c3122efc19540777aa6fc1cfb2650fdb0291ebd617931c1f621f15f2ff4c5724

Analysis

max time kernel
141s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c3122efc19540777aa6fc1cfb2650fdb0291ebd617931c1f621f15f2ff4c5724.exe
Size

2.1MB
MD5

e8445f89cacd7690ca774f8da9750d9f
SHA1

3cedea1e368b2baa24d739e76c15df68dd04c587
SHA256

c3122efc19540777aa6fc1cfb2650fdb0291ebd617931c1f621f15f2ff4c5724
SHA512

ca6610bc6ce814c564dc36b39a4ebc7b02d06a0bd582ec31439024da7dd297b9d89abb6690cc26717e830a38746768445b5ec5d5c216f24cfed416b8c8d48425
SSDEEP

49152:h1OsIyuyoY0IKAVWQrQSM5eeHY1h2PlSUQ8PciP:h1OdgoP9oM5LFH

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3768	VwpqOy3TajKuH0P.exe

Loads dropped DLL 3 IoCs

pid	Process
3768	VwpqOy3TajKuH0P.exe
2840	regsvr32.exe
2280	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlpibnihkidanhmgeakjejlnogapbkkn\2.0\manifest.json	VwpqOy3TajKuH0P.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlpibnihkidanhmgeakjejlnogapbkkn\2.0\manifest.json	VwpqOy3TajKuH0P.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlpibnihkidanhmgeakjejlnogapbkkn\2.0\manifest.json	VwpqOy3TajKuH0P.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlpibnihkidanhmgeakjejlnogapbkkn\2.0\manifest.json	VwpqOy3TajKuH0P.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlpibnihkidanhmgeakjejlnogapbkkn\2.0\manifest.json	VwpqOy3TajKuH0P.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	VwpqOy3TajKuH0P.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	VwpqOy3TajKuH0P.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	VwpqOy3TajKuH0P.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	VwpqOy3TajKuH0P.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.dll	VwpqOy3TajKuH0P.exe
File opened for modification	C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.dll	VwpqOy3TajKuH0P.exe
File created	C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.tlb	VwpqOy3TajKuH0P.exe
File opened for modification	C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.tlb	VwpqOy3TajKuH0P.exe
File created	C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.dat	VwpqOy3TajKuH0P.exe
File opened for modification	C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.dat	VwpqOy3TajKuH0P.exe
File created	C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.x64.dll	VwpqOy3TajKuH0P.exe
File opened for modification	C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.x64.dll	VwpqOy3TajKuH0P.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3768	1936	c3122efc19540777aa6fc1cfb2650fdb0291ebd617931c1f621f15f2ff4c5724.exe	78
PID 1936 wrote to memory of 3768	1936	c3122efc19540777aa6fc1cfb2650fdb0291ebd617931c1f621f15f2ff4c5724.exe	78
PID 1936 wrote to memory of 3768	1936	c3122efc19540777aa6fc1cfb2650fdb0291ebd617931c1f621f15f2ff4c5724.exe	78
PID 3768 wrote to memory of 2840	3768	VwpqOy3TajKuH0P.exe	79
PID 3768 wrote to memory of 2840	3768	VwpqOy3TajKuH0P.exe	79
PID 3768 wrote to memory of 2840	3768	VwpqOy3TajKuH0P.exe	79
PID 2840 wrote to memory of 2280	2840	regsvr32.exe	80
PID 2840 wrote to memory of 2280	2840	regsvr32.exe	80

C:\Users\Admin\AppData\Local\Temp\c3122efc19540777aa6fc1cfb2650fdb0291ebd617931c1f621f15f2ff4c5724.exe
"C:\Users\Admin\AppData\Local\Temp\c3122efc19540777aa6fc1cfb2650fdb0291ebd617931c1f621f15f2ff4c5724.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\VwpqOy3TajKuH0P.exe
  .\VwpqOy3TajKuH0P.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:2280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.dat

Filesize
6KB

MD5
3d2dfbc878284b9424fbd24d1b4017d6

SHA1
f4e87a89e51135ebc322b5670d373bfa7aaa87f1

SHA256
c7a566fd0c9cb0e1befc70ab1a40ef87af03cd6318917a9fe8f1adf7c17f59b0

SHA512
983588b2fa3f05a81db1ac208bf4d30033431cb0929eefdc441ff9073ca0de94c2adc25caab42372a738c77916ea82e539c36a6b8ca20eea05e49a1867ff9391

