470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86

Analysis

max time kernel
142s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86.exe
Size

931KB
MD5

14065732426031014310a5f7dbf08d1b
SHA1

58d87c12941dc67980d6f5e7ac3fc2000b3ccb9c
SHA256

470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86
SHA512

19a3a169c9455e808f8a1783b79488e8cd8fb6da0a8b054bf9bef123d9692c7bb618e6c5eb5e4cf0e9ab91dd112fdc333f40277ef8f9713e34bd4afcbea8383d
SSDEEP

24576:h1OYdaOeCZ/iWCvu/2sWsJA/jlt+DHhsg:h1OsQCpYO/dJJDHhsg

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

8gXXAxkJfXheNZ4.exe

pid process

2800 8gXXAxkJfXheNZ4.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

8gXXAxkJfXheNZ4.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojdlpeiokdlobjdainokijdepkidlofo\2.0\manifest.json	8gXXAxkJfXheNZ4.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojdlpeiokdlobjdainokijdepkidlofo\2.0\manifest.json	8gXXAxkJfXheNZ4.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojdlpeiokdlobjdainokijdepkidlofo\2.0\manifest.json	8gXXAxkJfXheNZ4.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojdlpeiokdlobjdainokijdepkidlofo\2.0\manifest.json	8gXXAxkJfXheNZ4.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojdlpeiokdlobjdainokijdepkidlofo\2.0\manifest.json	8gXXAxkJfXheNZ4.exe

Drops file in System32 directory 4 IoCs

Processes:

8gXXAxkJfXheNZ4.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	8gXXAxkJfXheNZ4.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	8gXXAxkJfXheNZ4.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	8gXXAxkJfXheNZ4.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	8gXXAxkJfXheNZ4.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

8gXXAxkJfXheNZ4.exe

pid	process
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe
2800	8gXXAxkJfXheNZ4.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

8gXXAxkJfXheNZ4.exe

description	pid	process
Token: SeDebugPrivilege	2800	8gXXAxkJfXheNZ4.exe
Token: SeDebugPrivilege	2800	8gXXAxkJfXheNZ4.exe
Token: SeDebugPrivilege	2800	8gXXAxkJfXheNZ4.exe
Token: SeDebugPrivilege	2800	8gXXAxkJfXheNZ4.exe
Token: SeDebugPrivilege	2800	8gXXAxkJfXheNZ4.exe
Token: SeDebugPrivilege	2800	8gXXAxkJfXheNZ4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86.exe

description	pid	process	target process
PID 1732 wrote to memory of 2800	1732	470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86.exe	8gXXAxkJfXheNZ4.exe
PID 1732 wrote to memory of 2800	1732	470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86.exe	8gXXAxkJfXheNZ4.exe
PID 1732 wrote to memory of 2800	1732	470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86.exe	8gXXAxkJfXheNZ4.exe

C:\Users\Admin\AppData\Local\Temp\470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86.exe
"C:\Users\Admin\AppData\Local\Temp\470f150b8baca70bd720bcfeffc2f00cd998faeb3ae70c697ea94a417df9ee86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\8gXXAxkJfXheNZ4.exe
.\8gXXAxkJfXheNZ4.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1216

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\8gXXAxkJfXheNZ4.dat
Filesize
1KB

MD5
d80c913784b393f8fa4d42953cfdf0b2

SHA1
ce4eb37810b5aab08460f55681b7c41783bfb8ba

SHA256
2410d64dd70f55de45fa86709c9329b4ff5f72c82a7b04403608bdf02f7c9377

SHA512
3718aa205f4e0d4132ee4b0664fd24d36868c84742eebd7afde2b737295a31eeeca67f3217d359d2b4698c87f558b1ceea538bccc999361d8c719283b497cc79

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\8gXXAxkJfXheNZ4.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\8gXXAxkJfXheNZ4.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
2c0df8f896ecc71694ca3dce96431adb

SHA1
24d46c00ee8e2b809719f5ca3e620faf7018fe51

SHA256
0eee2c213d4e011c43e653f7fd48e2f7bbfcc0699d8fac8cb13b810b9899f2e3

SHA512
f926c06dd53bd21d132b5834d78a206e3a1d051cb44d3e0ffb3c68c4a1b8a376463839b649eab63933184552d3c414297fbd50b19af73519417a095e27cdea50

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
a094276164738f6db8ee89783df35f54

SHA1
e730744e08a2be2b116e78a5351adac0233e4017

SHA256
ed19a6af09bb42a24a224b28bbc04b0a6c5ceff8a27d209e95108c29e8fe8bd8

SHA512
ad654cfb20e650a9aa56908cf04df5119acaa5830c316755f577d6ed49eac9439bbca99e8146abf140af237302c26f70b604cdfb546ba2c537840ae44cacff25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\[email protected]\install.rdf
Filesize
598B

MD5
795972318c75f92037de5c9c8803c567

SHA1
89269b462b56d12fbf6133f23446873ce42d9f8c

SHA256
617423cc1390a36e40ad28ec6c5c862834fe07caacfad797aa4fdf2ead1735cd

SHA512
b110d364d101f981e19493683496a53ecd9b4c4cb16df55dbec4439a8b66e88a82869ef4773e842a642746302fa715b7247ab5ad7d1927e9ae37d9d3ee26d7de

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\ojdlpeiokdlobjdainokijdepkidlofo\a.js
Filesize
6KB

MD5
b289926edce0c242461c5d85b2741100

SHA1
a80207b0baa5027a889865aaa840ce3d1f16a43e

SHA256
bd3497c0d8b5e92b5a95ce625d5220e5aa04b5995c5a52e112b1c05ad2c0fb47

SHA512
077f38999fb55eb7851a7e5482620392029b639275117b718781a36fa8599c8402d4c12811b4b637e877460bf5ca7a66c28bd9434326d8db6f3d914732520414

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\ojdlpeiokdlobjdainokijdepkidlofo\background.html
Filesize
138B

MD5
fc05e1cf6a9218ea8cf1781e8fc232de

SHA1
ca9c3169f4166827737ae94b75a2123a1311b9c4

SHA256
de5c6284ee896372099ad1e4f007b3bde82e4e17e72f2bb7204354f179113da3

SHA512
619248d59150e54175230cf4febdd0aae96ee800573427144d9ed67fd632333aa27a0bc0598dc455b0b22b0768a8e7ac960833fef0e8c015b133a3a308df41af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\ojdlpeiokdlobjdainokijdepkidlofo\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\ojdlpeiokdlobjdainokijdepkidlofo\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C13.tmp\ojdlpeiokdlobjdainokijdepkidlofo\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/2800-135-0x0000000000000000-mapping.dmp

Download