f2be96914795277acf1e983b099f470200541e6b8073b979f4198dd0494f0cef

Analysis

max time kernel
429s
max time network
432s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HyperOTP-NFC-Programmer-Windows-v3.0.1.zip
Size

783KB
MD5

125ce1addf374b34a9f48d9927e456c1
SHA1

7171d3476c42dcf6f0ed01d70ad9c1f845088842
SHA256

f2be96914795277acf1e983b099f470200541e6b8073b979f4198dd0494f0cef
SHA512

ecc30009cf565a74eff3b6d843fe03669a70d7ed81986059b01ad6dfd0f7ddbaa7e305fd970c77ef08bc0693bd1b3888dcc27131549a77a74d69b6793d71b2bf
SSDEEP

24576:kaDlCZYr1eILdqTkn9awlgO79LIDstTBsCUA:/5sYrTNn9aqlLIwtTGCUA

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3524	HyperOTPNFCProgrammer.exe

Loads dropped DLL 1 IoCs

pid	Process
3524	HyperOTPNFCProgrammer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133246554600832572"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1556	chrome.exe
1556	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4928	7zG.exe
Token: 35	4928	7zG.exe
Token: SeSecurityPrivilege	4928	7zG.exe
Token: SeSecurityPrivilege	4928	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4928	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\HyperOTP-NFC-Programmer-Windows-v3.0.1.zip
1⤵
PID:5012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4512

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\HyperOTP-NFC-Programmer-Windows-v3.0.1\" -spe -an -ai#7zMap30276:134:7zEvent14004
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4928

C:\Users\Admin\Desktop\HyperOTP-NFC-Programmer-Windows-v3.0.1\HyperOTPNFCProgrammer.exe
"C:\Users\Admin\Desktop\HyperOTP-NFC-Programmer-Windows-v3.0.1\HyperOTPNFCProgrammer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ff867659758,0x7ff867659768,0x7ff867659778
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3212 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3344 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=4564 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4716 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4864 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5124 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=4588 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=3456 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3464 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3912 --field-trial-handle=1840,i,5011849693439200477,3622711464356230919,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
162KB

MD5
4043af37a3392a9db521ff9ab62d9608

SHA1
83828688e7a2259ed2f77345851a16122383b422

SHA256
ee076822f35390ee382cda71759a2eec8f4db2bc18e4e3acd586173c29dab321

SHA512
97a9d37ec02796cbca922559f384e1632c249d9955022578c14e046f2bfd9f84db113cf55899cfcf63fd318fbee050f483d04ae3156220ff2f0d364f989e680a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
20KB

MD5
b657ebb79bf9f2a9a07c8eb33f897dab

SHA1
4ebe66fab159b8753ea4e71265fc29020fc55b33

SHA256
b640943f4d2c3b65c1d6b7fff75ce02d341c9434f75e2fafb292b43020556a34

SHA512
1f8e026d95a3ce045fbb23d7d58255facfb315e57eccdd5d33c66875a6f8e3a813a5566cbb5084bd82be8063e2528f8fe11c50e8408f0f90a57e348a93062cc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
4788978f25fe0da8f900634320089831

SHA1
3e9814faf3220b85922df9d4c374a4b270a30232

SHA256
47733c4c37daeece7994ae0b0313a6675d090af85efd56e67b3f84df971b56e7

SHA512
b201dbc0898018d0eb74b28676a5e4a0257784007f56ee224be24275d978809d9d4c349c1d30adc3bc47b72677f68582abf487984ccb87ea169654562b4ae5dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a20c14d0ed6b3d63115a5bb06c587572

SHA1
272900340dce2f6bfe8f620d32d8098c5c5ee9ff

SHA256
f12238964b4eeea6443a74b1827c678425446fc92937f991a7beb2294040a1b7

SHA512
fb2c1eb7b2749c07e1a1127b6f9c13ca6a91524317259d2b8d931cabb62aecca0b78632e72c09c6c6d61569b800a7f7cae7ab1064882032cf796e8b8b2cd2a9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
bb29d77c3ad3c321c1416d2d3e8698c7

SHA1
8b8fc5bdb1137c7b3c5dc3b155da88476ab1971a

SHA256
9f08126e451c870d5c29b904045b3c59369e7b7d5b7e90b73f10704a6fb0a1d7

SHA512
123d15310deb7e455be202b09178d418abd55fd9ff545bc18de50e05683d5fbf9a8e85296b356e6fba18f2ee1643f2bbf368be8fe60f3cadde8d4e3d7cca643e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9732b42590b0da363d1cfafd3fd16406