Download Submit
C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.dll

Filesize
616KB

MD5
ac2bb9f430ee63577e2e658e576fbaa3

SHA1
661dad0abec24f1cd8400e09fd00881d9dd66b02

SHA256
59bb2ef1513927977be1a94a9e7687a92fd078ad343d481ba40edbfbe85e8812

SHA512
f0c2e9c780bcf67147a7c4803ffb292d6b2c4bf0a03f65273a86c6da85c0b5cd1d24d48726d95ed1e5c6b5662b7fcaba65b47bf1e7d906d97c263d2c92285769

Download Submit
C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.x64.dll

Filesize
698KB

MD5
48aea480f88ba159a05da8c3e1b938e5

SHA1
56cce3368fb512d03e4ed502c1ae1b4a64a54ce9

SHA256
07fd15650c7ea9d453c9a86255445d32ba18b4f74876a1f099a473ff988f7ebf

SHA512
448dfc81b3148be7031e6ebfc813c148c39a4ae86692ace9d0c98bf2605aa5b76052cc6d4f44e3103452fa26eb60a67a28dd3ce5d579e81277421cefdf9c9be5

Download Submit
C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.x64.dll

Filesize
698KB

MD5
48aea480f88ba159a05da8c3e1b938e5

SHA1
56cce3368fb512d03e4ed502c1ae1b4a64a54ce9

SHA256
07fd15650c7ea9d453c9a86255445d32ba18b4f74876a1f099a473ff988f7ebf

SHA512
448dfc81b3148be7031e6ebfc813c148c39a4ae86692ace9d0c98bf2605aa5b76052cc6d4f44e3103452fa26eb60a67a28dd3ce5d579e81277421cefdf9c9be5

Download Submit
C:\Program Files (x86)\GoSavvee\PfHxCI1JVrcYrV.x64.dll

Filesize
698KB

MD5
48aea480f88ba159a05da8c3e1b938e5

SHA1
56cce3368fb512d03e4ed502c1ae1b4a64a54ce9

SHA256
07fd15650c7ea9d453c9a86255445d32ba18b4f74876a1f099a473ff988f7ebf

SHA512
448dfc81b3148be7031e6ebfc813c148c39a4ae86692ace9d0c98bf2605aa5b76052cc6d4f44e3103452fa26eb60a67a28dd3ce5d579e81277421cefdf9c9be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\PfHxCI1JVrcYrV.dll

Filesize
616KB

MD5
ac2bb9f430ee63577e2e658e576fbaa3

SHA1
661dad0abec24f1cd8400e09fd00881d9dd66b02

SHA256
59bb2ef1513927977be1a94a9e7687a92fd078ad343d481ba40edbfbe85e8812

SHA512
f0c2e9c780bcf67147a7c4803ffb292d6b2c4bf0a03f65273a86c6da85c0b5cd1d24d48726d95ed1e5c6b5662b7fcaba65b47bf1e7d906d97c263d2c92285769

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\PfHxCI1JVrcYrV.tlb

Filesize
3KB

MD5
52acf269931e562ad7445f7a803bd5e3

SHA1
ef86bb5f96b2bba4c85a73efef5df4a08ab99031

SHA256
bc29a9426767cb54f6f11ea9d457613f858aa0d0e33137ab8ad1f53ff601d8f2

SHA512
545cc433a340e0b6ef70c92ab7854058222bb76385fb4027f1cc174a0baececb48c8e04ea83e9387d2c664505d4dd3799d41512e06c3ec5b4e32d0bf4a84668b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\PfHxCI1JVrcYrV.x64.dll

Filesize
698KB

MD5
48aea480f88ba159a05da8c3e1b938e5

SHA1
56cce3368fb512d03e4ed502c1ae1b4a64a54ce9

SHA256
07fd15650c7ea9d453c9a86255445d32ba18b4f74876a1f099a473ff988f7ebf

SHA512
448dfc81b3148be7031e6ebfc813c148c39a4ae86692ace9d0c98bf2605aa5b76052cc6d4f44e3103452fa26eb60a67a28dd3ce5d579e81277421cefdf9c9be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\VwpqOy3TajKuH0P.dat

Filesize
6KB

MD5
3d2dfbc878284b9424fbd24d1b4017d6

SHA1
f4e87a89e51135ebc322b5670d373bfa7aaa87f1

SHA256
c7a566fd0c9cb0e1befc70ab1a40ef87af03cd6318917a9fe8f1adf7c17f59b0

SHA512
983588b2fa3f05a81db1ac208bf4d30033431cb0929eefdc441ff9073ca0de94c2adc25caab42372a738c77916ea82e539c36a6b8ca20eea05e49a1867ff9391

