7f28795746ba9626d5b7930666dda99ed07cad99ce091cf71055ae5e331a68fc

Analysis

max time kernel
150s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f28795746ba9626d5b7930666dda99ed07cad99ce091cf71055ae5e331a68fc.exe
Size

2.1MB
MD5

80b20bf66e4e3b08cf3ffd4e134041b8
SHA1

97283f6f5b5eead56ef37405f6a6bd1394148ec4
SHA256

7f28795746ba9626d5b7930666dda99ed07cad99ce091cf71055ae5e331a68fc
SHA512

478ef675d4aa39e9c1325cc3d49ce4cb5dacd5ff1a95805b8cd0af09ca825564e6adf71ef48d60f2a0c6309bc91266b8d3ce14a254ae2dccf151342c772c201c
SSDEEP

49152:h1OsaPY2QfeuG1nqR/d9zWFUZsqI6uPUgnWGaO:h1OxlQfeuGIR1RfuPUC

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	lvw5KnArNPwoPYb.exe

Loads dropped DLL 3 IoCs

pid	Process
1672	lvw5KnArNPwoPYb.exe
2176	regsvr32.exe
4124	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahfognjngniikhejmhbndlonbdcgfnjk\2.0\manifest.json	lvw5KnArNPwoPYb.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahfognjngniikhejmhbndlonbdcgfnjk\2.0\manifest.json	lvw5KnArNPwoPYb.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahfognjngniikhejmhbndlonbdcgfnjk\2.0\manifest.json	lvw5KnArNPwoPYb.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahfognjngniikhejmhbndlonbdcgfnjk\2.0\manifest.json	lvw5KnArNPwoPYb.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahfognjngniikhejmhbndlonbdcgfnjk\2.0\manifest.json	lvw5KnArNPwoPYb.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	lvw5KnArNPwoPYb.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	lvw5KnArNPwoPYb.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	lvw5KnArNPwoPYb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	lvw5KnArNPwoPYb.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GoSave\geHvN9et69zuA8.tlb	lvw5KnArNPwoPYb.exe
File created	C:\Program Files (x86)\GoSave\geHvN9et69zuA8.dat	lvw5KnArNPwoPYb.exe
File opened for modification	C:\Program Files (x86)\GoSave\geHvN9et69zuA8.dat	lvw5KnArNPwoPYb.exe
File created	C:\Program Files (x86)\GoSave\geHvN9et69zuA8.x64.dll	lvw5KnArNPwoPYb.exe
File opened for modification	C:\Program Files (x86)\GoSave\geHvN9et69zuA8.x64.dll	lvw5KnArNPwoPYb.exe
File created	C:\Program Files (x86)\GoSave\geHvN9et69zuA8.dll	lvw5KnArNPwoPYb.exe
File opened for modification	C:\Program Files (x86)\GoSave\geHvN9et69zuA8.dll	lvw5KnArNPwoPYb.exe
File created	C:\Program Files (x86)\GoSave\geHvN9et69zuA8.tlb	lvw5KnArNPwoPYb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1672	1096	7f28795746ba9626d5b7930666dda99ed07cad99ce091cf71055ae5e331a68fc.exe	76
PID 1096 wrote to memory of 1672	1096	7f28795746ba9626d5b7930666dda99ed07cad99ce091cf71055ae5e331a68fc.exe	76
PID 1096 wrote to memory of 1672	1096	7f28795746ba9626d5b7930666dda99ed07cad99ce091cf71055ae5e331a68fc.exe	76
PID 1672 wrote to memory of 2176	1672	lvw5KnArNPwoPYb.exe	77
PID 1672 wrote to memory of 2176	1672	lvw5KnArNPwoPYb.exe	77
PID 1672 wrote to memory of 2176	1672	lvw5KnArNPwoPYb.exe	77
PID 2176 wrote to memory of 4124	2176	regsvr32.exe	78
PID 2176 wrote to memory of 4124	2176	regsvr32.exe	78

C:\Users\Admin\AppData\Local\Temp\7f28795746ba9626d5b7930666dda99ed07cad99ce091cf71055ae5e331a68fc.exe
"C:\Users\Admin\AppData\Local\Temp\7f28795746ba9626d5b7930666dda99ed07cad99ce091cf71055ae5e331a68fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\lvw5KnArNPwoPYb.exe
  .\lvw5KnArNPwoPYb.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSave\geHvN9et69zuA8.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSave\geHvN9et69zuA8.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:4124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSave\geHvN9et69zuA8.dat

