Analysis
-
max time kernel
212s -
max time network
220s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2023 03:51
Behavioral task
behavioral1
Sample
jre-8u351-windows-x64.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
jre-8u351-windows-x64.exe
Resource
win10v2004-20230221-en
General
-
Target
jre-8u351-windows-x64.exe
-
Size
84.5MB
-
MD5
7542ec421a2f6e90751e8b64c22e0542
-
SHA1
d207d221a28ede5c2c8415f82c555989aa7068ba
-
SHA256
188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
-
SHA512
8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc
-
SSDEEP
1572864:ugyqUvFZpZDQBTgcJ5pWuqHRAOLut/+EDSSXXfDS2ZVw:ugzUnvDHq5pW1xAwutGEDxXXfGP
Malware Config
Signatures
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jds240562609.tmp\jre-8u351-windows-x64.exe BazarBackdoorVar3 C:\Users\Admin\AppData\Local\Temp\jds240562609.tmp\jre-8u351-windows-x64.exe BazarBackdoorVar3 -
Executes dropped EXE 1 IoCs
Processes:
jre-8u351-windows-x64.exepid process 4604 jre-8u351-windows-x64.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133257525529244995" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exechrome.exepid process 4048 powershell.exe 4048 powershell.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
powershell.exechrome.exedescription pid process Token: SeDebugPrivilege 4048 powershell.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
jre-8u351-windows-x64.exepid process 4604 jre-8u351-windows-x64.exe 4604 jre-8u351-windows-x64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
jre-8u351-windows-x64.exechrome.exedescription pid process target process PID 1188 wrote to memory of 4604 1188 jre-8u351-windows-x64.exe jre-8u351-windows-x64.exe PID 1188 wrote to memory of 4604 1188 jre-8u351-windows-x64.exe jre-8u351-windows-x64.exe PID 4692 wrote to memory of 2236 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 2236 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4580 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4856 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4856 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4188 4692 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jre-8u351-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\jre-8u351-windows-x64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\jds240562609.tmp\jre-8u351-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\jds240562609.tmp\jre-8u351-windows-x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4604
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb5f349758,0x7ffb5f349768,0x7ffb5f3497782⤵PID:2236
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:22⤵PID:4580
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:82⤵PID:4856
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:82⤵PID:4188
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3236 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:12⤵PID:1500
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3284 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:12⤵PID:5084
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4580 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:12⤵PID:2576
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4752 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:82⤵PID:4664
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4904 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:82⤵PID:4640
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:82⤵PID:1216
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:82⤵PID:3672
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1864,i,8780222716978203715,14788183758135403825,131072 /prefetch:82⤵PID:2468
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c510onh0.kxd.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\jds240562609.tmp\jre-8u351-windows-x64.exeFilesize
84.1MB
MD5dfcfc788d67437530a50177164db42b0
SHA12d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3
-
C:\Users\Admin\AppData\Local\Temp\jds240562609.tmp\jre-8u351-windows-x64.exeFilesize
84.1MB
MD5dfcfc788d67437530a50177164db42b0
SHA12d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
267KB
MD5d4225ad1f0bc1101dda508d0d3a570ce
SHA118e031c6b83b85e170f9777cd7d6eea38d7b0c95
SHA25637c34dedffc082acd4e812037745304bbe89a3dd0b857bb69503a945889af8df
SHA512f90605da5f930b2384ae0c1182a90887e869ee721af7f03b42a21a3d67c158faa2f408b43fdf332ff606c1315effe93fda40fa9b9b043691bc64163fc0ab3c4d
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
267KB
MD54082ecd27ef1d97f563539cad7a1458f
SHA1dcf60bb7087b97850544fba9538a6e7e2d7b2481
SHA256eeb1462eb93ac09f6fb4b9a6d691dbf8f80294f7869706715319ed529690aa16
SHA512fc2b2e70db7fcf1506c639ca9ad1b3677a4c20da2dcafa13c61ad05c03df3463c262cfbcbc3697f85bc0b253803ae05e77f88b810056469cf35f9ab6c767d632
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
285KB
MD508d5109ec366269fd42a8085be933d49
SHA11a5a434dca57a41a37b30b6f7e32b55f823c5a4d
SHA256cdf176ea70849d1945b1b6f22788f092de09010178cb511b6274d9ae7ac233ba
SHA5120473d151dfd40ba670970d457b57f18982f478cb3b86a654bf06406ac5d3acf9244a650ef2ad28b18476fa9d0bba757a49b1cede7d4c2cae53f37b2097f40252
-
\??\pipe\crashpad_4692_KFBVDCQDHXYMQRYGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4048-272-0x00000178EC930000-0x00000178EC9A6000-memory.dmpFilesize
472KB
-
memory/4048-269-0x00000178EB650000-0x00000178EB660000-memory.dmpFilesize
64KB
-
memory/4048-270-0x00000178EB650000-0x00000178EB660000-memory.dmpFilesize
64KB
-
memory/4048-271-0x00000178EC860000-0x00000178EC8A4000-memory.dmpFilesize
272KB
-
memory/4048-268-0x00000178EB5A0000-0x00000178EB5C2000-memory.dmpFilesize
136KB
-
memory/4048-274-0x00000178EB650000-0x00000178EB660000-memory.dmpFilesize
64KB
-
memory/4048-275-0x00000178EB650000-0x00000178EB660000-memory.dmpFilesize
64KB
-
memory/4048-276-0x00000178EB650000-0x00000178EB660000-memory.dmpFilesize
64KB
-
memory/4604-253-0x0000023DDC2D0000-0x0000023DDD947000-memory.dmpFilesize
22.5MB
-
memory/4604-244-0x0000023DDC2D0000-0x0000023DDD947000-memory.dmpFilesize
22.5MB