4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8.exe
Size

2.5MB
MD5

e14b9eb94670efa7c03a0b2b797daa53
SHA1

b6d8d9a26f093bcfe3f5ea2f28909982810cfa4a
SHA256

4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8
SHA512

c383debbeaac7b001939807ee19ae820a26edd0400f1faa52ac3b8fae02b0a82224b0cbe0d921a6757971d735e2430c30715a4bb63b72af88c5f38e07dcc2c9d
SSDEEP

49152:h1OshTAHQDPTB3RnKWXUjuxZsHKddXx/WPKGL2ONrq8J8aUnbeZ9F:h1OqTAqMjuxZH/Wpdf

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

7vkxCcLhkb1D0uC.exe

pid process

2920 7vkxCcLhkb1D0uC.exe
Loads dropped DLL 3 IoCs

Processes:

7vkxCcLhkb1D0uC.exeregsvr32.exeregsvr32.exe

pid process

2920 7vkxCcLhkb1D0uC.exe
1028 regsvr32.exe
4356 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2920	7vkxCcLhkb1D0uC.exe

pid	process
2920	7vkxCcLhkb1D0uC.exe
1028	regsvr32.exe
4356	regsvr32.exe

Drops Chrome extension 5 IoCs

Processes:

7vkxCcLhkb1D0uC.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngggfnohogahfeofogpajijoacbogbbl\200\manifest.json	7vkxCcLhkb1D0uC.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngggfnohogahfeofogpajijoacbogbbl\200\manifest.json	7vkxCcLhkb1D0uC.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngggfnohogahfeofogpajijoacbogbbl\200\manifest.json	7vkxCcLhkb1D0uC.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngggfnohogahfeofogpajijoacbogbbl\200\manifest.json	7vkxCcLhkb1D0uC.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngggfnohogahfeofogpajijoacbogbbl\200\manifest.json	7vkxCcLhkb1D0uC.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe7vkxCcLhkb1D0uC.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	7vkxCcLhkb1D0uC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	7vkxCcLhkb1D0uC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	7vkxCcLhkb1D0uC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	7vkxCcLhkb1D0uC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe

Drops file in Program Files directory 8 IoCs

Processes:

7vkxCcLhkb1D0uC.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.tlb	7vkxCcLhkb1D0uC.exe
File created	C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.dat	7vkxCcLhkb1D0uC.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.dat	7vkxCcLhkb1D0uC.exe
File created	C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.x64.dll	7vkxCcLhkb1D0uC.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.x64.dll	7vkxCcLhkb1D0uC.exe
File created	C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.dll	7vkxCcLhkb1D0uC.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.dll	7vkxCcLhkb1D0uC.exe
File created	C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.tlb	7vkxCcLhkb1D0uC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7vkxCcLhkb1D0uC.exe

pid process

2920 7vkxCcLhkb1D0uC.exe
2920 7vkxCcLhkb1D0uC.exe

pid	process
2920	7vkxCcLhkb1D0uC.exe
2920	7vkxCcLhkb1D0uC.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8.exe7vkxCcLhkb1D0uC.exeregsvr32.exe

description	pid	process	target process
PID 4988 wrote to memory of 2920	4988	4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8.exe	7vkxCcLhkb1D0uC.exe
PID 4988 wrote to memory of 2920	4988	4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8.exe	7vkxCcLhkb1D0uC.exe
PID 4988 wrote to memory of 2920	4988	4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8.exe	7vkxCcLhkb1D0uC.exe
PID 2920 wrote to memory of 1028	2920	7vkxCcLhkb1D0uC.exe	regsvr32.exe
PID 2920 wrote to memory of 1028	2920	7vkxCcLhkb1D0uC.exe	regsvr32.exe
PID 2920 wrote to memory of 1028	2920	7vkxCcLhkb1D0uC.exe	regsvr32.exe
PID 1028 wrote to memory of 4356	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 4356	1028	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8.exe
"C:\Users\Admin\AppData\Local\Temp\4bbc377cae8e928e1add8617d5593a9f285da84ce17d520f18b014e6370215e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\7vkxCcLhkb1D0uC.exe
.\7vkxCcLhkb1D0uC.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.x64.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.x64.dll"
4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:4356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.dat
Filesize
6KB

MD5
767a7704657a7921edbcf1774edb9ce5

SHA1
243b9a6d999fbd7179b6dfecca2d757f7788810f

SHA256
f1b5b58633072afd9fd749c087223f3a9f923c218136829635bc3509325ed883

SHA512
682898c3b6edeb7f4eef401874bb5165a4efbe04c78637cc16239db045031d96a80ed292cc598a211cbc30137a447d0eaebe9d3a8df8edded5a1d40386c2d805

