433429b5e3b9ca3e4586614619fe23e4c6f566abca1255649cf880243048a0aa

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

433429b5e3b9ca3e4586614619fe23e4c6f566abca1255649cf880243048a0aa.exe
Size

2.1MB
MD5

f0b2a60e7ab2fa72034ef283c1509bf1
SHA1

28b815495335106c98c969de7bb4015a7869b067
SHA256

433429b5e3b9ca3e4586614619fe23e4c6f566abca1255649cf880243048a0aa
SHA512

331084887ea5a1ec3fad8bdfaeb205dad95ef98e378925569dadc93085e5bc04f68591e195562ae2e5a76706712de9aedc2d661a2b14990a704d376e675f5a88
SSDEEP

49152:h1OsiPY2QfeuG1nqR/d9zWFUZsqI6uPUgnWGaO:h1ORlQfeuGIR1RfuPUC

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
540	PpLiaTGnYIMXaYG.exe

Loads dropped DLL 3 IoCs

pid	Process
540	PpLiaTGnYIMXaYG.exe
3236	regsvr32.exe
3508	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\200\manifest.json	PpLiaTGnYIMXaYG.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\200\manifest.json	PpLiaTGnYIMXaYG.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\200\manifest.json	PpLiaTGnYIMXaYG.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\200\manifest.json	PpLiaTGnYIMXaYG.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\200\manifest.json	PpLiaTGnYIMXaYG.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	PpLiaTGnYIMXaYG.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	PpLiaTGnYIMXaYG.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	PpLiaTGnYIMXaYG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	PpLiaTGnYIMXaYG.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.dll	PpLiaTGnYIMXaYG.exe
File created	C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.tlb	PpLiaTGnYIMXaYG.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.tlb	PpLiaTGnYIMXaYG.exe
File created	C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.dat	PpLiaTGnYIMXaYG.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.dat	PpLiaTGnYIMXaYG.exe
File created	C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.x64.dll	PpLiaTGnYIMXaYG.exe
File opened for modification	C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.x64.dll	PpLiaTGnYIMXaYG.exe
File created	C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.dll	PpLiaTGnYIMXaYG.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 540	4572	433429b5e3b9ca3e4586614619fe23e4c6f566abca1255649cf880243048a0aa.exe	76
PID 4572 wrote to memory of 540	4572	433429b5e3b9ca3e4586614619fe23e4c6f566abca1255649cf880243048a0aa.exe	76
PID 4572 wrote to memory of 540	4572	433429b5e3b9ca3e4586614619fe23e4c6f566abca1255649cf880243048a0aa.exe	76
PID 540 wrote to memory of 3236	540	PpLiaTGnYIMXaYG.exe	79
PID 540 wrote to memory of 3236	540	PpLiaTGnYIMXaYG.exe	79
PID 540 wrote to memory of 3236	540	PpLiaTGnYIMXaYG.exe	79
PID 3236 wrote to memory of 3508	3236	regsvr32.exe	80
PID 3236 wrote to memory of 3508	3236	regsvr32.exe	80

C:\Users\Admin\AppData\Local\Temp\433429b5e3b9ca3e4586614619fe23e4c6f566abca1255649cf880243048a0aa.exe
"C:\Users\Admin\AppData\Local\Temp\433429b5e3b9ca3e4586614619fe23e4c6f566abca1255649cf880243048a0aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\PpLiaTGnYIMXaYG.exe
  .\PpLiaTGnYIMXaYG.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:3508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.dat

Filesize
6KB

MD5
8bb9e9d7ef9b87288c4a579dc1cdc716

SHA1
1d9c1e9ee8f754be0b1609e5f95ed98b182ec867

SHA256
e74e7aeb6f9b1d6d11b61d60d81aec8db4c4135517964c7fdeb3225dccc57526

SHA512
8c427922aab592fa588ea4adcced4532bfb348f41c4c61f68741b2902c586a21e6ce5a40d31ddb90f679eea5db83fa2c5553c7525450252c4cc53b254fa12eff

