Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2023, 05:45

General

  • Target

    Chrome_update.js

  • Size

    548KB

  • MD5

    de577b14a91163a413aa0cff3b8bc805

  • SHA1

    ff303a738937fbe068f11f592ebc9d8ba77d2c8c

  • SHA256

    680135cc234cc387ff529ac500fe4eac5b648ed1c9e1c694b4d697106e79bdfe

  • SHA512

    73fd0b87d8989a619357794a7274ce4a91274e8a3ac76b9b7e25dfcf7b3d480bae40dd77b088dbad2e39c87e801ebc1afd2ad5c8972a9c5cf82f16f76ad53940

  • SSDEEP

    12288:Dy9iK9ic9i49i49ie9i1pYs1CB7uM6vJBtBaB3BhBGB3b:DyvJNNJGpYq9vJBV

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Chrome_update.js
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C://ProgramData//pFSeiWofHgUbpCQepaDtC.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2472
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\ProgramData\sett.bat"
        3⤵
          PID:676
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\ProgramData\7z.bat"
          3⤵
            PID:472
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\ProgramData\2.bat"
            3⤵
              PID:680
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\ProgramData\2.bat"
              3⤵
                PID:1108

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\2.bat

            Filesize

            232B

            MD5

            6011bc3aa00cc9eefa63bd07c9676678

            SHA1

            9c8fb9c006ab9787254bd6ade3194a90c24d66c9

            SHA256

            5a8a48a2be136200954f5f81de68363d5dd8c82489dacae5d6b717b598634079

            SHA512

            93869d542de437ce4514c745153284163305256f4673139a91ce9253ea329941b1fc273ccb3c0a2710e761ad41698a3f96ea0a5516ab3f436a5ead82572d36ba

          • C:\ProgramData\7z.bat

            Filesize

            239B

            MD5

            67404b0103100e3452532b69a46aa33f

            SHA1

            4bc62bfaecc1a4c5c95d906e2b64e161933f9965

            SHA256

            6f1624a63e0713b8c0f86a461e9ce955f0d7eef8d4d3cdacf0b79e3ae843f19c

            SHA512

            4c7f3e63746179413915f308dea04cf668f909a4111caa479b633587137483ff7af548e2aab7180617cc5a6363884151f546a58b0b40a7bdb7edc3024bb26989

          • C:\ProgramData\pFSeiWofHgUbpCQepaDtC.bat

            Filesize

            9KB

            MD5

            4b2794840b114be5011da81ad4c462d8

            SHA1

            66cf9461efa6fb1e55af037515121d2a856670ac

            SHA256

            60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93

            SHA512

            28d60ca188d99af1e6338d97cbcde497f5325c1a7da132b7d8f9c29a630d93570b488db40bc3ded89fa96c04153298b6a15128f641fcb1134cfa8d933d9e8b2c

          • C:\ProgramData\sett.bat

            Filesize

            248B

            MD5

            7d1c3743cb7af1f479ef8a94c1dc44da

            SHA1

            228abfe62f4f166bb0881e273c2bd6bffb3167d4

            SHA256

            434d977609d8c580895a2b3b74f0948e2670bdeef5d06a1325c4940264b95f6c

            SHA512

            e00f310e0c09b0e78ee98e8c1efdbb2caf6cac0e5fde51536123443f54f271c0232b4521c02de5083eb18cc03d350d37a0cb1ed2da58c6a0830b5462def34276

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            aa1c5c22aeaa691027acfbcaa55a591a

            SHA1

            7645d95e52b2216930ee08be3960140a29e1acb3

            SHA256

            840b7e4294001e5f0abd2abb287630f69965f73a204e1d7c6afbb5c25bccf646

            SHA512

            d366bbabda8b7400742c8893a3a14be0f1aa0508fe020cea986802fb95993ca76002f4bdda549456ebc87d384badf18ca278f1b5cbce0ed343eca826aa113c4b

          • C:\Users\Admin\AppData\Local\Temp\Cab786D.tmp

            Filesize

            62KB

            MD5

            3ac860860707baaf32469fa7cc7c0192

            SHA1

            c33c2acdaba0e6fa41fd2f00f186804722477639

            SHA256

            d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

            SHA512

            d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

          • C:\Users\Admin\AppData\Local\Temp\Tar78DD.tmp

            Filesize

            164KB

            MD5

            4ff65ad929cd9a367680e0e5b1c08166

            SHA1

            c0af0d4396bd1f15c45f39d3b849ba444233b3a2

            SHA256

            c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

            SHA512

            f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27