47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d

Analysis

max time kernel
163s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d.exe
Size

919KB
MD5

b4c4d0d448ebef4e0c3ac45815312b8c
SHA1

ace74c7b552968096643cbfb2f6c8c159171a246
SHA256

47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d
SHA512

7453e69f2de465948bd940a02bc3c18e0e85e50a8e2208f04527fc9070c4463e7e1e418c024f0fe58db2117e3ab7f4bb3b816ed12f41de04dabf65a2e37d6302
SSDEEP

24576:h1OYdaOyMtdHAqcdDVhYwiei7+EpFAh/kKr:h1OsnPHVmVhYwiLtKkKr

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

iOjESWjYWfGTUSa.exe

pid process

3276 iOjESWjYWfGTUSa.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

iOjESWjYWfGTUSa.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fejpndghoadijhodpedphidnkpklcfje\2.0\manifest.json	iOjESWjYWfGTUSa.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fejpndghoadijhodpedphidnkpklcfje\2.0\manifest.json	iOjESWjYWfGTUSa.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fejpndghoadijhodpedphidnkpklcfje\2.0\manifest.json	iOjESWjYWfGTUSa.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fejpndghoadijhodpedphidnkpklcfje\2.0\manifest.json	iOjESWjYWfGTUSa.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fejpndghoadijhodpedphidnkpklcfje\2.0\manifest.json	iOjESWjYWfGTUSa.exe

Drops file in System32 directory 4 IoCs

Processes:

iOjESWjYWfGTUSa.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	iOjESWjYWfGTUSa.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	iOjESWjYWfGTUSa.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	iOjESWjYWfGTUSa.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	iOjESWjYWfGTUSa.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

iOjESWjYWfGTUSa.exe

pid	process
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe
3276	iOjESWjYWfGTUSa.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

iOjESWjYWfGTUSa.exe

description	pid	process
Token: SeDebugPrivilege	3276	iOjESWjYWfGTUSa.exe
Token: SeDebugPrivilege	3276	iOjESWjYWfGTUSa.exe
Token: SeDebugPrivilege	3276	iOjESWjYWfGTUSa.exe
Token: SeDebugPrivilege	3276	iOjESWjYWfGTUSa.exe
Token: SeDebugPrivilege	3276	iOjESWjYWfGTUSa.exe
Token: SeDebugPrivilege	3276	iOjESWjYWfGTUSa.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d.exe

description	pid	process	target process
PID 3404 wrote to memory of 3276	3404	47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d.exe	iOjESWjYWfGTUSa.exe
PID 3404 wrote to memory of 3276	3404	47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d.exe	iOjESWjYWfGTUSa.exe
PID 3404 wrote to memory of 3276	3404	47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d.exe	iOjESWjYWfGTUSa.exe

C:\Users\Admin\AppData\Local\Temp\47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d.exe
"C:\Users\Admin\AppData\Local\Temp\47f64760deb5c97ad02b98c4028c5f79b77641bd37dda492a8368701dc87693d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404

C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\iOjESWjYWfGTUSa.exe
.\iOjESWjYWfGTUSa.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
ed27a15d5afdfd0c81f84b784589f8b8

SHA1
00c91fea8b3d8e5d1c5347804efd695c8c4df9c0

SHA256
d756924a474e841455223527873c55f5cf007b87caafbc948ccbf2546615e508

SHA512
f7dd8cd881bef1dcdc7e4a1cc3a7851d34afbd6a246481c675b9f911724fe67ef7b622284cf07c14c6bb37226020e8f99aa3fcb1bfaa5aeb5c4dfdab75add3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
8cbe89f95477dcad2ed0dcc7cc3c9264

SHA1
dde0604f27c6c1cda0635b8ee770a966a5495e69

SHA256
8041e5594afc27edbd979b0e65f3f342e00c3244778922556c80f9c176414265

SHA512
572b7e213207e71c92f638175b4219b763aa94adc8f3e33b44811f4485aa9d47c0444a5a7fbaf09874f234fe5ee70de388ac5dc16013de6523610c6e21203775

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\[email protected]\install.rdf
Filesize
595B

MD5
8a4c1d52a493c0a37f0af8206a6f23ae

SHA1
5c74d161a05f4b1a2a291b1c22da29aa8c3e1fca

SHA256
e5404b074433be72b4b837373a2c795d0e08c2aef77065c3d7325ad4dbfb5cb1

SHA512
576eab4d3d10a05d25558aaa2410f9f08f281a83c6711dd66424149e23f42a23be75c4f972ed66405f1df55c612a910431c1daa63cb570300b45b8b2aff8f029

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\fejpndghoadijhodpedphidnkpklcfje\background.html
Filesize
140B

MD5
b6d992b05236b2093a18bed38dcf5860

SHA1
b4ba2e620edfc74c60dea72837944a1a52b621de

SHA256
6beea7751bd2c58027b13d12d3ec3f370f871a26044f2dffdf55601fb3438340

SHA512
70b4dace3523f175036272dfd285652d556925f6f28f137e44217cfc02617b5437febcb21dc6639d2ee016caa2f16ec78acf8f498858c61549612bc10516051f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\fejpndghoadijhodpedphidnkpklcfje\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\fejpndghoadijhodpedphidnkpklcfje\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\fejpndghoadijhodpedphidnkpklcfje\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\fejpndghoadijhodpedphidnkpklcfje\xto.js
Filesize
6KB

MD5
78a31532468dedc7fbbfa9f2c023c1d7

SHA1
d7c1ff474d1b32acdd82578a13a8c4a75cf5fa7b

SHA256
129fe5d0e23598b134ad0dc00b63bf053df0687bc02ec4bad05da6b821695e50

SHA512
b8d5f5ab61505da28093c21d77adea8b864fad4b02075a1a46dc79668d13693eea788a3227730c43f58004b458dfa089cbb8f89ad1a82d8fd356ea1f29f131fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\iOjESWjYWfGTUSa.dat
Filesize
1KB

MD5
16063bb1dcd6d76298aba30bc5839449

SHA1
1f527db4f31e86e980cb9743d0351730ad86c9f5

SHA256
a7fb5a2d8240b40459c39d7439186829283ddbabdbec8a3cdf9374aced4234db

SHA512
dd5163c818235ce46fddfba902cf439206b393c5973575827e608f967e2e371a5eb88817c8f1cbc2336a3e0556666eebdbe49e6462bf0328f936e87b93b5eb0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\iOjESWjYWfGTUSa.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS78F9.tmp\iOjESWjYWfGTUSa.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/3276-132-0x0000000000000000-mapping.dmp

Download