Analysis

  • max time kernel
    357s
  • max time network
    361s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2023, 10:58

General

  • Target

    Chrome_update.js

  • Size

    557KB

  • MD5

    1e589efc405c7b9af2cf0204527c8dc0

  • SHA1

    5adf3277054b7698f6f6ca184905cb07ef806362

  • SHA256

    46a4c3da6ce3e37e603aa50253cec14a2b70874495c0c9b54130a7083619ecac

  • SHA512

    eb081b232c4e6c5a7a31ff5df065d536c55976c2e0763c04add765700e31dc8324f1709f41cbcab996c1d855356f895be16e318a12f5041ec65181557b7b9ee9

  • SSDEEP

    12288:SG0crv/Vrv/krv/PYXljLBYUfmTfmc4E7+TFnb:t5lGIPO32b

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Chrome_update.js
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C://ProgramData//SNAhVIwVqdiU.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\ProgramData\sett.bat"
        3⤵
          PID:752
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\ProgramData\7z.bat"
          3⤵
            PID:2372
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\ProgramData\2.bat"
            3⤵
              PID:2340
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\ProgramData\2.bat"
              3⤵
                PID:2508

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\2.bat

            Filesize

            232B

            MD5

            6011bc3aa00cc9eefa63bd07c9676678

            SHA1

            9c8fb9c006ab9787254bd6ade3194a90c24d66c9

            SHA256

            5a8a48a2be136200954f5f81de68363d5dd8c82489dacae5d6b717b598634079

            SHA512

            93869d542de437ce4514c745153284163305256f4673139a91ce9253ea329941b1fc273ccb3c0a2710e761ad41698a3f96ea0a5516ab3f436a5ead82572d36ba

          • C:\ProgramData\7z.bat

            Filesize

            239B

            MD5

            67404b0103100e3452532b69a46aa33f

            SHA1

            4bc62bfaecc1a4c5c95d906e2b64e161933f9965

            SHA256

            6f1624a63e0713b8c0f86a461e9ce955f0d7eef8d4d3cdacf0b79e3ae843f19c

            SHA512

            4c7f3e63746179413915f308dea04cf668f909a4111caa479b633587137483ff7af548e2aab7180617cc5a6363884151f546a58b0b40a7bdb7edc3024bb26989

          • C:\ProgramData\SNAhVIwVqdiU.bat

            Filesize

            9KB

            MD5

            4b2794840b114be5011da81ad4c462d8

            SHA1

            66cf9461efa6fb1e55af037515121d2a856670ac

            SHA256

            60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93

            SHA512

            28d60ca188d99af1e6338d97cbcde497f5325c1a7da132b7d8f9c29a630d93570b488db40bc3ded89fa96c04153298b6a15128f641fcb1134cfa8d933d9e8b2c

          • C:\ProgramData\sett.bat

            Filesize

            248B

            MD5

            7d1c3743cb7af1f479ef8a94c1dc44da

            SHA1

            228abfe62f4f166bb0881e273c2bd6bffb3167d4

            SHA256

            434d977609d8c580895a2b3b74f0948e2670bdeef5d06a1325c4940264b95f6c

            SHA512

            e00f310e0c09b0e78ee98e8c1efdbb2caf6cac0e5fde51536123443f54f271c0232b4521c02de5083eb18cc03d350d37a0cb1ed2da58c6a0830b5462def34276

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            d2906181003d4f831b35caacfe06df30

            SHA1

            c424f02871319159141267fec5654714dea164c2

            SHA256

            8060a25a453297eb1b5305d583c6c0361f5904c8e0d48267af0f6308b7984e61

            SHA512

            d65be167ec7febdeadc6b3bd1e59bbc76103145686d1e61155685ceeff43394690f19f9941db56544acb7ff83f75d09d78204c866f972b7f0ae0e7fd8c2434ec

          • C:\Users\Admin\AppData\Local\Temp\CabB924.tmp

            Filesize

            62KB

            MD5

            3ac860860707baaf32469fa7cc7c0192

            SHA1

            c33c2acdaba0e6fa41fd2f00f186804722477639

            SHA256

            d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

            SHA512

            d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

          • C:\Users\Admin\AppData\Local\Temp\TarB9B3.tmp

            Filesize

            164KB

            MD5

            4ff65ad929cd9a367680e0e5b1c08166

            SHA1

            c0af0d4396bd1f15c45f39d3b849ba444233b3a2

            SHA256

            c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

            SHA512

            f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27