Resubmissions
06-03-2023 14:33
230306-rw9qpscg76 1006-03-2023 14:32
230306-rwm7pscg72 106-03-2023 14:24
230306-rq2g5scg48 10Analysis
-
max time kernel
6s -
max time network
15s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
06-03-2023 14:32
Static task
static1
Behavioral task
behavioral1
Sample
windows.exe
Resource
win10-20230220-en
General
-
Target
windows.exe
-
Size
9.8MB
-
MD5
f8ceee79a7b323a7683a46f1c7636ad3
-
SHA1
8fe53a9600d1eb1e6789989d214480fa21711f31
-
SHA256
cbe35fed4367bc69d7ad61ab2e25c455501633f4adc8a8b864724d02f82804c2
-
SHA512
495d701de6372de2995ad6ae1e482d63d4197dcf8ab7f3b918ef73a42560bb88ce4dee0e36a99358f8b375baa9a6693f12eb3b12fdc84182c0a4f5049f247f20
-
SSDEEP
98304:AnNBW0h2GJfzIyepDL+LuMYBV+NBWzUNrQqMqS82ABqYBYCq6/4N5FZ7w8av8pD8:iW0SLw8BDoVn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
chrome.exedescription pid process target process PID 4220 wrote to memory of 1080 4220 chrome.exe chrome.exe PID 4220 wrote to memory of 1080 4220 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"1⤵PID:4208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd35549758,0x7ffd35549768,0x7ffd355497782⤵PID:1080
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1788,i,13472674490940526597,11712298863380200532,131072 /prefetch:22⤵PID:4168
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1684 --field-trial-handle=1788,i,13472674490940526597,11712298863380200532,131072 /prefetch:82⤵PID:2452
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1788,i,13472674490940526597,11712298863380200532,131072 /prefetch:82⤵PID:4712
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1788,i,13472674490940526597,11712298863380200532,131072 /prefetch:12⤵PID:4648
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1788,i,13472674490940526597,11712298863380200532,131072 /prefetch:12⤵PID:2944
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1012
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\crashpad_4220_QQYJCVTATIWTSMYYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4168-132-0x00007FFD3F4B0000-0x00007FFD3F4B1000-memory.dmpFilesize
4KB
-
memory/4208-126-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/4208-160-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB