885c5f1c8ddc46424971c0e128f8287ec7f7c0effeab7e848d2ef56a1dc8b8af

Analysis

max time kernel
57s
max time network
272s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
04/08/2023, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x4b4ier.js
Size

1.7MB
MD5

ab01b574d043fee15b3fc37aa7da09b7
SHA1

df20c798b6d3faf2feb769fea68ae32507989320
SHA256

885c5f1c8ddc46424971c0e128f8287ec7f7c0effeab7e848d2ef56a1dc8b8af
SHA512

77ceea2e77586c69ae42b0ea246bd8023d4df6d03ec3c8201cfbb4b6aec95ac72c04b88ceb5916a11386935e0a082977925b0fb5d011ece6d70acc7325dc37ea
SSDEEP

24576:1oBtBRwdH5U2XVFuX9Ty29FjrVa82JSFDu/0PTGxDvbISH/gorRJ5hJzIE3EoUcd:YvxF3WcTcQCxzUzQ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2816	chrome.exe
2816	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe
Token: SeShutdownPrivilege	2816	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe
2816	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2444	2816	chrome.exe	29
PID 2816 wrote to memory of 2444	2816	chrome.exe	29
PID 2816 wrote to memory of 2444	2816	chrome.exe	29
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 1632	2816	chrome.exe	33
PID 2816 wrote to memory of 2312	2816	chrome.exe	34
PID 2816 wrote to memory of 2312	2816	chrome.exe	34
PID 2816 wrote to memory of 2312	2816	chrome.exe	34
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35
PID 2816 wrote to memory of 1460	2816	chrome.exe	35

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\x4b4ier.js
1⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6909758,0x7fef6909768,0x7fef6909778
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:2
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3328 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:8
  2⤵
  PID:284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3380 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:2
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3048 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3416 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3500 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3620 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1232,i,6180352253568358192,7279414812995118175,131072 /prefetch:8
  2⤵
  PID:1580

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1640

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
c09f7068d8df3093ef47115eef609053

SHA1
c73028ec6fc32a7f5e760b003b6df2e32c9c1d19

SHA256
94853e8adbc7e2e3f98d0d07041a7c809f961573bfe7f3fbe47ad00fe12e8b76

SHA512
927a2b94d7b6d53aadbca08e74e34e979826c9d18fae14aa2cf21bdfda7cef9b4f3acf243bb5a460bf01e723d311d58782231cbc1a7840e52a42d93373d90b76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
58ef502e3edce1da9a34adfcf84d904d

SHA1
46efcf890819c03e3f052980528f64e677ed1c1a

SHA256
468067846586b3569e1f790b4b2ee596c0a3bdfb618059dd0d0a0be6453429c5

SHA512
d636228ece2d21f506e4c0da9ccbbf6c623c0d3051d0d4bd4e2b9912fdda4579d01b34e97eb7bc4534419dfca542d306c4577b6c4bf075e92c18355c556f134a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
ac3e6295a00dc4c6de19f8ed496e64a1

SHA1
45d24d05912584082aa33ed2bc4be800d5de3bf9

SHA256
1df7831dbbf92e4e69903f2bcbd811183eaaca5e7e0e3c2a49aafe0110f31082

SHA512
8fd6377861619f0fc15792b0a41262ddfb0f8d178f87cef2a9d555ef4e09d0dd09660f42a54a867f372fd6d365e10274cfb320d062fbcf5f39acd73da70d1240

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
f3031196902356449647bea31aeb1291

SHA1
60a5ec3ec2632bf601e8bae8808f6955ae4cbf30

SHA256
94d18b6874d5954ac31e74578829fed505856237252edf47e96d00c264868ed4

SHA512
1fea15b9aed6348f39c234f060807732203b1caf9add741e08bf0e728aa6fee20608a0d790dd668bceef1eceb500584baf6910bbff861152870e6b002cd592ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit