Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 01:07

General

  • Target

    0987f8c064ae1df6179b1fea805d90a6.exe

  • Size

    319KB

  • MD5

    0987f8c064ae1df6179b1fea805d90a6

  • SHA1

    244cdc00af7a48fe0be4021e57c5efa8edfcbf06

  • SHA256

    3843f978c4fa1c2678fcc485917d4e3365f0c02b35dfe6e7f80c820d877f526e

  • SHA512

    5bd3d02c0f7954fce60d7bbd9226531ca3a249d3fb34da46d253fa5796091a4857682bb0a7f667ff7c63809b785db3dd0a3539220dcc193b539c3185205fb3e9

  • SSDEEP

    6144:91OgDPdkBAFZWjadD4sPj/9/f2BrxFk4mfH1fN1+6Psasl1S8HsOKLE6:91OgLdag/1f2BVF6tL+DHsOD6

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0987f8c064ae1df6179b1fea805d90a6.exe
    "C:\Users\Admin\AppData\Local\Temp\0987f8c064ae1df6179b1fea805d90a6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\wxDfast\uninstall.exe

    Filesize

    46KB

    MD5

    2628f4240552cc3b2ba04ee51078ae0c

    SHA1

    5b0cca662149240d1fd4354beac1338e97e334ea

    SHA256

    03c965d0bd9827a978ef4080139533573aa800c9803599c0ce91da48506ad8f6

    SHA512

    6ecfcc97126373e82f1edab47020979d7706fc2be39ca792e8f30595133cd762cd4a65a246bee9180713e40e61efa373ecfb5eb72501ee18b38f13e32e61793b

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\chrome.manifest

    Filesize

    114B

    MD5

    9019106d3128c0ae6f54f1578eccb848

    SHA1

    21ccded1bfa4a6906a767529488b98257b39a069

    SHA256

    e1452fb716c270fe3da9396dc69af25d6ed5c0a842890b984b4ef1669a7cef60

    SHA512

    68c3538715f0b089b2adba02af648efad0cd8916ccf3fb26a447b3987206ce36ec9eca3c4c35b5643c366019924efbb4ba69674eeeee301dcac2f73c13009447

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\content\indexeddb.js

    Filesize

    1KB

    MD5

    d180154787ad45e53337c0edbab1f3c4

    SHA1

    ee5555d4fa12a1dd15cb415923d287d168791fed

    SHA256

    b5dc85dd0ad25f666348e2e424b624484e6b80e06fdeab61bbc8155fa8653cdd

    SHA512

    c6be4ab8536ab52d5c606396d33cbeacee1ea7355a16d50a4df6e063c84ff4892b6b33a6f90db0a8f03593343b503746952d77fce210db9a891c3cf1e90785f4

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\content\jquery.js

    Filesize

    91KB

    MD5

    4bab8348a52d17428f684ad1ec3a427e

    SHA1

    56c912a8c8561070aee7b9808c5f3b2abec40063

    SHA256

    3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23

    SHA512

    a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\content\jsext.js

    Filesize

    6KB

    MD5

    2c373f06c4c38b26ca458b8bf713a090

    SHA1

    86cb69b259e935c8c31ccd8e028dc7db5ac7f816

    SHA256

    5900fd5ea9abef9882459b847175a9349a0d4f3cf00fac4336167ad4c49eb81c

    SHA512

    fddcaf9ac0e1d5ecd51299546c3cf8428e52513c4d40ce5c4552139d10102a454a5b1bcc0e842184be886041886b820a0f4b82422aa97429f6ecdb3c0284b695

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\content\lsdb.js

    Filesize

    1KB

    MD5

    91ac4b09428003959d6c76e086fcd8ea

    SHA1

    7a8b6e59d190ea4b58eff4d6cfbd291de7cb34bc

    SHA256

    686b292388757c1d1b9c5b0503012a762d3f20352af66c49ad1b074ca9229f94

    SHA512

    85bdd47e2bfb25d669196b675e55896cdd7713f872bcf187cf5fb6575cc0ae38b4a925bd982d38c01610617675708c2743d2e0571f4c5fa7a116c4a272892a3b

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\content\prfdb.js

    Filesize

    1KB

    MD5

    3617b4465103970ff81a1229d6aae0ee

    SHA1

    bdf7d737c22c0afb1f452b0b62fd4e966395c85f

    SHA256

    cc3fe8dd900f23ba95421115995b1c42639bc1c4eb49c5233410a7cf40065e32

    SHA512

    7af5ffc03f901e0d75e1d04ceb29257fc5674482699253f5952c929743cdea3d8515355fb49925fb8bb0322256429e643896bc3bc6431cb3c403fc1a72464991

