Analysis
-
max time kernel
33s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
14/06/2023, 09:54
General
-
Target
ChromeSetup.exe
-
Size
1.0MB
-
MD5
1e5db050ae657418229cc65b6c7b62fb
-
SHA1
bf66c158fe588ac39ba160ef5169560c13c380be
-
SHA256
34b740789389b6aec040caf45c0da8a5de2451b5d6002925a9cde6cba436b7e4
-
SHA512
4f6afe4228afae60cd7492f666aa0dd275700c712e4486510e90e2958b2d4f36ae8a55e68f4f329433439bdef1632ea5a69bc79f2c37c3ca4bd892f2cb60dbdd
-
SSDEEP
24576:6VyEIohMRSfw0RTQZjHKPjiqSMz9xLZ/JO5unIE:6VpMiwWTQZjHKPji/MxxcuI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GUM7521.tmp\GoogleUpdate.exe"C:\Program Files (x86)\GUM7521.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={D8589D13-0585-2631-111B-02E183065013}&lang=zh-CN&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&installdataindex=defaultbrowser"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5e1b44a75947137f4143308d566889837
SHA12bbb25793fb06e79462911a3f51c4e71ea86034e
SHA256ec7e883e7af38bf3ac0ac513cfde0186038443e9acc7ad616ee6bd0ec09aacb9
SHA5121708d045f7f447e4bc80df4758e2a4bfa5c2144d47995c769b739631e7a4b4506e4265c9b8784e6903fd065957c05c05bed293d01ac53cea19090f98eea902a5
-
Filesize
1.6MB
MD55c2593649cf4fe6b9ed6f9a734dbf344
SHA1a53363568dcb192a1148987e1cad160b9cf8f221
SHA256dbe8a6b2dac8f166e08534ebe02d23ff7648e836cfcb507a41f51368cba01bbe
SHA512b3fbca01a459223f184ca039e4aa16e921217025f5967fdff6d0d0aa54042f882d986e003c8556b04877ed14f346abd2b62bb5bd2d6de89664ff5cb62439f2bf
-
Filesize
31KB
MD549118a53f59666aa2f27af738830d767
SHA103f1554bd446fc697300dd9768c629d5b3deb272
SHA25624f51cc2b5d20296f31c04c22a9ed4b2d9eece579996209703a60083eea7fa1b
SHA512e982f38d9855fa6b8c9a4117ff3ded84b08990b997f50e2499e46061dd3df0079909cbfabb496c09b41ec6c47f89914e8967508cd4c557bf4a3a9642ddcc54a1
-
Filesize
105KB
MD5e1b44a75947137f4143308d566889837
SHA12bbb25793fb06e79462911a3f51c4e71ea86034e
SHA256ec7e883e7af38bf3ac0ac513cfde0186038443e9acc7ad616ee6bd0ec09aacb9
SHA5121708d045f7f447e4bc80df4758e2a4bfa5c2144d47995c769b739631e7a4b4506e4265c9b8784e6903fd065957c05c05bed293d01ac53cea19090f98eea902a5
-
Filesize
1.6MB
MD55c2593649cf4fe6b9ed6f9a734dbf344
SHA1a53363568dcb192a1148987e1cad160b9cf8f221
SHA256dbe8a6b2dac8f166e08534ebe02d23ff7648e836cfcb507a41f51368cba01bbe
SHA512b3fbca01a459223f184ca039e4aa16e921217025f5967fdff6d0d0aa54042f882d986e003c8556b04877ed14f346abd2b62bb5bd2d6de89664ff5cb62439f2bf
-
Filesize
31KB
MD549118a53f59666aa2f27af738830d767
SHA103f1554bd446fc697300dd9768c629d5b3deb272
SHA25624f51cc2b5d20296f31c04c22a9ed4b2d9eece579996209703a60083eea7fa1b
SHA512e982f38d9855fa6b8c9a4117ff3ded84b08990b997f50e2499e46061dd3df0079909cbfabb496c09b41ec6c47f89914e8967508cd4c557bf4a3a9642ddcc54a1
-
Filesize
31KB
MD549118a53f59666aa2f27af738830d767
SHA103f1554bd446fc697300dd9768c629d5b3deb272
SHA25624f51cc2b5d20296f31c04c22a9ed4b2d9eece579996209703a60083eea7fa1b
SHA512e982f38d9855fa6b8c9a4117ff3ded84b08990b997f50e2499e46061dd3df0079909cbfabb496c09b41ec6c47f89914e8967508cd4c557bf4a3a9642ddcc54a1
-
Filesize
4KB
-
Filesize
4KB