b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 19:40

Target

b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe
Size

3.0MB
MD5

2d35dbffb6491784d189c5830f0eb480
SHA1

59e6e41377f18986827d9763e536da89d343411b
SHA256

b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc
SHA512

518ed4f849e4abe36b4d2716053f5d2a700421d01240fedcb5b3d565a8a0d25ad884376f1514212b2b2e37624496a444a569ed3683b409c46929f7cd06d1dc2c
SSDEEP

49152:t8aqv29TU21ex0dQqrSYVsL/7vGQhSqoZNecKY/P2eyM7K:t8vKUWddSZ79Ib24

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbcphcakcnlnlfkadngpkbnfgopnjapc\2.0\manifest.json	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbcphcakcnlnlfkadngpkbnfgopnjapc\2.0\manifest.json	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbcphcakcnlnlfkadngpkbnfgopnjapc\2.0\manifest.json	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbcphcakcnlnlfkadngpkbnfgopnjapc\2.0\manifest.json	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbcphcakcnlnlfkadngpkbnfgopnjapc\2.0\manifest.json	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	b5261454a2b861958d079c10e0bf1c086f28cb65cf2f1916782419576a2973bc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4916

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/4856-132-0x0000000002BB0000-0x0000000002C52000-memory.dmp

Filesize
648KB

Download