Resubmissions

13/04/2023, 12:19

230413-pg92tacf6t 7

13/04/2023, 12:18

230413-pgsgrsbc45 1

13/04/2023, 12:15

230413-pewreabc27 7

Analysis

  • max time kernel
    51s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    13/04/2023, 12:15

General

  • Target

    NOEXIT.bat

  • Size

    36B

  • MD5

    7ef39834b5770e2a06e236d685840b66

  • SHA1

    6cdc9862913270d9fccd17e8c286c5f37575cee0

  • SHA256

    920357b0150629f73caba00198bdc7635c432ac908cc327090bf4bf3f5fee0bc

  • SHA512

    f99d9f07dc029bd566774634b2f4742c93e724cc2077f1ebc80ed45bfdb094a91eadef41699ec98c0f1456d843dbd0205452c9ee2120de5a2fb1a31b5676f697

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\NOEXIT.bat"
    1⤵
      PID:924
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72c9758,0x7fef72c9768,0x7fef72c9778
        2⤵
          PID:1364
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:2
          2⤵
            PID:1532
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:8
            2⤵
              PID:452
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:8
              2⤵
                PID:1316
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:1
                2⤵
                  PID:1408
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:1
                  2⤵
                    PID:692
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1548 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:2
                    2⤵
                      PID:1236
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2268 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:1
                      2⤵
                        PID:2060
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3792 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:8
                        2⤵
                          PID:2068
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3912 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:8
                          2⤵
                            PID:2088
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=584 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:1
                            2⤵
                              PID:2532
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2412 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:1
                              2⤵
                                PID:2804
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2492 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:1
                                2⤵
                                  PID:2912
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=1312,i,5356210766455469319,706034455838475263,131072 /prefetch:8
                                  2⤵
                                    PID:2696
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:1200
                                  • C:\Windows\system32\CMD.exe
                                    "C:\Windows\system32\CMD.exe"
                                    1⤵
                                      PID:2384
                                      • C:\Windows\system32\winver.exe
                                        winver
                                        2⤵
                                          PID:2408
                                        • C:\Windows\system32\msinfo32.exe
                                          msinfo32
                                          2⤵
                                            PID:2464

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          1KB

                                          MD5

                                          3b7985e4a138e7c4757462bbe49cdc7e

                                          SHA1

                                          cdf0096405cf086d5b19ce60dfc46352c08a0632

                                          SHA256

                                          e557e49614d05c429c53f7ea6b7b64e01d6a450735afd5176862187b91276af1

                                          SHA512

                                          2cedf69b6522edb89bd822370fae4e398c908a5ab9bb4edf12566e8c4436b23d27cbd9f828d574ee0c0fe14e49a4196fb0adfb58a93209fadf7b8e52a8499e9d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                          Filesize

                                          264KB

                                          MD5

                                          f50f89a0a91564d0b8a211f8921aa7de

                                          SHA1

                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                          SHA256

                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                          SHA512

                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          1KB

                                          MD5

                                          56f826b3751e04cb48d0b3ab88068226

                                          SHA1

                                          1c83823fcd4571756266b40ea5dd200a03cb910d

                                          SHA256

                                          c755b67b8741117b391358005c56b2c914384192df1cb7977b86ed05fc7483c2

                                          SHA512

                                          90bef0e1633854824c097a52963359a57067b35a701b053d49a5ac4e85b43337017931c9b6c79a1a9b730e7f956ae02b6d6147f5e0ef01e911213964610f0303

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          1KB

                                          MD5

                                          0b21c3114a121557f338fed3d86a4e62

                                          SHA1

                                          0be6e0c7572074497086ca5a1bfab1d8633ab5c1

                                          SHA256

                                          91e79ef00dbb1123155a4ade9d46d5269b208d34ff1255af78df283cc2026d38

                                          SHA512

                                          2a359bfdce05bd87c830e4d686a5d262891e2ec9ed43128c98a6fe0bc6d58379c89c12edc1327db5a495adfafebd451d895155a73cc082adb69721ba8ddfe12d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          361B

