a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe
Size

932KB
MD5

5e75f2f72e2ff17040847e93a73216aa
SHA1

985973793293bb1f0046831413fa66c7813bea99
SHA256

a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103
SHA512

66daf86ff829af9ba77688ff9c0086c0dabd83a3f95c6ce6868c19c3e456c6a510862e9de35fce52e4f364acc971aec97d64cff6889b5cd759d31f87a8a77c94
SSDEEP

24576:h1OYdaOACZ/iWCvu/2sWsJA/jlt+DHhsi:h1OsqCpYO/dJJDHhsi

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CvPvVBtFi5cEztg.exe

pid process

772 CvPvVBtFi5cEztg.exe
Loads dropped DLL 1 IoCs

Processes:

a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe

pid process

2032 a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2032	a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe

Drops Chrome extension 3 IoCs

Processes:

CvPvVBtFi5cEztg.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcgbnnhknlekddjbnknbdohpieffagdj\2.0\manifest.json	CvPvVBtFi5cEztg.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcgbnnhknlekddjbnknbdohpieffagdj\2.0\manifest.json	CvPvVBtFi5cEztg.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcgbnnhknlekddjbnknbdohpieffagdj\2.0\manifest.json	CvPvVBtFi5cEztg.exe

Drops file in System32 directory 4 IoCs

Processes:

CvPvVBtFi5cEztg.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	CvPvVBtFi5cEztg.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	CvPvVBtFi5cEztg.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	CvPvVBtFi5cEztg.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	CvPvVBtFi5cEztg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

CvPvVBtFi5cEztg.exe

pid	process
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe
772	CvPvVBtFi5cEztg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

CvPvVBtFi5cEztg.exe

description	pid	process
Token: SeDebugPrivilege	772	CvPvVBtFi5cEztg.exe
Token: SeDebugPrivilege	772	CvPvVBtFi5cEztg.exe
Token: SeDebugPrivilege	772	CvPvVBtFi5cEztg.exe
Token: SeDebugPrivilege	772	CvPvVBtFi5cEztg.exe
Token: SeDebugPrivilege	772	CvPvVBtFi5cEztg.exe
Token: SeDebugPrivilege	772	CvPvVBtFi5cEztg.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe

description	pid	process	target process
PID 2032 wrote to memory of 772	2032	a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe	CvPvVBtFi5cEztg.exe
PID 2032 wrote to memory of 772	2032	a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe	CvPvVBtFi5cEztg.exe
PID 2032 wrote to memory of 772	2032	a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe	CvPvVBtFi5cEztg.exe
PID 2032 wrote to memory of 772	2032	a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe	CvPvVBtFi5cEztg.exe

C:\Users\Admin\AppData\Local\Temp\a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe
"C:\Users\Admin\AppData\Local\Temp\a77ab4e889c1170a115ece59ecf4ba36557b6dbd5882a72a91f407a8b9c65103.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\CvPvVBtFi5cEztg.exe
.\CvPvVBtFi5cEztg.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
1f87a579a6de93bd05695cc036ee7cf8

SHA1
8450d093e2eceb7c40ef690a4895655227728d65

SHA256
35f0395a89b663947cfde491896bbf04984cc0ce9304fa18e5adb455592991ce

SHA512
b4161d999482e22b5aeccc6abce6e5af73071ef7f16c3c431d269ba1e59395d0983165b874c3bdbf61e98b7ac51ba5c76bbcb72f609121313e652ee49f78cdf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
e5c221e76e888a690b837a7e53f85865

SHA1
0cdacec06e4f634643c78fd56f08c69cc4887490

SHA256
9da4cbc7ea00a779f9a6c2552a995a486e7bb0b7577cba5ed16beb5f1a2fd2e7

SHA512
30f0ad4e5e65203163ee300d8a8d3912e59353d7c8d2c99883f3f123a85c9729f9abee4e81408f402dda3e7a9f9d0b5b3666dd517f37b6f4a0812a920f1f86aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\[email protected]\install.rdf
Filesize
596B

MD5
0929438a1df52d827340c0cb074ea220

SHA1
10d16865ac18e9fc027ef2934375789475c61d26

SHA256
aba1b064836edb57a45dab53c294c4c1163544f0c8e217dfe947a41255682149

SHA512
6a614e90a7bed9d4db5a76be459427359d2af541187c77cfd2d6746fc9248553b7ec4378961331f5019e943795028419673323d4d78ed5d45a9d4894cd0ba885

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\CvPvVBtFi5cEztg.dat
Filesize
1KB

MD5
396c70ba30cf8a7b7180fb0937691b49

SHA1
84f8acf6e2fe3ddc8f25012b86c28badfe24ce1f

SHA256
3a89e70c3e9912b5a1653b5f5839636871671694535e152bcd4ee677e07d4eb0

SHA512
46fd3c3f2f553e7697474fab73c4664bb40fbf02443e2c49ea5fecae931e666a42981d9c92fb6f567421599aafa34d2ce174642ded1a6f1b4c2841fb2d25223b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\CvPvVBtFi5cEztg.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\hcgbnnhknlekddjbnknbdohpieffagdj\Gv.js
Filesize
6KB

MD5
ac7c0f51ef35559329d19ff6f3d231ab

SHA1
b273f1e217ea17009ae4782bdc96c185f8b448ea

SHA256
a5ac2bf230c6e59b03f833fee202a10b590485f0a912f530c74c18983f269e63

SHA512
18a944c627e4663c98837ab2b3780d7683807f5bcd6c33a1bcd7f03a52138096dc802665b1b6a4bc3d1e71ec4c43b8933bc00317ae40725f18d9e87d967d0d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\hcgbnnhknlekddjbnknbdohpieffagdj\background.html
Filesize
139B

MD5
43d59a32e9b6d357212f72b57dd748d2

SHA1
708d257db74e935925674cf8536135b1b9f7c13c

SHA256
7de1e68c74671352f633690ecf5727f793095cd62e6b91829ceb3147e1684eb4

SHA512
3e795e17317e900671f175fbde12cb537983d3deb12905c55b182c73471129221fdb4dde34756d5f514de6694bae5060b3c8e15be002a22c4f186a0e65ea7cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\hcgbnnhknlekddjbnknbdohpieffagdj\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\hcgbnnhknlekddjbnknbdohpieffagdj\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1324.tmp\hcgbnnhknlekddjbnknbdohpieffagdj\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1324.tmp\CvPvVBtFi5cEztg.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/772-56-0x0000000000000000-mapping.dmp

Download
memory/2032-54-0x0000000076B51000-0x0000000076B53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads