a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78

Analysis

max time kernel
168s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78.exe
Size

931KB
MD5

d57e411aaee15ca5f3215212ba6835d8
SHA1

9a613998515b4c02f8a9708d6c1933c6d6e21ef8
SHA256

a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78
SHA512

3782af543134c2cf7876b15e1802aa976ba6259a36922228332156bad4f746dceded20b70ee096d1b88fb8a9fe038eab8e94b8e15e484bcb0567bc70ef3b6c30
SSDEEP

24576:h1OYdaORCZ/iWCvu/2sWsJA/jlt+DHhss:h1OsLCpYO/dJJDHhss

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

1O0WcmfylkkKGqM.exe

pid process

1084 1O0WcmfylkkKGqM.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

1O0WcmfylkkKGqM.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\doiigecoijngdbgohakgaghaddfpddco\2.0\manifest.json	1O0WcmfylkkKGqM.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\doiigecoijngdbgohakgaghaddfpddco\2.0\manifest.json	1O0WcmfylkkKGqM.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\doiigecoijngdbgohakgaghaddfpddco\2.0\manifest.json	1O0WcmfylkkKGqM.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\doiigecoijngdbgohakgaghaddfpddco\2.0\manifest.json	1O0WcmfylkkKGqM.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\doiigecoijngdbgohakgaghaddfpddco\2.0\manifest.json	1O0WcmfylkkKGqM.exe

Drops file in System32 directory 4 IoCs

Processes:

1O0WcmfylkkKGqM.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1O0WcmfylkkKGqM.exe
File opened for modification	C:\Windows\System32\GroupPolicy	1O0WcmfylkkKGqM.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1O0WcmfylkkKGqM.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1O0WcmfylkkKGqM.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

1O0WcmfylkkKGqM.exe

pid	process
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe
1084	1O0WcmfylkkKGqM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

1O0WcmfylkkKGqM.exe

description	pid	process
Token: SeDebugPrivilege	1084	1O0WcmfylkkKGqM.exe
Token: SeDebugPrivilege	1084	1O0WcmfylkkKGqM.exe
Token: SeDebugPrivilege	1084	1O0WcmfylkkKGqM.exe
Token: SeDebugPrivilege	1084	1O0WcmfylkkKGqM.exe
Token: SeDebugPrivilege	1084	1O0WcmfylkkKGqM.exe
Token: SeDebugPrivilege	1084	1O0WcmfylkkKGqM.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78.exe

description	pid	process	target process
PID 1872 wrote to memory of 1084	1872	a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78.exe	1O0WcmfylkkKGqM.exe
PID 1872 wrote to memory of 1084	1872	a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78.exe	1O0WcmfylkkKGqM.exe
PID 1872 wrote to memory of 1084	1872	a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78.exe	1O0WcmfylkkKGqM.exe

C:\Users\Admin\AppData\Local\Temp\a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78.exe
"C:\Users\Admin\AppData\Local\Temp\a78037e7c9da791d47cd002fd2e8cfcc2b2dcc7706a19fcee75b96dbc149df78.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\1O0WcmfylkkKGqM.exe
.\1O0WcmfylkkKGqM.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5108

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\1O0WcmfylkkKGqM.dat
Filesize
1KB

MD5
f2af4a715f5a6141ed43bbaafe08b9eb

SHA1
ef3b7a958963b6e5a08fef909c816e5bcdd3fff7

SHA256
add66684d7cffc768b2977fc1bdf2ce6161ccf88ded30a614974f6be6b900130

SHA512
dc054fc275114d5d50bab4e229c06c3fad02894e8f0c11c4c2592b21306f6f103132fe33943d2855995a7a558f75c15caf94831b71786cd6ea1dfa1f4e492ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\1O0WcmfylkkKGqM.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\1O0WcmfylkkKGqM.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
0c5b703f38bf86b6b9deebd48e67b0d6

SHA1
b499c4e72fc4f921fb51784456783017fc57b574

SHA256
c7be10e20b3930451a649df2ff904ce39eeb8a5d298fcc3d43062fb7ed02d179

SHA512
eb57958feb02af3778b17f682af1d1d8d7eb8f4e0eda716cba0f22cff89c172d9f9f6ea4c16c028f5b06647478150f8a3209608314392bce01f7425ae71d7422

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
f45c3ffdf245bf072035eccb32c4d2f1

SHA1
c12fcc17de6bf788b8e0483f1aee6ab02d2847fe

SHA256
a09f4a91d8747bbcb2c59c3d31f0828f7b4d283fe131130dd3018c1bc101bfcc

SHA512
f4b9b85be89a07fed6d123ef1a062c4826e6f258cb839e00c2deff1e604e4cd06c642cf1177d20f197ff9e1ebff469265b41f09d2e376a22d6acaf7b6c1d97ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\[email protected]\install.rdf
Filesize
590B

MD5
1bda8d9c83fd78e30700fc85f9548c3e

SHA1
73eb380344a6606095f8bfeaf1ff56c818b4aff7

SHA256
d8c219507e07cbbf2560ea829963989708f93337d8d9ebbed9e1f0a2bd9d60cd

SHA512
07f763b1b30728f8f2ce5e6a393da04e4bd976144a0e9afdfc05bd2cba0ac239c307dc2d39c37fa24440eda07a884004d2953ee6d476984f995edb44f609109a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\doiigecoijngdbgohakgaghaddfpddco\background.html
Filesize
139B

MD5
65283cb41c17fcf4278e2baa023e65aa

SHA1
9ca935d944eb1d9edd31a31a89626f1052158f42

SHA256
a40a23fa3643c3678b5fda03a81513a8b100c7d0acbbc90380b2644d065c636c

SHA512
423c20b9b74216c78c5fb821208dd13ab416f2275189637917fbf63d0f97bffaab0c889678e5be621ec6778b77800faf42582d6cc6b6c9dd88f21bfae7c654d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\doiigecoijngdbgohakgaghaddfpddco\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\doiigecoijngdbgohakgaghaddfpddco\dt.js
Filesize
6KB

MD5
209381fbad85535f5028514cb0736c45

SHA1
c6c4c610e07f9118936ce3d76ed19ee522a9d10d

SHA256
a3976f1a5f1e69400218a20f493a9095b131c02a41ba9f83f23e06572c8a8976

SHA512
152c9982183a520a08e60d8de053f0fbc39f6ef51b018e4c91d4f4895bf686dbc3857a90114e8f9b40b969b9dea7cdaaf4daac4e6412e75f2553be1e30322796

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\doiigecoijngdbgohakgaghaddfpddco\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEFA4.tmp\doiigecoijngdbgohakgaghaddfpddco\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1084-132-0x0000000000000000-mapping.dmp

Download