Download Submit
C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.dll

Filesize
612KB

MD5
4e8d65edf539af96ec6861d8445573ae

SHA1
1b4554cd7c108aa09bb3aed009ac8440c0f8bb93

SHA256
f7931fcce1da10bbc25b3aff0b72a6744a7e454d9fc5d83f9c612e142eafee87

SHA512
a0ffd39e17e3e39d12d36bacebd21ac309f09b36e26b786d54e0218d6c41c01a3c3ecfe37aa7c4636f8be3c6821f21a21a3ba327d93fbddcb7adfca591838455

Download Submit
C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.x64.dll

Filesize
693KB

MD5
036a783b0d4af93086c9bef9bf1ed7d8

SHA1
58624b183fda19f285365c464914d8c342f693e5

SHA256
1cb50065e24f17a830d511888a1d857556e804ad0ad82d67953b3cbf04a406ec

SHA512
5f25cd28cad3bdd19475d2adfe7385cf177f0177010cd30d2cb03b237f011ae14b993a61466b71fa81613b51664f6b7c4ece954e78d667a17146e9aa38752062

Download Submit
C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.x64.dll

Filesize
693KB

MD5
036a783b0d4af93086c9bef9bf1ed7d8

SHA1
58624b183fda19f285365c464914d8c342f693e5

SHA256
1cb50065e24f17a830d511888a1d857556e804ad0ad82d67953b3cbf04a406ec

SHA512
5f25cd28cad3bdd19475d2adfe7385cf177f0177010cd30d2cb03b237f011ae14b993a61466b71fa81613b51664f6b7c4ece954e78d667a17146e9aa38752062

Download Submit
C:\Program Files (x86)\Browser Shop\GPq96W5JaxEGbc.x64.dll

Filesize
693KB

MD5
036a783b0d4af93086c9bef9bf1ed7d8

SHA1
58624b183fda19f285365c464914d8c342f693e5

SHA256
1cb50065e24f17a830d511888a1d857556e804ad0ad82d67953b3cbf04a406ec

SHA512
5f25cd28cad3bdd19475d2adfe7385cf177f0177010cd30d2cb03b237f011ae14b993a61466b71fa81613b51664f6b7c4ece954e78d667a17146e9aa38752062

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\GPq96W5JaxEGbc.dll

Filesize
612KB

MD5
4e8d65edf539af96ec6861d8445573ae

SHA1
1b4554cd7c108aa09bb3aed009ac8440c0f8bb93

SHA256
f7931fcce1da10bbc25b3aff0b72a6744a7e454d9fc5d83f9c612e142eafee87

SHA512
a0ffd39e17e3e39d12d36bacebd21ac309f09b36e26b786d54e0218d6c41c01a3c3ecfe37aa7c4636f8be3c6821f21a21a3ba327d93fbddcb7adfca591838455

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\GPq96W5JaxEGbc.tlb

Filesize
3KB

MD5
123d8e428b231b034495720766d9db44

SHA1
20db932b0f9fb5045ae866259d4c4c2650e519fe

SHA256
e5a0972cb89bbe9ca59f02a11f145178b7cfee9d43cd2e6729b4d4b9c1809d1f

SHA512
79444ea1e1eecf5adaef18c229516bb095898a7ceed229133a6d6e7082ce02c9e40612ca2b3474d8934f47f41077784cf252ca5832faf0b7063d8cb3c31a1afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\GPq96W5JaxEGbc.x64.dll

Filesize
693KB

MD5
036a783b0d4af93086c9bef9bf1ed7d8

SHA1
58624b183fda19f285365c464914d8c342f693e5

SHA256
1cb50065e24f17a830d511888a1d857556e804ad0ad82d67953b3cbf04a406ec

SHA512
5f25cd28cad3bdd19475d2adfe7385cf177f0177010cd30d2cb03b237f011ae14b993a61466b71fa81613b51664f6b7c4ece954e78d667a17146e9aa38752062

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\PpLiaTGnYIMXaYG.dat

Filesize
6KB

MD5
8bb9e9d7ef9b87288c4a579dc1cdc716

SHA1
1d9c1e9ee8f754be0b1609e5f95ed98b182ec867

SHA256
e74e7aeb6f9b1d6d11b61d60d81aec8db4c4135517964c7fdeb3225dccc57526

SHA512
8c427922aab592fa588ea4adcced4532bfb348f41c4c61f68741b2902c586a21e6ce5a40d31ddb90f679eea5db83fa2c5553c7525450252c4cc53b254fa12eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\PpLiaTGnYIMXaYG.exe

Filesize
634KB

MD5
af19e3488de335eb28ca3eb46566b7e1

SHA1
1ec3cdea5742b5961605cc1dea8e4d347a5d9cc1

SHA256
e59002c28df258c3a628aa28295edaf96f4235811f04aabab4bb5a42d3cd46cb

SHA512
a51581e8a6becbc27eb3d51b5ec195205d58f15f0483856f7a1afa8927dd138bea301db9253d731fc7c235b4b3acc1cbbe41b3eb04d94d2773942a76e7323247

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\PpLiaTGnYIMXaYG.exe

Filesize
634KB

MD5
af19e3488de335eb28ca3eb46566b7e1

SHA1
1ec3cdea5742b5961605cc1dea8e4d347a5d9cc1

SHA256
e59002c28df258c3a628aa28295edaf96f4235811f04aabab4bb5a42d3cd46cb

SHA512
a51581e8a6becbc27eb3d51b5ec195205d58f15f0483856f7a1afa8927dd138bea301db9253d731fc7c235b4b3acc1cbbe41b3eb04d94d2773942a76e7323247

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\background.html

Filesize
139B

MD5
f92b55baaa111e3d706de5608773d706

SHA1
8d1106c49257aa81002758c0a65534693d457ba3

SHA256
555dcb9de0b4aabd22c778ebe741e869d9c1a056aed8c6b234be8e406ef6b615

SHA512
ec8af20028ffb3d7c7c77e83b84e799ca09df3b336085550ac3b4e84718938c48224219a2ed572ace38ffd96af787691ca881f628a2a2e664d16815a3042ac7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\iF.js

Filesize
5KB

MD5
fb57e364d9948f3a0197902451dff784

SHA1
e052d0f7ce8d4e02ed771d946249b6a4a90096e9

SHA256
47ab5782ce207e5acd0ea4c24e08d7829bcce84959018241ff2b82dc69c8e422

SHA512
d456526572efa1b46222b6debd6482c5549a17e3ecaa506d3b31e71b8096b9207af9291087c5f414fa2f57e8bc96c5a2873a57c99c61c5cf16eee95ebc95a35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\bpjcmhoadnlohfbgiiflapnmjcpfbdeo\manifest.json

Filesize
504B

MD5
d532994175ac6e4e8fea2ae07edef6ff

SHA1
5646eab3cebc8b0a804103b63f08a63db784a77d

SHA256
f9a190f8cfafdeddfe9627366bcd108e42b7fa07c8d074f1570bd77489f39c4d

SHA512
ba6ddc11423c0b0d93de3e3ecb9eeebe29470723282165aa67de4329a5f9af7e390869a7cbd0834c1ff115a1ed0a274bed686b4b6630e98b268ec1f2a9a8dadb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
017d90c2b23488fa24f267ba24b01aad

SHA1
f7c78a9ae1a5f6ca12498f4fc4416b90e561cc72

SHA256
b0311e19d49b22de81b5518c0b56c13f95f2451a96b8a30d3d08b139828a446c

SHA512
b0b00cb70864ac9887be095ab7d50f2a787f9553872c7aa39788766b6a3493d6c4282114141ab446e44ab77821a9be7683207260bdcb08b0e0957417c1db857d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
cfbd373a3f0096130ef047025ad09b68

SHA1
aa9d879303f8748008b176e08b03cd52a9f06674

SHA256
4bec05a252a9ee17c3f3b94a7f99cac6fd018641af7649f2f6cac0f4f5a69cab

SHA512
37490d64c677914488d62b34e474cda902de68dc044cd727649b8cb2d98f81fab3c380d82a1034b303484ae664a67a43658ed00a4c705c1a422458ed15bdcf56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3E1.tmp\[email protected]\install.rdf

Filesize
601B

MD5
426527ffafee377004916191f35c0a3e

SHA1
610a92a6da8d7b2024ce6f427a8c9ec95b8ebecd

SHA256
43eaa67eacc769133d1e66ec04e12fac08e9118ac8cbbb4a08e3faa09f722ef5

SHA512
6ed3fe6717fb5f681b6078e75fd47680ce31de9ceedec4c1b952634a77b4a83d230fb5e64dde615b339d855ff8f2b14d7544df5a6971e63f31bd878117930186

Download Submit