51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946.exe
Size

920KB
MD5

e7b20873ebbbf942fb4c77aa268ae3bf
SHA1

2621fe69f192096b2a83839a23fbe68f8471ac75
SHA256

51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946
SHA512

bcb8356d1d7b7ad8fff8f75bddff0bb1b711dfa65ecc6cf4e40d4e220fcc17406a4d797c53768cb5a390217cbbf607c0afbd03f7bad28d89e90cf4090fc7c274
SSDEEP

24576:h1OYdaOHMtdHAqcdDVhYwiei7+EpFAh/kKu:h1Os+PHVmVhYwiLtKkKu

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

8zw7knIRFetu29P.exe

pid process

1084 8zw7knIRFetu29P.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

8zw7knIRFetu29P.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajhlgomonbdilnccoihmgkbkkbdjafdf\1.0\manifest.json	8zw7knIRFetu29P.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajhlgomonbdilnccoihmgkbkkbdjafdf\1.0\manifest.json	8zw7knIRFetu29P.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajhlgomonbdilnccoihmgkbkkbdjafdf\1.0\manifest.json	8zw7knIRFetu29P.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajhlgomonbdilnccoihmgkbkkbdjafdf\1.0\manifest.json	8zw7knIRFetu29P.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajhlgomonbdilnccoihmgkbkkbdjafdf\1.0\manifest.json	8zw7knIRFetu29P.exe

Drops file in System32 directory 4 IoCs

Processes:

8zw7knIRFetu29P.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	8zw7knIRFetu29P.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	8zw7knIRFetu29P.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	8zw7knIRFetu29P.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	8zw7knIRFetu29P.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

8zw7knIRFetu29P.exe

pid	process
1084	8zw7knIRFetu29P.exe
1084	8zw7knIRFetu29P.exe
1084	8zw7knIRFetu29P.exe
1084	8zw7knIRFetu29P.exe
1084	8zw7knIRFetu29P.exe
1084	8zw7knIRFetu29P.exe
1084	8zw7knIRFetu29P.exe
1084	8zw7knIRFetu29P.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946.exe

description	pid	process	target process
PID 5060 wrote to memory of 1084	5060	51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946.exe	8zw7knIRFetu29P.exe
PID 5060 wrote to memory of 1084	5060	51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946.exe	8zw7knIRFetu29P.exe
PID 5060 wrote to memory of 1084	5060	51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946.exe	8zw7knIRFetu29P.exe

C:\Users\Admin\AppData\Local\Temp\51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946.exe
"C:\Users\Admin\AppData\Local\Temp\51728dc33f53420b24754ab8167b932932bbf9e74b3da8afbd963b6def3da946.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\8zw7knIRFetu29P.exe
.\8zw7knIRFetu29P.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
7f62cbf7464ef999805a0ad3ac9ffec0

SHA1
b17a2fef5cd9e133adce286db3bc4d395980ac45

SHA256
3d1572a4fba03fcd9fb6149308118891d74c51d6d44d5ecd36b6527cbe97e347

SHA512
bdff84001f95d4a8b7686b8d225a434b743e311b2a362897c92fa6287b677b38140890daec898ca1244798a1bd1b29f6b22bd427d4a63385475aa1b264518852

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
af1d6f452b205f47ddb73bba7021b88e

SHA1
6d54d3f58fe7921397c5e27c9ff95c7281c53440

SHA256
1015ae523e6d54936b2f78116bcd584dfd1fcfb3e6b811ca02412a1d4ef1da78

SHA512
3955ed18532de5dfdaa8806d9385ecbdb7aa26fe67f9c57df04c452ff7bf39ea2b3e862a290702baa68b34879e2be31f9d25d2af6a63700b9d5db4f02197b1c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\[email protected]\install.rdf

Filesize
603B

MD5
ffd5ba8a603479c94e83f510adada190

SHA1
c428c0430605664f1eb588421277e143cd79d0a6

SHA256
1f045c5474a2e0763c4508b3af8e816a41e55c6d5d010183c273cba57c4f09e4

SHA512
77f72e94c09fd139ddf93e0ccb3d664735ae32f5302949d3a9ef43eb93194144e12b4616b0076bd68c7a2c9c7656e39a17365533f4111e66b598063d4cb24e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\8zw7knIRFetu29P.dat

Filesize
1KB

MD5
be6b84c540d7fe320e85248eea21375a

SHA1
f685151d4c532fa86806657beb67cdc571f008e8

SHA256
c8f5c4dcd28cd4a0440c1d839fb0062fce163a718098ec47c2b2f0fcc5abbf33

SHA512
207fd29573cac966842c73f3f606d647d9728af3e1d2d9c86bee5f095402aa496aac490de86880fa63928b1e4f0b5a3a9aa687470669e99e8d425566a5f80c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\8zw7knIRFetu29P.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\8zw7knIRFetu29P.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\ajhlgomonbdilnccoihmgkbkkbdjafdf\Dz37TBlYZt.js

Filesize
6KB

MD5
afed56a2648bf881ffa3353c3ea48afa

SHA1
03b3c39f373a86b67bd955906298a49b4ec36eb4

SHA256
21403d115198efd62967da5eb9d643e3155dc8077d08da6cee99979b129c583c

SHA512
7e2d68273fc563c0195fb69a8ff6109bba99d282782f7381df9035371d79b8ebe7bf269fe50a50b45f86605e5133ed758271870e23c053fc5bc36726fb80a1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\ajhlgomonbdilnccoihmgkbkkbdjafdf\background.html

Filesize
147B

MD5
d7098434113f3e9260368a332f4c5f70

SHA1
d7b2df8df0cd1115497dcce2152acd684b88bf1a

SHA256
62374ff24353337605e66132494d1c3240232822450233904c6dbb0dfbd25743

SHA512
5034c5cf449fb9015d7ac787d005d8c8a098734cf919fee0a9480058461e997f8be58decae6035b9e12c29397f5d2b9036c55175089d5d0585ebb73a391bc804

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\ajhlgomonbdilnccoihmgkbkkbdjafdf\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\ajhlgomonbdilnccoihmgkbkkbdjafdf\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS762F.tmp\ajhlgomonbdilnccoihmgkbkkbdjafdf\manifest.json

Filesize
505B

MD5
81ffb399385d4747d64ee1e27698ea05

SHA1
a86735aa92f91f22d4c32a999d3dc12103bf65ee

SHA256
a9e44c9b861cebc3f8c8c3fbba2cdac559d078855b8c63907007e40621244999

SHA512
a5162125cfb11779ceaa110b4a5641e38fea29d9a56405386475420024e9285cbd49b13338cf90a7ec207e532f05f61517b5261bf0f67a48ff49d3402eed1167

Download Submit
memory/1084-132-0x0000000000000000-mapping.dmp

Download