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\content\sqlite.js

    Filesize

    1KB

    MD5

    f888ad982995d2993f2198cf965a2779

    SHA1

    7032fb551679d6d2e3c6bba5a3a5f5f5af2bc28c

    SHA256

    9237e8ffff281a12323db5b9662804278af0589544904d86e781f4678ed9c2db

    SHA512

    33b93d975c2f639f62ce4871a547d291b6a841a421a47fac90404e3a9860843b5e2cdab71e5320669eb3d467d191dcad330cdc383f328acd599354b3d3b35326

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\content\wx.xul

    Filesize

    228B

    MD5

    7a8e613355800b0b8066c1a3aae98738

    SHA1

    86c2410ce83e7b7884765acc70e0d68fb5310d06

    SHA256

    719113409ba141256b72b6ae7353f5d1cb6afa0374ea54cbccb6040de7dd3df4

    SHA512

    544db0a229dad79bdc78937708c9924a67f904f3abdb94835de7b82933c93be5cc942283948ddb80a0c1ddc3f74d7f8c8c9437907a3aeb2cedf16d8bda605eb9

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\[email protected]\install.rdf

    Filesize

    677B

    MD5

    ede69675cff37c38de4fa89ba814f94e

    SHA1

    f19c3cf7c1e46637a02a76c862284ab5c492b0d5

    SHA256

    c0eae6e84b5735e67cb05ffd5f5fd104fce282f8408df6c5f98e1ddd21140b27

    SHA512

    f5be792c92434ebff8ab258a8fb10bd61f8d979f8ebb2912c1dcc364fd9dd0fe2d05632e4bedbf5a75873a3066c32e9ff3a9cb0fa02855c57f58a9015200b64e

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\background.html

    Filesize

    5KB

    MD5

    edefced42e595f7bc78c32d69418660e

    SHA1

    ef1e348cdfb7818023dc0d702c91fe3251d8267a

    SHA256

    b10f86eeb71af806283942b6ef98d8747913dfb59d5c0b153fb4f2b0d54c02b1

    SHA512

    cefe3f2aaa58f089331b61151ae0715836b99cddedefc23b6913c51f8acea62fb89504c9257192f090977f6e47901d3e1b0735c80547f7f2572e43ae9c835ada

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\bhoclass.dll

    Filesize

    137KB

    MD5

    ac13c733379328f86568f6e514c2f7f8

    SHA1

    338901240fedcef4e3892fd4c723c89154f4de05

    SHA256

    7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562

    SHA512

    35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\content.js

    Filesize

    386B

    MD5

    7dc9098267587238fc54ff2c3d3bf050

    SHA1

    4f27c02db689c3b84c54263c1c9f4b6238c075a9

    SHA256

    169098e8d397215ded425388e12673b9ca6f0524178bf154116f8843f8aa26fe

    SHA512

    e0d958210b5c30c5b03f9e967b405e04df895ccbbb888df9fcf422889f3b48982b22d1a6ab40ca561b45a87dca9a7567bbf4945958ae9b255bed822acf55a9d9

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\dfkigbjomfcobanbbibhaiflbcpijcpb.crx

    Filesize

    24KB

    MD5

    6b6a1033e96f7170ebb28d0bd0673d02

    SHA1

    8838be72153e04f80e28eff6173acf10d905b7a2

    SHA256

    087a84edfdebbda7866e6642d6f6c2ef447df9eac2e0ba9e81bd8d3c2c495de3

    SHA512

    82c5fc8994e79ea4017283d85cda8d244c84ed05f459ac0a186a42ad84029d65cb973bdb3862662f67b4fd3484ff7d1b08403fcf9c28e181c1404b2df993da34

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\settings.ini

    Filesize

    599B

    MD5

    f3b88f2077d812b2667169490df8cf3b

    SHA1

    f2d1b1e9daf66081be8c7088265d6d8401dc4788

    SHA256

    c8c80c0f8264f9663b873e74f5aa006665ae2c7354e39a961b32055c6d525884

    SHA512

    a496c3da7c126fe5cfa1e14a1a2e23b60491a2d841fd40673ea24534e4ea75dc2027aeb2b3cf95776dac3a3b7e535e88066734fd395c97b0cbd02aa3547d780d

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\setup.exe

    Filesize

    61KB

    MD5

    201d2311011ffdf6c762fd46cdeb52ab

    SHA1

    65c474ca42a337745e288be0e21f43ceaafd5efe

    SHA256

    15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

    SHA512

    235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b