdfhfhcpcjnmlpljllokfniopnid\1.0\manifest.json	DVkIzQnPwozFyzT.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhhmkdfhfhcpcjnmlpljllokfniopnid\1.0\manifest.json	DVkIzQnPwozFyzT.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhhmkdfhfhcpcjnmlpljllokfniopnid\1.0\manifest.json	DVkIzQnPwozFyzT.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhhmkdfhfhcpcjnmlpljllokfniopnid\1.0\manifest.json	DVkIzQnPwozFyzT.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

DVkIzQnPwozFyzT.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	DVkIzQnPwozFyzT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	DVkIzQnPwozFyzT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	DVkIzQnPwozFyzT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	DVkIzQnPwozFyzT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

DVkIzQnPwozFyzT.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	DVkIzQnPwozFyzT.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	DVkIzQnPwozFyzT.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	DVkIzQnPwozFyzT.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	DVkIzQnPwozFyzT.exe

Drops file in Program Files directory 8 IoCs

Processes:

DVkIzQnPwozFyzT.exe

description	ioc	process
File created	C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.dll	DVkIzQnPwozFyzT.exe
File opened for modification	C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.dll	DVkIzQnPwozFyzT.exe
File created	C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.tlb	DVkIzQnPwozFyzT.exe
File opened for modification	C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.tlb	DVkIzQnPwozFyzT.exe
File created	C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.dat	DVkIzQnPwozFyzT.exe
File opened for modification	C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.dat	DVkIzQnPwozFyzT.exe
File created	C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.x64.dll	DVkIzQnPwozFyzT.exe
File opened for modification	C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.x64.dll	DVkIzQnPwozFyzT.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DVkIzQnPwozFyzT.exe

pid	process
884	DVkIzQnPwozFyzT.exe
884	DVkIzQnPwozFyzT.exe
884	DVkIzQnPwozFyzT.exe
884	DVkIzQnPwozFyzT.exe
884	DVkIzQnPwozFyzT.exe
884	DVkIzQnPwozFyzT.exe
884	DVkIzQnPwozFyzT.exe
884	DVkIzQnPwozFyzT.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d.exeDVkIzQnPwozFyzT.exeregsvr32.exe

description	pid	process	target process
PID 4976 wrote to memory of 884	4976	a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d.exe	DVkIzQnPwozFyzT.exe
PID 4976 wrote to memory of 884	4976	a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d.exe	DVkIzQnPwozFyzT.exe
PID 4976 wrote to memory of 884	4976	a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d.exe	DVkIzQnPwozFyzT.exe
PID 884 wrote to memory of 4856	884	DVkIzQnPwozFyzT.exe	regsvr32.exe
PID 884 wrote to memory of 4856	884	DVkIzQnPwozFyzT.exe	regsvr32.exe
PID 884 wrote to memory of 4856	884	DVkIzQnPwozFyzT.exe	regsvr32.exe
PID 4856 wrote to memory of 3740	4856	regsvr32.exe	regsvr32.exe
PID 4856 wrote to memory of 3740	4856	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d.exe
"C:\Users\Admin\AppData\Local\Temp\a720aaf61d60b456f030971af1945dcba9413cacfa916db2fc21bd36f9751e5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\DVkIzQnPwozFyzT.exe
.\DVkIzQnPwozFyzT.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.x64.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.x64.dll"
4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:3740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.dat
Filesize
7KB

MD5
0d96fd55142da4c10dc1220273470864

SHA1
2a3845b22c9551672293f7f2a6f13d963c7cec79

SHA256
3884a69affd4320f2d63bf3cc6ed11186f8075cbcb98a0ba9a04f00c12adb034

SHA512
bb1afc327ff81ee10304904472cd52792b8b9bb8d494b1bac05a5c596339b82ac5092dfd2073309ce918c893d414f470a59a1a76d95c20f31305a7b8436004df

Download Submit
C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.dll
Filesize
747KB

MD5
d949da968ea04ac3a7ddf0e300bb32be

SHA1
581d7d799c538b8e9e578cf57c420fb802d5a201

SHA256
5c4756451acf8622efa75639f9131ca8215c165e2ef21cc1ab7f8fee77db462b

SHA512
fd00e332af52646425f0d4032bb1bbfc85a44ff274bcf212f1264a29be546db4c1ceab7da32c70248a6baa2c55d2dff47dcb2ac441c783a1d9d1260c4685eb7e

Download Submit
C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.x64.dll
Filesize
885KB

MD5
1a6b1013f17c1cdc6e98f82cd2568ea8

SHA1
c96e7bdba616743a5c05b08a342d89ed102376b0

SHA256
fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a

SHA512
10596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9

Download Submit
C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.x64.dll
Filesize
885KB

MD5
1a6b1013f17c1cdc6e98f82cd2568ea8

SHA1
c96e7bdba616743a5c05b08a342d89ed102376b0

SHA256
fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a

SHA512
10596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9

Download Submit
C:\Program Files (x86)\SkypEmoticons\VoGRjvvO8r5bps.x64.dll
Filesize
885KB

MD5
1a6b1013f17c1cdc6e98f82cd2568ea8

SHA1
c96e7bdba616743a5c05b08a342d89ed102376b0

SHA256
fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a

SHA512
10596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\DVkIzQnPwozFyzT.dat
Filesize
7KB

