34ba222ef969f09ecca5506cbada7c346469a96a6af0cdd21146d4435196deda

Target

zxcvb.exe
Size

40KB
MD5

0a7b32e75a01764ef5389a1d9e72ed63
SHA1

871366f3573c3349e9dc7b67fef1ef575815c154
SHA256

34ba222ef969f09ecca5506cbada7c346469a96a6af0cdd21146d4435196deda
SHA512

f19a7d56a825b59d2841a4f10db940458d3255239e15bb9bbe1376e1fc47d4c97aef09d4e7ecd5a3a35fca44ec92edf60edd4a07ef1845d679c3bd4fc8fe43ba

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	836	WerFault.exe	26

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1808	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1736	chrome.exe
1740	chrome.exe
1740	chrome.exe
2280	chrome.exe
2272	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1072	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	taskmgr.exe
Token: SeDebugPrivilege	836	zxcvb.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1072	taskmgr.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1700	836	zxcvb.exe	27
PID 836 wrote to memory of 1700	836	zxcvb.exe	27
PID 836 wrote to memory of 1700	836	zxcvb.exe	27
PID 836 wrote to memory of 1700	836	zxcvb.exe	27
PID 1700 wrote to memory of 1808	1700	cmd.exe	29
PID 1700 wrote to memory of 1808	1700	cmd.exe	29
PID 1700 wrote to memory of 1808	1700	cmd.exe	29
PID 1700 wrote to memory of 1808	1700	cmd.exe	29
PID 1740 wrote to memory of 936	1740	chrome.exe	33
PID 1740 wrote to memory of 936	1740	chrome.exe	33
PID 1740 wrote to memory of 936	1740	chrome.exe	33
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1496	1740	chrome.exe	34
PID 1740 wrote to memory of 1736	1740	chrome.exe	35
PID 1740 wrote to memory of 1736	1740	chrome.exe	35
PID 1740 wrote to memory of 1736	1740	chrome.exe	35
PID 1740 wrote to memory of 548	1740	chrome.exe	36
PID 1740 wrote to memory of 548	1740	chrome.exe	36
PID 1740 wrote to memory of 548	1740	chrome.exe	36
PID 1740 wrote to memory of 548	1740	chrome.exe	36
PID 1740 wrote to memory of 548	1740	chrome.exe	36
PID 1740 wrote to memory of 548	1740	chrome.exe	36
PID 1740 wrote to memory of 548	1740	chrome.exe	36
PID 1740 wrote to memory of 548	1740	chrome.exe	36
PID 1740 wrote to memory of 548	1740	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
"C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 20
    3⤵
    - Delays execution with timeout.exe
    PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 1244
  2⤵
  - Program crash
  PID:856

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6b94f50,0x7fef6b94f60,0x7fef6b94f70
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1844 /prefetch:8
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1448 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3288 /prefetch:2
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1920 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3828 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=908 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3204 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1708 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1492 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3613176778642204578,2616571119952800138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1904 /prefetch:8
  2⤵
  PID:3000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-54-0x0000000001190000-0x00000000011A0000-memory.dmp

Filesize
64KB

Download
memory/836-55-0x0000000075381000-0x0000000075383000-memory.dmp

Filesize
8KB

Download
memory/1072-58-0x000007FEFBFA1000-0x000007FEFBFA3000-memory.dmp

Filesize
8KB

Download
memory/1072-59-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1072-60-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download