Filesize
6KB

MD5
1f405e6bfbe835728fd18acbe06e71f1

SHA1
8808a1470e7dfcc38d439ad0dd3418769f1c255a

SHA256
10a0ac261867a7cba885dea2417e3d16b0a1721ff1ce487f2144ca19436edfc4

SHA512
a84b014fa6131579805793fc064b3d5b6e0dc217858e30833ac6fa1325110ebe59f61632c56b533733a04e2758f3a31d0b6d0821ad42ea2ea86b4175d80e6bcb

Download Submit
C:\Program Files (x86)\GoSave\geHvN9et69zuA8.dll

Filesize
612KB

MD5
4e8d65edf539af96ec6861d8445573ae

SHA1
1b4554cd7c108aa09bb3aed009ac8440c0f8bb93

SHA256
f7931fcce1da10bbc25b3aff0b72a6744a7e454d9fc5d83f9c612e142eafee87

SHA512
a0ffd39e17e3e39d12d36bacebd21ac309f09b36e26b786d54e0218d6c41c01a3c3ecfe37aa7c4636f8be3c6821f21a21a3ba327d93fbddcb7adfca591838455

Download Submit
C:\Program Files (x86)\GoSave\geHvN9et69zuA8.x64.dll

Filesize
693KB

MD5
036a783b0d4af93086c9bef9bf1ed7d8

SHA1
58624b183fda19f285365c464914d8c342f693e5

SHA256
1cb50065e24f17a830d511888a1d857556e804ad0ad82d67953b3cbf04a406ec

SHA512
5f25cd28cad3bdd19475d2adfe7385cf177f0177010cd30d2cb03b237f011ae14b993a61466b71fa81613b51664f6b7c4ece954e78d667a17146e9aa38752062

Download Submit
C:\Program Files (x86)\GoSave\geHvN9et69zuA8.x64.dll

Filesize
693KB

MD5
036a783b0d4af93086c9bef9bf1ed7d8

SHA1
58624b183fda19f285365c464914d8c342f693e5

SHA256
1cb50065e24f17a830d511888a1d857556e804ad0ad82d67953b3cbf04a406ec

SHA512
5f25cd28cad3bdd19475d2adfe7385cf177f0177010cd30d2cb03b237f011ae14b993a61466b71fa81613b51664f6b7c4ece954e78d667a17146e9aa38752062

Download Submit
C:\Program Files (x86)\GoSave\geHvN9et69zuA8.x64.dll

Filesize
693KB

MD5
036a783b0d4af93086c9bef9bf1ed7d8

SHA1
58624b183fda19f285365c464914d8c342f693e5

SHA256
1cb50065e24f17a830d511888a1d857556e804ad0ad82d67953b3cbf04a406ec

SHA512
5f25cd28cad3bdd19475d2adfe7385cf177f0177010cd30d2cb03b237f011ae14b993a61466b71fa81613b51664f6b7c4ece954e78d667a17146e9aa38752062

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\ahfognjngniikhejmhbndlonbdcgfnjk\background.html

Filesize
147B

MD5
5b515865288e275ef90b25603b5feb54

SHA1
724336b1435bc4834a2d29764c626a97627c5aec

SHA256
1a4d6b32d68ad06fbc4b1f16a55aae21d78c086ec4118c2a9816137b3a23eba7

SHA512
995f15f7ed7948fb886f30b86d324e5a7e14f1860f4effcffd0ccd902750219911d96fc901f16276d22b99fc60b647ed9f54fed70c4f17a4bacc436c4f08cd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\ahfognjngniikhejmhbndlonbdcgfnjk\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\ahfognjngniikhejmhbndlonbdcgfnjk\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\ahfognjngniikhejmhbndlonbdcgfnjk\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\ahfognjngniikhejmhbndlonbdcgfnjk\r628wj9G3c.js

Filesize
5KB

MD5
8dd61a5fb08d3d9c5232435bbf0db4bb

SHA1
d629e537a5c453f07339fc3342cec7f865a7f83f

SHA256
6bf3edb6978c31178929114458043e945bc1b48ddef13ba2375a65e22f48cdc7

SHA512
8e0df8cbed2fbbbce845c981dc4e196b1ea3ab462da8857e1c1edc01e2d04625fe9f3fa99fd34f6caff37871568cf1c2735d89d9a09d5e72872f21bf15ec23ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\geHvN9et69zuA8.dll

Filesize
612KB

MD5
4e8d65edf539af96ec6861d8445573ae

SHA1
1b4554cd7c108aa09bb3aed009ac8440c0f8bb93

SHA256
f7931fcce1da10bbc25b3aff0b72a6744a7e454d9fc5d83f9c612e142eafee87

SHA512
a0ffd39e17e3e39d12d36bacebd21ac309f09b36e26b786d54e0218d6c41c01a3c3ecfe37aa7c4636f8be3c6821f21a21a3ba327d93fbddcb7adfca591838455

