100ec1132f410687d07afd3451bb40886a9f9935753694367972ee0a5ab32f5e

Resubmissions

20/05/2023, 23:14

230520-28ca3shg3z 3

20/05/2023, 23:09

230520-2492jsfa99 6

Analysis

max time kernel
138s
max time network
44s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MaritasBeta.exe
Size

53.7MB
MD5

f70233c9569d89568db1d85daad48704
SHA1

cf2e57456393b099c12410a41a684ad28469e1b1
SHA256

60514e03558e18cba000e619343ef0637452546bbfa2bb17870017875dc8e53e
SHA512

7e8ffeb8ddbca63cf03be4b366ebb410b228f269009bb6ca860e98b0998f48c45f76dfaac4dff94307fc1b4582e5d2c2f016a3834653e4ecfeb1ee6f645239bb
SSDEEP

393216:iGtlSkEbhX2H3hImWGeZKSfeU1RhU3eKEL6Xu5eR3mXu2z2IecUtA7z7uRqB5SxA:iX8r2z/SyKBQs3E2gHx6IVswnbOo52eh

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
280	chrome.exe
280	chrome.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe
Token: SeShutdownPrivilege	280	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe
280	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 108	280	chrome.exe	29
PID 280 wrote to memory of 108	280	chrome.exe	29
PID 280 wrote to memory of 108	280	chrome.exe	29
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 1532	280	chrome.exe	31
PID 280 wrote to memory of 780	280	chrome.exe	32
PID 280 wrote to memory of 780	280	chrome.exe	32
PID 280 wrote to memory of 780	280	chrome.exe	32
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33
PID 280 wrote to memory of 1528	280	chrome.exe	33

C:\Users\Admin\AppData\Local\Temp\MaritasBeta.exe
"C:\Users\Admin\AppData\Local\Temp\MaritasBeta.exe"
1⤵
PID:1216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb679758,0x7fefb679768,0x7fefb679778
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2228 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2196 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1296 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1416 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3756 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3816 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4024 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3772 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3916 --field-trial-handle=1280,i,2264600919659028117,14568873765939036619,131072 /prefetch:1
  2⤵
  PID:2292

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1656

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
3a51bf082bc52649e61a1aa8afc3a91a

SHA1
c150b01261120033ea25157cdcf9df07033d51e2

SHA256
0dcb081ee8a44c7762d77829226a3e79cf7157c9a2618433dc90981a6ec35f3e

SHA512
b22d8d5921914479e3dacb09ae89ca29c191b3e2edd5632d4dfeac45185a56a6919f7e3e83c780d3d7e35e463a48a0369bf3082d8953506b253e20a5640578f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
151KB

MD5
6e302f1a0c3bfd20988d367f7846740b

SHA1
e1af9099e2160f8c83d476a7044f9cf6cbe69de5

SHA256
2f8336a86263f4e92b684999fd11c1a45b3dbf4a4f671369297bbd5fd8dbf7fb

SHA512
c120f290aa80e2fbd8e91d2f4df56f76b9a673c283bbf1a7ce7f5786da632f2f34bef34ab3adda38194af69601084a55ea75c8e08e93cd6d7dbb257195fec2e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bfcc66d0-e3f7-4c8d-9e03-da3a511fec5e.tmp

Filesize
151KB

MD5
0e6014e729895498e26a770dd3d31933

SHA1
72497b39da15cffd25481bb0dc77c631b3c052af

SHA256
93d7babbfb919ed7bafdae2b5d5bb496195ea0d955316ce30ccd2362104eba29

SHA512
83a24d6173c28a55687eb269862689059afcc9dc723b5dcbc067b7c126eb8b020d5be808072b26cd3bfad52e9be1df40fec140a635e8a5ad454f6433867612bf

Download Submit