Download Submit
C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.dll
Filesize
747KB

MD5
568f45a778978bfa4c7b3bd0c6a5dbf3

SHA1
2bf9ff26b5c38630b42d932506905725ef3a04a6

SHA256
a914e0ec45c799c86c4f62d4144ab5b9c9ded0ad33461fb41de8a437ce00196d

SHA512
62727e134832a741b10260a50a3f0ea68dece7e8f22afc29b937c10a84b3d6fbd23f36b8a1ff83bfa804a7fa18482671d25a9e94b77820c64f33bd66a95f2fca

Download Submit
C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.x64.dll
Filesize
875KB

MD5
17da2bf78af676b649eae4f74864dfcc

SHA1
decf265a0aadc130874511ace40c62b0c0e16aac

SHA256
b3a707a96ccf454e91ecc1c8578928232646f188b7d9973678f0e27bbf96a2fb

SHA512
76522bd652d3ed0d6bec2c467937e319c24040498f825a2e5dec3c18357c5548a37b3d99de1f748ffdc380ae36b502ec0a6761f2adb55ffbbab1972323a3e806

Download Submit
C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.x64.dll
Filesize
875KB

MD5
17da2bf78af676b649eae4f74864dfcc

SHA1
decf265a0aadc130874511ace40c62b0c0e16aac

SHA256
b3a707a96ccf454e91ecc1c8578928232646f188b7d9973678f0e27bbf96a2fb

SHA512
76522bd652d3ed0d6bec2c467937e319c24040498f825a2e5dec3c18357c5548a37b3d99de1f748ffdc380ae36b502ec0a6761f2adb55ffbbab1972323a3e806

Download Submit
C:\Program Files (x86)\Browser Shop\SmGpJ1FtvlOqfl.x64.dll
Filesize
875KB

MD5
17da2bf78af676b649eae4f74864dfcc

SHA1
decf265a0aadc130874511ace40c62b0c0e16aac

SHA256
b3a707a96ccf454e91ecc1c8578928232646f188b7d9973678f0e27bbf96a2fb

SHA512
76522bd652d3ed0d6bec2c467937e319c24040498f825a2e5dec3c18357c5548a37b3d99de1f748ffdc380ae36b502ec0a6761f2adb55ffbbab1972323a3e806

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\7vkxCcLhkb1D0uC.dat
Filesize
6KB

MD5
767a7704657a7921edbcf1774edb9ce5

SHA1
243b9a6d999fbd7179b6dfecca2d757f7788810f

SHA256
f1b5b58633072afd9fd749c087223f3a9f923c218136829635bc3509325ed883

SHA512
682898c3b6edeb7f4eef401874bb5165a4efbe04c78637cc16239db045031d96a80ed292cc598a211cbc30137a447d0eaebe9d3a8df8edded5a1d40386c2d805

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\7vkxCcLhkb1D0uC.exe
Filesize
785KB

MD5
c452103272f13b87cdbecb41ae8c5e15

SHA1
3904c76d43842139288db38322ae2522f69b0f47

SHA256
95494f4ea7ec3895ab6b670e91e3f99489d4ac84e54bb652bda11f1d539c5a30

SHA512
f20683111d6cc0dc72de592e74d101a30af835bd32d4a70ad00fb9f2b5cc42081e6c942477dba8bb294ee0aadedf1e3b335bb982b5613ae550987f10f84273a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\7vkxCcLhkb1D0uC.exe
Filesize
785KB

MD5
c452103272f13b87cdbecb41ae8c5e15

SHA1
3904c76d43842139288db38322ae2522f69b0f47

SHA256
95494f4ea7ec3895ab6b670e91e3f99489d4ac84e54bb652bda11f1d539c5a30

SHA512
f20683111d6cc0dc72de592e74d101a30af835bd32d4a70ad00fb9f2b5cc42081e6c942477dba8bb294ee0aadedf1e3b335bb982b5613ae550987f10f84273a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\SmGpJ1FtvlOqfl.dll
Filesize
747KB

MD5
568f45a778978bfa4c7b3bd0c6a5dbf3

SHA1
2bf9ff26b5c38630b42d932506905725ef3a04a6

SHA256
a914e0ec45c799c86c4f62d4144ab5b9c9ded0ad33461fb41de8a437ce00196d

SHA512
62727e134832a741b10260a50a3f0ea68dece7e8f22afc29b937c10a84b3d6fbd23f36b8a1ff83bfa804a7fa18482671d25a9e94b77820c64f33bd66a95f2fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\SmGpJ1FtvlOqfl.tlb
Filesize
3KB

