e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:38

Target

e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe
Size

2.6MB
MD5

f928a5ec2974ab57bb7532ce39e889e4
SHA1

4134dd7b383c8503340949aa89629b1365b12e2c
SHA256

e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7
SHA512

83c593eb741fed50aa91c110902bbd917bf4b5b284f6f3a3997cbf48cbf8f54af375d2d58311378447510a40d4117dcde4efa6da27e35373b35106572842b3a2
SSDEEP

49152:YGiFhHID19wKHiDDfkycbKYBCpAURZIHy0hattFe1M7C9beyM8W:FKUinkrbZh+ZwvsFe1tl

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnmapinmconjmcoakpmeffiponcpicje\2.0\manifest.json	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnmapinmconjmcoakpmeffiponcpicje\2.0\manifest.json	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnmapinmconjmcoakpmeffiponcpicje\2.0\manifest.json	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1544	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe
1544	e32d2ed392f0f1de9767e0fc27b2209396309f82314c3ab0a8c2f2f45a4495c7.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1544-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1544-55-0x0000000002630000-0x00000000026D5000-memory.dmp

Filesize
660KB

Download