SHA1
607b72b482b1efd3a4789757821faa3722e87968

SHA256
9fc390199eac50dee072b34b3ba718ea1d1236a60d91b10410f96a68ecaea883

SHA512
66c72440ee4745918d8797786a50f2f63f9478f8684bea08cd729e4638433bc93b1a4bf81a56c96d6e6bd41aecdf41b77d9c4089ee438ed130a1def9a99798af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
273287e8491fabdad3f08ae76ce9ea2a

SHA1
3549c1237a4113bf29e0b6acabf545ee7eaa9516

SHA256
9da6c28a5f176c0c8b25a36f859502c1800c01f650c2cf45641fa43b0d67a084

SHA512
3464a74036b4671727a4cfe77f687f173d418be60afaba410727bd00c36ece017c49698f44b80e0d958bbb04c755faadadda35b46c64dbc6ccbada641ec34eed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ba4f2fd7-27cc-41ce-b150-16d2841f2fff.tmp

Filesize
538B

MD5
5d0ec44cfe8533e950cd3ddc4662037d

SHA1
8d05316eb943066eff4a383b08df6de579de2be4

SHA256
6557f8803ed8cc89430b36e585603fd31021fb86afe8dd42f02b402cf25d4756

SHA512
b41017cab2915b2790865141487bf25eefb0e3f63c9e0459f673c57908bd986df94c19bf1c01edd9ff021d1249d656e452a2c02002035afab854f49f7d2644c5

Download Submit
C:\Users\Admin\Desktop\HyperOTP-NFC-Programmer-Windows-v3.0.1\HyperOTPNFCProgrammer.exe

Filesize
64KB

MD5
c49354f0e35c719689188bb0ff3d28f9

SHA1
ed31ad5daa0a91089a0097308601068362cf3b4c

SHA256
5bfc92d73899473f26391a664934f80c80f55f32ccbd151e02318d34c89efcac

SHA512
49093f1714c7ed353a5ca8a6238969e867ffa8eaa7de7b791b2011de4e2174408a07a75f9e18b34b66e1875aa3b7f22911f28c99a317c134dc1de1c0bea37709

Download Submit
C:\Users\Admin\Desktop\HyperOTP-NFC-Programmer-Windows-v3.0.1\HyperOTPNFCProgrammer.exe

Filesize
64KB

MD5
c49354f0e35c719689188bb0ff3d28f9

SHA1
ed31ad5daa0a91089a0097308601068362cf3b4c

SHA256
5bfc92d73899473f26391a664934f80c80f55f32ccbd151e02318d34c89efcac

SHA512
49093f1714c7ed353a5ca8a6238969e867ffa8eaa7de7b791b2011de4e2174408a07a75f9e18b34b66e1875aa3b7f22911f28c99a317c134dc1de1c0bea37709

Download Submit
C:\Users\Admin\Desktop\HyperOTP-NFC-Programmer-Windows-v3.0.1\NFCCardOTPApi.dll

Filesize
238KB

MD5
35e0a12903c03016353c3673066f54ab

SHA1
c08dc0fd60fd3158508f67299c21934e61779b8a

SHA256
d5016ab3ac7364d386ba65bc7ad83661a0a074e39a3e0349fcdb49e849f11c75

SHA512
d92627dfd10b3c78edbd5f8ce3bff2b46ac4167bb5cee39f9427a2440ed65076f9b8b2473ae86abf4c977146cdbd629efc0b6342d99f605497fabe301e5d248d

Download Submit
C:\Users\Admin\Desktop\HyperOTP-NFC-Programmer-Windows-v3.0.1\NFCCardOTPApi.dll

Filesize
238KB

MD5
35e0a12903c03016353c3673066f54ab

SHA1
c08dc0fd60fd3158508f67299c21934e61779b8a

SHA256
d5016ab3ac7364d386ba65bc7ad83661a0a074e39a3e0349fcdb49e849f11c75

SHA512
d92627dfd10b3c78edbd5f8ce3bff2b46ac4167bb5cee39f9427a2440ed65076f9b8b2473ae86abf4c977146cdbd629efc0b6342d99f605497fabe301e5d248d

Download Submit
memory/3524-150-0x0000000007B10000-0x0000000007B48000-memory.dmp

Filesize
224KB

Download
memory/3524-158-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3524-155-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3524-154-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3524-153-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3524-152-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3524-151-0x0000000007B00000-0x0000000007B0E000-memory.dmp

Filesize
56KB

Download
memory/3524-149-0x0000000005740000-0x0000000005748000-memory.dmp

Filesize
32KB

Download
memory/3524-148-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3524-147-0x0000000000320000-0x0000000000334000-memory.dmp

Filesize
80KB

Download