MD5
09f02d57c684e89e594215260e2323b4

SHA1
c66c408e4919d9466f0b079846658165fd5daf11

SHA256
e4cdffe72ccc82e3dc738b78bc1aa4646ef9f9451662b0de6d67e18067837383

SHA512
f44be8c55204e41ade8c71d837cfe6d21fc9e708fdeb1b40433b4b893287f11006835ff1361e81de42f9cf03e0783269169e7ec920ea6b4f369f2dd648febdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\SmGpJ1FtvlOqfl.x64.dll
Filesize
875KB

MD5
17da2bf78af676b649eae4f74864dfcc

SHA1
decf265a0aadc130874511ace40c62b0c0e16aac

SHA256
b3a707a96ccf454e91ecc1c8578928232646f188b7d9973678f0e27bbf96a2fb

SHA512
76522bd652d3ed0d6bec2c467937e319c24040498f825a2e5dec3c18357c5548a37b3d99de1f748ffdc380ae36b502ec0a6761f2adb55ffbbab1972323a3e806

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
bcc560ee77fda4438e5a3cb0cbee9bb9

SHA1
1efdb23c977a75a91abcfa29062f236c5cf0999d

SHA256
e35020dfd174d47012296587acc830d99e4017bf78c46229fbd6527d3b1c4431

SHA512
6a35da94b2130daca85e9e77667addb7c0ac7dd5e2a8b44f0802a916d153d9521c7edeb7814613eeb6073146e26896e985214f77567b93660811ef365c51a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\[email protected]\content\bg.js
Filesize
7KB

MD5
fe5e96844e6384e54a3ac07ede9335d1

SHA1
724e42daa10a4711021c5a46f913dd86fa10abae

SHA256
37c1cf7c522142fd89e8f5f655cec6b702980facbd1a134e069893d04f02320d

SHA512
f4e004d8c04141de09fec0dfbf1e9ab1b9f342660c5545abc464b3a803778edaa72c0d467c6657764520e0f962d93758b2f4b4f1bdc0f57a9803f1cb8899b005

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\[email protected]\install.rdf
Filesize
597B

MD5
d5caeec043c3ed95b023f0f5f3300bed

SHA1
d418befcd55d4799e960fcbf039263fcb0dc9cbe

SHA256
bf61b137120111892390b3e8c1c789fa94b698e7c68bdb2ae0c449f5666bef29

SHA512
b6679a27a6367ee289fda0929864426308ee19676e558d1ce93088787d128f458f2bea986931874055b7b8fe36eef653162f3a4b1cc7cb7d81544d438a008d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\ngggfnohogahfeofogpajijoacbogbbl\YoOG34p.js
Filesize
5KB

MD5
1ec4a84c3650aee5eea37af9380c7726

SHA1
21388b56a567afc4736b8258a90f53c5a56a7036

SHA256
8067a1cdf50a1c0d88b626f786588a66f814241482b495dbb080998af8806a57

SHA512
1aa7b6c92469f27ba8250faf6d34e82769e2a1254d5b5db2c4201131b5b3f608af96f8ea9074a110f2f9906ad5dbb31a8efb3b0c8910805fd815908752985365

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\ngggfnohogahfeofogpajijoacbogbbl\background.html
Filesize
144B

MD5
564bf56540fb5e6930ed09e0530ed7be

SHA1
39ac883b7c171fa01aeb40156f3c9dfa2d745804

SHA256
fccc3f005664f986c095c4452a68fa4d34d80231596550392f0380945d6ace87

SHA512
6391160bf4656e141e935914bf3a6829d165431d324e07453546c75c0b7f09165fed535115eaf2ef3c5473bf649553d4b1eec154a7c7aa4f449f3a985ac433a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\ngggfnohogahfeofogpajijoacbogbbl\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\ngggfnohogahfeofogpajijoacbogbbl\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\ngggfnohogahfeofogpajijoacbogbbl\manifest.json
Filesize
504B

MD5
d532994175ac6e4e8fea2ae07edef6ff

SHA1
5646eab3cebc8b0a804103b63f08a63db784a77d

SHA256
f9a190f8cfafdeddfe9627366bcd108e42b7fa07c8d074f1570bd77489f39c4d

SHA512
ba6ddc11423c0b0d93de3e3ecb9eeebe29470723282165aa67de4329a5f9af7e390869a7cbd0834c1ff115a1ed0a274bed686b4b6630e98b268ec1f2a9a8dadb

Download Submit
memory/1028-149-0x0000000000000000-mapping.dmp

Download
memory/2920-132-0x0000000000000000-mapping.dmp

Download
memory/4356-152-0x0000000000000000-mapping.dmp

Download