Analysis Overview
SHA256
dafacda4cfc0db8960891b2386b9cda1c0f521daddc8b6b8cca73fcbf12eae1b
Threat Level: Known bad
The file ChromiumUpdater_conex.zip was found to be: Known bad.
Malicious Activity Summary
Aurora
Checks BIOS information in registry
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-02-21 20:05
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-02-21 20:04
Reported
2023-02-21 20:08
Platform
win7-20230220-en
Max time kernel
143s
Max time network
150s
Command Line
Signatures
Aurora
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe"
Network
| Country | Destination | Domain | Proto |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp |
Files
memory/824-54-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-55-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-56-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-57-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-58-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-59-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-60-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-61-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-62-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-63-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-64-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-65-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-66-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-67-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-68-0x0000000001150000-0x0000000001A62000-memory.dmp
memory/824-69-0x0000000001150000-0x0000000001A62000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-02-21 20:04
Reported
2023-02-21 20:08
Platform
win10v2004-20230220-en
Max time kernel
153s
Max time network
160s
Command Line
Signatures
Aurora
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 42.220.44.20.in-addr.arpa | udp |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| IE | 13.69.239.72:443 | tcp | |
| US | 8.8.8.8:53 | 63.13.109.52.in-addr.arpa | udp |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| NL | 173.223.113.164:443 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp | |
| FI | 77.91.124.12:8081 | tcp |
Files
memory/4980-133-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-134-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-135-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-136-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-137-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-138-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-139-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-140-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-141-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-142-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-143-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-144-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-145-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-146-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-147-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-148-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-149-0x0000000000A90000-0x00000000013A2000-memory.dmp