                                          MD5

                                          76c5235000e2a77743196893fe3cb44b

                                          SHA1

                                          763a7ad2b73d84c4f2be30a1f63cd6b63916ec53

                                          SHA256

                                          ecf190a0776f210092ff4c25f34a60e50e7ac19148e0fe8cca8c09c605c47cfb

                                          SHA512

                                          a4e0e533f231e4c179429e480d31d393e9b16d65b580691758db0b84c2dc5dba07e65a11d6a5ed7e9b2bbd7653d1f7c47f0afa44724613e93ba07a9a2b453652

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          1KB

                                          MD5

                                          82a38da77d3f4e8a1f52b482b1d04142

                                          SHA1

                                          3027c248f7090957f40e5f3dbc5fd0b915d7d835

                                          SHA256

                                          01058acfb88ce70aa1dda6e496a6950a2ecc9a6cc21bacfd107b26ef2424c4b3

                                          SHA512

                                          7483663d626a2f821f811bc349b68cabff6ffe048754d16e337be6857eb8b545f60cb0e3d0dd66670da330e65a506c18f5bce966032a9197d71fcf6d7253ca79

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          4KB

                                          MD5

                                          db40f3cb9d53e672a8d766431602b52c

                                          SHA1

                                          5b2817ad7bc9f0644e03485c55f8f12c5d95e796

                                          SHA256

                                          b2183c97c794a9590859a6c99e97aa4339daf7088a55e01c6237046e50843604

                                          SHA512

                                          69bae73eea59d16ed5d69758316bbf7102392c37f53bbba36e935ad6f105c20b382989d8f32c9a01231c2692e47720afcd4b69a07ed9daa542ad995e3b972fa2

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          d7f71e4949d8b4a406ed73d7b332df9e

                                          SHA1

                                          30ac61553e5f08aa628261254b398c1190517935

                                          SHA256

                                          e89c489d0e65efd176f986b01ea216094312db1958377a34b46d42bac5aad5f6

                                          SHA512

                                          57b3b0dd277dc2a4d65096903fe9a3f42ab92c53f618d85ecc548a26ee25c586417c5972f7d286f2132333050669034cb53d752a8f79d812b9758bb215826b67

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          4KB

                                          MD5

                                          81ad4ff228b872e8e9d043620d34cbae

                                          SHA1

                                          ac90372853b9e28e85c310360481a4ab68845e7c

                                          SHA256

                                          5998df30f9378dab1dd32756212e890ca959bf13c74cea97896ac8cb2e84f176

                                          SHA512

                                          f8c2fbc1df695fc5221b8b49cd8c6454448f7005dffa142699a3534ffd370e94568de58c9687ee5baf1e6d96884312a4e08b86d6335988ece5dabd9b39bcf3a6

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e072e49f-55f4-4eaa-a495-238573fa018c.tmp

                                          Filesize

                                          4KB

                                          MD5

                                          339d67887209f04d375533735b7cde7e

                                          SHA1

                                          376d4b1aef327d6565a12130982df4318ca191ff

                                          SHA256

                                          87542154ce8c290697899369c1c0a9e047b9e3f905f353c1c9eb967ff915e735

                                          SHA512

                                          4847e81300f83c2662e63453f40cbd43cd39448079277a22409353a42b63b2b66904ef01e94ec28c98963787222255dbe93eb85eb27b6cd290db1995d07b85fa

                                        • C:\Users\Admin\Downloads\Petya.A.zip

                                          Filesize

                                          128KB

                                          MD5

                                          1559522c34054e5144fe68ee98c29e61

                                          SHA1

                                          ff80eeb6bcf4498c9ff38c252be2726e65c10c34

                                          SHA256

                                          e99651aa5c5dcf9128adc8da685f1295b959f640a173098d07018b030d529509

                                          SHA512

                                          6dab1f391ab1bea12b799fcfb56d70cfbdbde05ad350b53fcb782418495fad1c275fe1a40f9edd238473c3d532b4d87948bddd140e5912f14aff4293be6e4b4c

                                        • memory/2176-363-0x0000000000230000-0x0000000000242000-memory.dmp

                                          Filesize

                                          72KB