MD5
0d96fd55142da4c10dc1220273470864

SHA1
2a3845b22c9551672293f7f2a6f13d963c7cec79

SHA256
3884a69affd4320f2d63bf3cc6ed11186f8075cbcb98a0ba9a04f00c12adb034

SHA512
bb1afc327ff81ee10304904472cd52792b8b9bb8d494b1bac05a5c596339b82ac5092dfd2073309ce918c893d414f470a59a1a76d95c20f31305a7b8436004df

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\DVkIzQnPwozFyzT.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\DVkIzQnPwozFyzT.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
c9455d031f41b1cba084633fb7593b83

SHA1
12ee3ebb27de71d8ce0aa0a135960522539e52a9

SHA256
5947f7ddea5919698a47d96636ac7da1b96d775b4178cc71ddfa5705568ed830

SHA512
6c321dd542e7f1e3a41167706b0e9ebafdb64f20473334de69c20b274d1d854212e5cad60caec856df2b8b037f44986d67ea229d4465e8e06dbce6c128a44dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
9df079dbac50b84a2e8764296af2574c

SHA1
62dcfdca7167aefaf1356be153533a2571d099b2

SHA256
bdac26d92a8b6110c47ddada2b5cda11945f9f23e0c3254fa60681ade115ed20

SHA512
bf5b6f70abf3b7247f2a2843c359d41ddbd2396753085d77b95b35176f8ce3fbef7845d90208a2c7491015df7e88cad5f85c699c743f2c642091538a16ed0114

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\[email protected]\install.rdf
Filesize
602B

MD5
317ce1219a28d2c3a6ecb3519c6c8732

SHA1
936d2bd828b04ebf3a70180a27f0ed96ad27524d

SHA256
1395790c7742ea743b646f6325d41034f333af522314bc3e37c923d3c442f5c4

SHA512
f72a54df6b05640c4d88b9ba2f21243d92df9dbb4f002ce92bd6763f7684c870dcc51abf7d757d1114b908b0eb8fb411944fab6dbfefc42aaf1fa6e8a05765f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\VoGRjvvO8r5bps.dll
Filesize
747KB

MD5
d949da968ea04ac3a7ddf0e300bb32be

SHA1
581d7d799c538b8e9e578cf57c420fb802d5a201

SHA256
5c4756451acf8622efa75639f9131ca8215c165e2ef21cc1ab7f8fee77db462b

SHA512
fd00e332af52646425f0d4032bb1bbfc85a44ff274bcf212f1264a29be546db4c1ceab7da32c70248a6baa2c55d2dff47dcb2ac441c783a1d9d1260c4685eb7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\VoGRjvvO8r5bps.tlb
Filesize
3KB

MD5
5b503f1b4056c3d4fbf2d03f88e1adfe

SHA1
c8d659ea27bf0ca0bbfd46865d5796589bf9ef68

SHA256
231ef0fef77ab6c7fea053f64a9ce7f9e21646b868bfe391962262fc15c9bb6c

SHA512
229207201368d9674258389df19132070390f913aa5cc21b7567c515be5f5e0f07cdaa460d497ae355f27f00f7fc75538783d8890f6c9c0e861a7ecb8f520bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\VoGRjvvO8r5bps.x64.dll
Filesize
885KB

MD5
1a6b1013f17c1cdc6e98f82cd2568ea8

SHA1
c96e7bdba616743a5c05b08a342d89ed102376b0

SHA256
fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a

SHA512
10596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\lhhmkdfhfhcpcjnmlpljllokfniopnid\MUpWwW.js
Filesize
6KB

MD5
bdf2bcdc65e38228194870f63178d9a2

SHA1
79e458840183eb2792e25c2f0564aacea951f48d

SHA256
722b36424b14d4ad80d4bf1b8cb2d2812bae0e4d9256f61f176a40d2b1736f79

SHA512
521fa551c729b19b12f0f7f6c9559f30f2fded25fdf298395603a65a379cf5400044b5fe9d66ce4a5392ee92acf27561e9f5005645bfedd86c4465c17481ec22

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\lhhmkdfhfhcpcjnmlpljllokfniopnid\background.html
Filesize
143B

MD5
3fb57c8c811891c35e4ca82bf0170f5a

SHA1
10920bec5e7da56ea3017ad94c06db4a02c37784

SHA256
4a35a0af677655c91bb6716f387b0ec801aff9617cc6cd1912f8206061a9d5cb

SHA512
f5dfa9ab7befbfe602e6ae9830d862552880855584b63efadf58b43a57e89247c2572b471fa1cdbe95d8b6034dca0b4491b77eb1281148e23bed26f59d48b372

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\lhhmkdfhfhcpcjnmlpljllokfniopnid\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\lhhmkdfhfhcpcjnmlpljllokfniopnid\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFA82.tmp\lhhmkdfhfhcpcjnmlpljllokfniopnid\manifest.json
Filesize
505B

MD5
81ffb399385d4747d64ee1e27698ea05

SHA1
a86735aa92f91f22d4c32a999d3dc12103bf65ee

SHA256
a9e44c9b861cebc3f8c8c3fbba2cdac559d078855b8c63907007e40621244999

SHA512
a5162125cfb11779ceaa110b4a5641e38fea29d9a56405386475420024e9285cbd49b13338cf90a7ec207e532f05f61517b5261bf0f67a48ff49d3402eed1167

Download Submit
memory/884-132-0x0000000000000000-mapping.dmp

Download
memory/3740-152-0x0000000000000000-mapping.dmp

Download
memory/4856-149-0x0000000000000000-mapping.dmp

Download