Analysis
-
max time kernel
153s -
max time network
213s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:35
Static task
static1
Behavioral task
behavioral1
Sample
95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe
Resource
win10v2004-20221111-en
General
-
Target
95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe
-
Size
663KB
-
MD5
bcb844e1cb9f61ffdb26c3776c4627c6
-
SHA1
979aaea528ca96e71edcfde5a1172156ba401a2d
-
SHA256
95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f
-
SHA512
38e36d7062e6e4480c0380dd5f39045091b860b24c2d4b32fa3c2ac5d3b8c024eb4f0109cd0daf4631d46ddb9073faa8eee2af161bbfaf0ff0ff7431d4c5d4d9
-
SSDEEP
12288:qNIQAPGsAqY9IMVYd38sJdpQHlGlY8KfTHb/l9TXQCb:XPGSY91VwNJcFMqTHbdVXlb
Malware Config
Signatures
-
Processes:
Chromium.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Chromium.exe -
Executes dropped EXE 1 IoCs
Processes:
Chromium.exepid process 1004 Chromium.exe -
Loads dropped DLL 1 IoCs
Processes:
95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exepid process 1152 95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Chromium.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run Chromium.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chromium = "\"C:\\Users\\Admin\\AppData\\Roaming\\Chromium.exe\"" Chromium.exe -
Processes:
Chromium.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Chromium.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
Chromium.exepid process 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe 1004 Chromium.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exeChromium.exepid process 1152 95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe 1152 95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe 1004 Chromium.exe 1004 Chromium.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exedescription pid process target process PID 1152 wrote to memory of 1004 1152 95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe Chromium.exe PID 1152 wrote to memory of 1004 1152 95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe Chromium.exe PID 1152 wrote to memory of 1004 1152 95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe Chromium.exe PID 1152 wrote to memory of 1004 1152 95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe Chromium.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
Chromium.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Chromium.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Chromium.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe"C:\Users\Admin\AppData\Local\Temp\95a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Chromium.exeC:\Users\Admin\AppData\Roaming\Chromium.exe2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Chromium.exeFilesize
663KB
MD5bcb844e1cb9f61ffdb26c3776c4627c6
SHA1979aaea528ca96e71edcfde5a1172156ba401a2d
SHA25695a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f
SHA51238e36d7062e6e4480c0380dd5f39045091b860b24c2d4b32fa3c2ac5d3b8c024eb4f0109cd0daf4631d46ddb9073faa8eee2af161bbfaf0ff0ff7431d4c5d4d9
-
C:\Users\Admin\AppData\Roaming\Chromium.exeFilesize
663KB
MD5bcb844e1cb9f61ffdb26c3776c4627c6
SHA1979aaea528ca96e71edcfde5a1172156ba401a2d
SHA25695a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f
SHA51238e36d7062e6e4480c0380dd5f39045091b860b24c2d4b32fa3c2ac5d3b8c024eb4f0109cd0daf4631d46ddb9073faa8eee2af161bbfaf0ff0ff7431d4c5d4d9
-
\Users\Admin\AppData\Roaming\Chromium.exeFilesize
663KB
MD5bcb844e1cb9f61ffdb26c3776c4627c6
SHA1979aaea528ca96e71edcfde5a1172156ba401a2d
SHA25695a7ad84f7123ae9763fab872bedfe3664fdf55c8b394a09605ee08a4e32f25f
SHA51238e36d7062e6e4480c0380dd5f39045091b860b24c2d4b32fa3c2ac5d3b8c024eb4f0109cd0daf4631d46ddb9073faa8eee2af161bbfaf0ff0ff7431d4c5d4d9
-
memory/1004-56-0x0000000000000000-mapping.dmp
-
memory/1152-54-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB