Analysis
-
max time kernel
36s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-04-2023 00:40
Static task
static1
Behavioral task
behavioral1
Sample
Ambrosial.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Ambrosial.exe
Resource
win10v2004-20230220-en
General
-
Target
Ambrosial.exe
-
Size
15.9MB
-
MD5
596b0f4684d45de83c204967c06e48a3
-
SHA1
933dc2dc29a17a9447c944289fed4f98e0eb5e5f
-
SHA256
6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
-
SHA512
8f50098d120d32a84347a8337dee27061a6914d66b951f930d491a81a9804317318f25f80467684fd4fecea6bccc6de38b2df3ee2742a54805f2cdb4413d3830
-
SSDEEP
196608:64WxsIO2gfRMhSE8/Erd8QP+ih91qBpodTAIRq+2vBt:64WuIO2gfRMYbcr6QP391qBafC
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
Ambrosial.exedescription ioc process File created C:\Windows\Fonts\Azonix.otf Ambrosial.exe File opened for modification C:\Windows\Fonts\Azonix.otf Ambrosial.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1708 788 WerFault.exe Ambrosial.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 1564 chrome.exe 1564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe Token: SeShutdownPrivilege 1564 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe 1564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Ambrosial.exechrome.exedescription pid process target process PID 788 wrote to memory of 1708 788 Ambrosial.exe WerFault.exe PID 788 wrote to memory of 1708 788 Ambrosial.exe WerFault.exe PID 788 wrote to memory of 1708 788 Ambrosial.exe WerFault.exe PID 1564 wrote to memory of 960 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 960 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 960 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 680 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 824 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 824 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 824 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe PID 1564 wrote to memory of 1352 1564 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 788 -s 5962⤵
- Program crash
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb819758,0x7fefb819768,0x7fefb8197782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1208 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1672 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2216 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2188 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1208 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2492 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3900 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4024 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4176 --field-trial-handle=1268,i,17217906554771721553,1750636234085703832,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8a42d89e-23e6-46ca-96ea-70159fb6e6b9.tmpFilesize
173KB
MD5ad11f2a5a2d4dc86e6f721240b680927
SHA102c44ecd4bfe65a47ee7206d71a79f52a23a54da
SHA256b7dd54e4d3564ef2d1de06e8990a36c7494a8c1699c15705803c26016cff28ca
SHA5124e4bf413e278dc90790a5520fcc60b7e1d1c723dfb7ec22a35d6cb5e7acde9039780950a76464bcb89db54ecbae4bb2e473fabf4b8e05bc800e05b590e362d1f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
363B
MD57627f7bd5ca6fb0c8f7f41f04b0f7a86
SHA1fd88ff68fbbaa29ba05d69763c39dafd1f14b6fc
SHA2566a227cd7247b8d4d4322d071974800dce14c4e0e665824fa433434b470e93f02
SHA512150ee5e3b6d286ea6759718faec467d08f9a06ac50f27da2ecadff96e3f08483b245f5f47907cb46e92702d25048e156485fa8e328283347b8ff0a4fd1614c9e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD577289b734aa3447d1b2369be828c0174
SHA1d93a988edf0e6c30c0705446af62a9c9c0756ac8
SHA2563ae8ea90cdef26fc8cf434446ff7adc678bc6154fcfd55cc52d207a55d5904d8
SHA512e666f9a8b3a217136f52931dce57f2bce353270803203846e72c59d84b2c08cde739089e85a1891e924c0047678fe0c1fbc5ed0b929001cbbf23c19fc9790f75
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmpFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
173KB
MD54bd84ca30a743f04ca0dee1c92256399
SHA1f24a9dfdf10ec2406217a777fd70a36bbdf1a470
SHA256725cacddad5640d123d72d5417915bfb4897bd74e3e20b8c620870630becb86c
SHA512375a85e739bfd139d5aff6fc15a08cc1c78c52d567fd16ccb71bae584ae0dacca6641188e37fe7fb68969318a539876efaddfc7350b65bcb9734b0708f994b1c
-
C:\Windows\Fonts\Azonix.otfFilesize
11KB
MD5cdfe47b31e9184a55cf02eef1baf7240
SHA1b8825c605434d572f5277be0283d5a9b2cde59e4
SHA25651a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9
SHA512a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5
-
\??\pipe\crashpad_1564_YQCIQLLDBIIINHRXMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/788-54-0x0000000000850000-0x000000000183A000-memory.dmpFilesize
15.9MB
-
memory/788-55-0x0000000000150000-0x000000000016C000-memory.dmpFilesize
112KB
-
memory/788-56-0x0000000000570000-0x000000000058A000-memory.dmpFilesize
104KB
-
memory/788-57-0x0000000003220000-0x00000000032A0000-memory.dmpFilesize
512KB