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\VwpqOy3TajKuH0P.exe

Filesize
632KB

MD5
59ed6cd5a934e324d7ff694adb712b61

SHA1
ee41b1da1ca21a050e548b04bbf37c47f251fd10

SHA256
cb9b055b0e4049898db5c8d1df973692f7e57f57ad053fc9fec5372a294b8726

SHA512
04238927495ce1720202db05e90c1efc0c8d409e5255188fff51ee5589048d7b5c56f080fe7e5a1f45f4a7ca1c0d73fadbc34b8a268547f2f2bbd1c994ec2fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\VwpqOy3TajKuH0P.exe

Filesize
632KB

MD5
59ed6cd5a934e324d7ff694adb712b61

SHA1
ee41b1da1ca21a050e548b04bbf37c47f251fd10

SHA256
cb9b055b0e4049898db5c8d1df973692f7e57f57ad053fc9fec5372a294b8726

SHA512
04238927495ce1720202db05e90c1efc0c8d409e5255188fff51ee5589048d7b5c56f080fe7e5a1f45f4a7ca1c0d73fadbc34b8a268547f2f2bbd1c994ec2fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
86b4bb6ff8f5153a722c1133efb056b5

SHA1
7d250b8116c2d4c9a9c302f15fb70f020705bb84

SHA256
69f30f4fa4489c1615540784d2568ff14d4845c55b7b783941466a35b9ee388b

SHA512
c47d16c911a41f61275000b407a2ce9ca34fff28429a16f6fe7747a698525975f9c8ba0fab4edcec6f2b7c6590a27e70bb6f65206a89fb2e29c09d10f630963f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
22ac356879a4362c9accefa68df2bbf6

SHA1
0746cf2815cc4cbfd9f8220e1011105b3c3befa0

SHA256
cf3ea575667aea6dd82001ee0cf77bfcdd8d74b4dd1b52ca9ff69ebc081ad0d4

SHA512
c643ae2b5c7af00e9e9453925e93c22c384f18781dc70814f718f2e249c303fc95048543bca55a5edc75e07dcf388bd0dec59ecaf3348e642266b70e3589d120

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\[email protected]\install.rdf

Filesize
594B

MD5
b441237379663c4b6a277f7b9dfd7149

SHA1
bc183eadff6c553f92910107b26fda20f52e34bb

SHA256
933a7c8e5c9b987c0e12b46cdad685836b13b708d62162c4e38bb9a39ce9fc51

SHA512
563614848d799563fcf4ec32421c7a0d60d7e7f6f59576374bed78a73c57f48701c05662b56ba3ae7f1a442b6fca5f7050ce463ef8f23c5ad7873a5fb5a8065b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\jlpibnihkidanhmgeakjejlnogapbkkn\E.js

Filesize
5KB

MD5
36e04de57c7fe9012dbdf26f85ca1399

SHA1
432ce51c5c9a5fa86ea88631d5142450730ea556

SHA256
4a1588f7f4cf3563b28d705250f935639157611c9a5d0d29b81a3a0d6f1c5ffb

SHA512
a24f5fa4a87bcd907d67b37ba5819df0f03dbb65c763ed5fcdb6a3ca1e5fffc57edb0603803dc9ad420612aebbf901a4a6e820f0b429b0c3214a9d39989f0dbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\jlpibnihkidanhmgeakjejlnogapbkkn\background.html

Filesize
138B

MD5
07aa8fbef4d4aa9725bdaedfad1a2e18

SHA1
6cf622d2b094007fc35c9c7efc4fd3a4a594c1f2

SHA256
ca4f5a1c1ab80567b4357d15d67a28c9200d545e510c9a5df5d02e36f8b99c5f

SHA512
0f8c9b7b2c34cddde2d2f1b8568ec01a7558e47ebc0c1d0be34d6d1bbba05964c974718427c4eed69cbbb6e778700688d37483a394c39e82edd37fe138adef43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\jlpibnihkidanhmgeakjejlnogapbkkn\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\jlpibnihkidanhmgeakjejlnogapbkkn\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9B99.tmp\jlpibnihkidanhmgeakjejlnogapbkkn\manifest.json

Filesize
500B

MD5
503545e93824e50cb5d8e9b3d27c83a8

SHA1
a3bc3931c2c16d7e01c7b6897c2bbfae0f65d7d3

SHA256
cca93698f94ac1916eb21a9d7e5a0759dbb9cf2171bed6105ec1da477c497eab

SHA512
fa1a3b176689a94df825e3305f238b18014e27a251d1af909cd56f9f7619d6df334d259df5c86c2ab01ab27cb5a6510c28ce182266d4f895e26b47b82090eca0

Download Submit