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\geHvN9et69zuA8.tlb

Filesize
3KB

MD5
123d8e428b231b034495720766d9db44

SHA1
20db932b0f9fb5045ae866259d4c4c2650e519fe

SHA256
e5a0972cb89bbe9ca59f02a11f145178b7cfee9d43cd2e6729b4d4b9c1809d1f

SHA512
79444ea1e1eecf5adaef18c229516bb095898a7ceed229133a6d6e7082ce02c9e40612ca2b3474d8934f47f41077784cf252ca5832faf0b7063d8cb3c31a1afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\geHvN9et69zuA8.x64.dll

Filesize
693KB

MD5
036a783b0d4af93086c9bef9bf1ed7d8

SHA1
58624b183fda19f285365c464914d8c342f693e5

SHA256
1cb50065e24f17a830d511888a1d857556e804ad0ad82d67953b3cbf04a406ec

SHA512
5f25cd28cad3bdd19475d2adfe7385cf177f0177010cd30d2cb03b237f011ae14b993a61466b71fa81613b51664f6b7c4ece954e78d667a17146e9aa38752062

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\lvw5KnArNPwoPYb.dat

Filesize
6KB

MD5
1f405e6bfbe835728fd18acbe06e71f1

SHA1
8808a1470e7dfcc38d439ad0dd3418769f1c255a

SHA256
10a0ac261867a7cba885dea2417e3d16b0a1721ff1ce487f2144ca19436edfc4

SHA512
a84b014fa6131579805793fc064b3d5b6e0dc217858e30833ac6fa1325110ebe59f61632c56b533733a04e2758f3a31d0b6d0821ad42ea2ea86b4175d80e6bcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\lvw5KnArNPwoPYb.exe

Filesize
634KB

MD5
af19e3488de335eb28ca3eb46566b7e1

SHA1
1ec3cdea5742b5961605cc1dea8e4d347a5d9cc1

SHA256
e59002c28df258c3a628aa28295edaf96f4235811f04aabab4bb5a42d3cd46cb

SHA512
a51581e8a6becbc27eb3d51b5ec195205d58f15f0483856f7a1afa8927dd138bea301db9253d731fc7c235b4b3acc1cbbe41b3eb04d94d2773942a76e7323247

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\lvw5KnArNPwoPYb.exe

Filesize
634KB

MD5
af19e3488de335eb28ca3eb46566b7e1

SHA1
1ec3cdea5742b5961605cc1dea8e4d347a5d9cc1

SHA256
e59002c28df258c3a628aa28295edaf96f4235811f04aabab4bb5a42d3cd46cb

SHA512
a51581e8a6becbc27eb3d51b5ec195205d58f15f0483856f7a1afa8927dd138bea301db9253d731fc7c235b4b3acc1cbbe41b3eb04d94d2773942a76e7323247

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
c83186a94aa83151351ec129ce1368ef

SHA1
9624e3fbf6b4e1f83ce0818a141ae96402fbf867

SHA256
1c3e400b668c99d067d93ef91c8d6ee2f0f5e4d0b6eba905dd2066935f5adc62

SHA512
fe7903d9680229338dd6bf5427a359e939cbf1e26e35985086b15e672a587326db056818fffa7e6e2a23d34c473242c3d34f850bb7c27d86b710b6a75ff36c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
a059bdde67fd5b59a289dbde16fce6db

SHA1
e8228bc559b6ca8f70571f469dc362584acaaf67

SHA256
37310649ad1e5aaf17a2b944da2b186e3ba0704f650f9677fe1effceee84d2f9

SHA512
1d9ea6b6c5561bea812bb6c8e6b658805a18539f54f9acf0b90615dbe9ccd3efe8680102a643181335ee0097379cf251eee4374ddbd351b7036f7922480ed397

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAEF2.tmp\[email protected]\install.rdf

Filesize
592B

MD5
e1967860f11d36def0c1b92d59c9b2fa

SHA1
6edb190d04b3b79acc85211a8af2952b7bd0c802

SHA256
6ea42e9df4989bc3dc3a7503a2365d013cefb5d3f671c7073799ed052bac8616

SHA512
a3a55310d30c7347477f0c118ab281a9eb31090ebfb80aae57fca093686d4a10b9519b63633975fc243ad5187ba5b0d5c0cb95cc2a7154fd09b8f8d341ad9930

Download Submit
memory/1672-132-0x0000000000000000-mapping.dmp

Download
memory/2176-149-0x0000000000000000-mapping.dmp

Download
memory/4124-152-0x0000000000000000-mapping.dmp

Download