Resubmissions
10-02-2023 21:11
230210-z1n9kadc35 1Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-02-2023 21:11
Static task
static1
Behavioral task
behavioral1
Sample
javaw.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
javaw.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
javaw.exe
-
Size
223KB
-
MD5
68f55ca782ebe9bb2f932e3a3d6ffd8a
-
SHA1
0f13e8e11ce24123bacf23a8b116bc777a0ac072
-
SHA256
6e6517ee65b753af161608be59bafc72ba3f670e4c48a8eb7e30170b0f0ef80b
-
SHA512
f6cc93e8b6f9f9ca72c870f2a1711c41bcba8d7ec7cd5d1003fb96e77f7700b1627738ed83493b863424edaba6e3821818b7977252edad3481bb4404c184c76d
-
SSDEEP
6144:WogqpfnQKiMHATT2JzOvflsoLsyx9TBM2z67k//4YW:WoPpf1ikDzQFRx9T51H4x
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 900 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe 1876 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1772 1876 chrome.exe 29 PID 1876 wrote to memory of 1772 1876 chrome.exe 29 PID 1876 wrote to memory of 1772 1876 chrome.exe 29 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 1168 1876 chrome.exe 30 PID 1876 wrote to memory of 900 1876 chrome.exe 31 PID 1876 wrote to memory of 900 1876 chrome.exe 31 PID 1876 wrote to memory of 900 1876 chrome.exe 31 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32 PID 1876 wrote to memory of 1932 1876 chrome.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\javaw.exe"C:\Users\Admin\AppData\Local\Temp\javaw.exe"1⤵PID:836
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefac84f50,0x7fefac84f60,0x7fefac84f702⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1136 /prefetch:22⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1376 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1728 /prefetch:82⤵PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:12⤵PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:12⤵PID:680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3300 /prefetch:22⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3552 /prefetch:82⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3644 /prefetch:82⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 /prefetch:82⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,7605675953209480454,16766863703192355283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1564 /prefetch:82⤵PID:2284
-