General

  • Target

    ChromeSetup.exe

  • Size

    1.4MB

  • Sample

    221230-t4s42abc2x

  • MD5

    5c870708d9f9518da3c6ba355636596d

  • SHA1

    f98ccad0b759070899e6ba7ff5058fc4e5319823

  • SHA256

    419c4aa887895f85c1eb1e297c16b340af1c4b954173384cff3a4ac9e7f99dcd

  • SHA512

    36577860e70041236c46f1f1ba0456b01a4892abaae9096d2aad47c1f27dd4881dd4cad1d80e463a6ac6ccfae374d9203c43ac866b60054721e087a47c9e8425

  • SSDEEP

    24576:Jw8KjKjGFygcc23L1/NVOmOSGb6E3ecS4fzrjxJh9UZXlpbPvC7xtYUrEmFlo+LT:PKjKWQc2b1FVgbjrjxPe1pbPSQm1FloS

Malware Config

Targets

    • Target

      ChromeSetup.exe

    • Size

      1.4MB

    • MD5

      5c870708d9f9518da3c6ba355636596d

    • SHA1

      f98ccad0b759070899e6ba7ff5058fc4e5319823

    • SHA256

      419c4aa887895f85c1eb1e297c16b340af1c4b954173384cff3a4ac9e7f99dcd

    • SHA512

      36577860e70041236c46f1f1ba0456b01a4892abaae9096d2aad47c1f27dd4881dd4cad1d80e463a6ac6ccfae374d9203c43ac866b60054721e087a47c9e8425

    • SSDEEP

      24576:Jw8KjKjGFygcc23L1/NVOmOSGb6E3ecS4fzrjxJh9UZXlpbPvC7xtYUrEmFlo+LT:PKjKWQc2b1FVgbjrjxPe1pbPSQm1FloS

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • Registers COM server for autorun

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks