89bc05a18db73de6b19390bc0ef32711e4e357ebb89a9aa915c5d2d15da3a33c

Analysis

max time kernel
143s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.9MB
Sample221102-zd5m2abfc7
SHA256 89bc05a18db73de6b19390bc0ef32711e4e357ebb89a9aa915c5d2d15da3a33c
MD5 99fa3cf292e4c3534951b6ebd96a6802
SHA1 0d413e37db1be727beda18a33295c5105987f4bf
SHA512 b7382fe0cea6b2f22c224d8951c83aac703de50dca7d4fd03c802cc76652a9f3eccb0eee7684be39d743daa420d2176ea6e91c5dd5de852ff73fae26df859eda
SSDEEP 98304:8yj8MwA8xw0RziBr7PNQoPojPbiPB/Nxt/QTt9KrrY7Pj3UV7B9IzHRYO4yxhN0L:B80f9Pp+D6Twgr9Vt98d4yxj+xMtE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1260	netsh.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1604-57-0x00000000001F0000-0x0000000000967000-memory.dmp	upx
behavioral1/memory/1604-62-0x00000000001F0000-0x0000000000967000-memory.dmp	upx

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
364	chrome.exe
1768	chrome.exe
1768	chrome.exe
2396	chrome.exe
2388	chrome.exe
2796	chrome.exe
1768	chrome.exe
1768	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1768	chrome.exe
1768	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1352	1604	file.exe	27
PID 1604 wrote to memory of 1352	1604	file.exe	27
PID 1604 wrote to memory of 1352	1604	file.exe	27
PID 1352 wrote to memory of 1260	1352	cmd.exe	29
PID 1352 wrote to memory of 1260	1352	cmd.exe	29
PID 1352 wrote to memory of 1260	1352	cmd.exe	29
PID 1604 wrote to memory of 1768	1604	file.exe	30
PID 1604 wrote to memory of 1768	1604	file.exe	30
PID 1604 wrote to memory of 1768	1604	file.exe	30
PID 1768 wrote to memory of 1204	1768	chrome.exe	31
PID 1768 wrote to memory of 1204	1768	chrome.exe	31
PID 1768 wrote to memory of 1204	1768	chrome.exe	31
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 1716	1768	chrome.exe	32
PID 1768 wrote to memory of 364	1768	chrome.exe	33
PID 1768 wrote to memory of 364	1768	chrome.exe	33
PID 1768 wrote to memory of 364	1768	chrome.exe	33
PID 1768 wrote to memory of 1308	1768	chrome.exe	34
PID 1768 wrote to memory of 1308	1768	chrome.exe	34
PID 1768 wrote to memory of 1308	1768	chrome.exe	34
PID 1768 wrote to memory of 1308	1768	chrome.exe	34
PID 1768 wrote to memory of 1308	1768	chrome.exe	34
PID 1768 wrote to memory of 1308	1768	chrome.exe	34
PID 1768 wrote to memory of 1308	1768	chrome.exe	34
PID 1768 wrote to memory of 1308	1768	chrome.exe	34

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\system32\cmd.exe
  cmd.exe /c "NetSh Advfirewall set allprofiles state off"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\system32\netsh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://example.com --load-extension=C:\Users\Admin\AppData\Local\extenttfxt --user-data-dir=C:\Users\Admin\AppData\Local\usrdat-HBmVr --no-first-run=true --disable-default-apps --no-default-browser-check=true
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\usrdat-HBmVr /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\usrdat-HBmVr\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\usrdat-HBmVr --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd4,0xd8,0x9c,0xe0,0x7fef6574f50,0x7fef6574f60,0x7fef6574f70
    3⤵
    PID:1204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:2
    3⤵
    PID:1716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --mojo-platform-channel-handle=1332 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --mojo-platform-channel-handle=1648 /prefetch:8
    3⤵
    PID:1308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
    3⤵
    PID:1148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2368 /prefetch:1
    3⤵
    PID:720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2376 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2384 /prefetch:1
    3⤵
    PID:332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:1
    3⤵
    PID:1376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5064 /prefetch:2
    3⤵
    PID:2312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --mojo-platform-channel-handle=1476 /prefetch:8
    3⤵
    PID:2580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --mojo-platform-channel-handle=3572 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
    3⤵
    PID:2876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=824,4210032351500179429,4119787719167956061,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-HBmVr" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=828 /prefetch:1
    3⤵
    PID:2948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.js

Path C:\Users\Admin\AppData\Local\extenttfxt\background.js
Size 1KB
SHA256 878fcdbf34efb1eafb843fdcd9ed140ea3f617adffb8ff505eea96c28a9f4db9
MD5 74a9c69d4ce48d0438b60ba62b4a2c35
SHA1 a84a79817410233cff8d44058eb9e77adce344fd
SHA512 c49d70f0c0f244dcfad342bf4a70cbd2b01d4045ff5bc7ec3265f9958b04dad6855be7489e745c25efdad6667d1d860a0fa4d6cadc3b9588ed3bd9419b1fed25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\extenttfxt\manifest.json
Size 231B
SHA256 c05ec956376eb913f7b7ed3f3cdfb27704422a535000462ad0cb1ca0fc70aa6f
MD5 cef055c7efb02b871df01aa4702ca772
SHA1 861e2fef078ea737ded75b4da6f5714a132f95d5
SHA512 0948c6e882a406ef643614ecc74489b7964854f53d5b614ef175c69c1d23634f9c6113c3027654746b223c83145f9fde81729bc62038149271d4025a29ee7a13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\usrdat-HBmVr\Crashpad\settings.dat
Size 40B
SHA256 94cf35416af745cf3e80df25dd0a0167fa7c64f20aa66c18308ee96471220183
MD5 dd85353438c44d20999477e08d3bac9a
SHA1 440c2f33c08bd3118df6b837312a07699703975b
SHA512 ac318d47800425b4ae5fbf7cdaf041ceebcf7818df85870e27a80f390ac83d7c505e94062ce5f380bb94aeb9a5dc1393fad69b4722ccd1d14aaeb9d3beeeb716
MD5 SHA1 SHA512

Submit Download

memory/1260-56-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Download

memory/1604-57-0x00000000001F0000-0x0000000000967000-memory.dmp

Download

memory/1604-62-0x00000000001F0000-0x0000000000967000-memory.dmp

Download