hxxps://bananasquad[.]ru/downloadhandler

Analysis

max time kernel
300s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://bananasquad.ru/downloadhandler

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133409941172013828"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4484	chrome.exe
4484	chrome.exe
960	chrome.exe
960	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4484	chrome.exe
4484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3792	4484	chrome.exe	59
PID 4484 wrote to memory of 3792	4484	chrome.exe	59
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 3332	4484	chrome.exe	88
PID 4484 wrote to memory of 5000	4484	chrome.exe	89
PID 4484 wrote to memory of 5000	4484	chrome.exe	89
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90
PID 4484 wrote to memory of 2124	4484	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bananasquad.ru/downloadhandler
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff911989758,0x7ff911989768,0x7ff911989778
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1888,i,11116455170979385508,17362634173866123438,131072 /prefetch:2
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1888,i,11116455170979385508,17362634173866123438,131072 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1888,i,11116455170979385508,17362634173866123438,131072 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1888,i,11116455170979385508,17362634173866123438,131072 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1888,i,11116455170979385508,17362634173866123438,131072 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1888,i,11116455170979385508,17362634173866123438,131072 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1888,i,11116455170979385508,17362634173866123438,131072 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4584 --field-trial-handle=1888,i,11116455170979385508,17362634173866123438,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d669234182fe38a27838408ec8fff21f

SHA1
f2acb1e59c8382f1c57bd018c67831b4eeeb2a2e

SHA256
b13a21d1a9c777676cefde774cdac3e4ea8e34cb241eb21ccf9e2c65d85aa090

SHA512
1266f5c07c12aa2dce5d51b62c85a9063691179145edb94e65ac42ae5aad98d4e62848e2aedf75f9b389094c91d1ca892ab2977888fdd5c9e9021e3cec458b9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a4bbe212fa54ea103f99cacf796dcdbb

SHA1
c8ef736ac0ade6dae444fa97ae7bb12cf110c8f8

SHA256
414777ec602834a688610e35a25c52248aee2d2c4c82ac936e18f3756a090c82

SHA512
a969ccfc2358ab0f4e9be9655a57795a149a64064c6fd3348ac84ce981856d7405cd0667acb3caa9c49c7b485af578864ca8f331d19bfd50c27cbad9ec48808e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5b12997fc845b6b2ee7c78c824d6fb21

SHA1
bf94fea0a11a1c805c27cd42b44bc7bd5731f1ac

SHA256
1f3632f91e1eb8a35676e19b5274e9c47f338beb8a48ba76768793935a8561b9

SHA512
4a71cb0ceccd0057a1ccde7ae8afb2883c05776106fffe84117a2d476099b7e0117c66b76284246c090790f8237aff71af89c138ca512ded7db97aa614ea5d4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a0e6c20d6d2d361e4c88ad496aca940c

SHA1
589facfc5cf222de0ce4ed4ea245497bf398cae2

SHA256
b9b00ecb94a4d4d28095d3a07330ab2179f110999da90d74e2aca68323753002

SHA512
ca02546c3fc9b0cc0889cde8227d5a42f0a6a91fae3d59bcebfd869f31a67518b1b43ce1caba8ad778d4d11965ec6cae3e5422dc746db0ce944b37d86be17e70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
9901c3491b1c90242c00ea76eebaa370

SHA1
ed4c861fededc05af57ce96657d5aaf9cda7dfdf

SHA256
21c264e023295c8debd3af8bae3d1fd1f3b09cb35d45b2dfd4ee29988cdec47b

SHA512
18fe7ac3bef80741ef6315937c016b20a6b2bcd2e27424baff505cb31f163e60c3055cb68152481c1a17b6741aff66f20924009ac10afa7dc01035c3afa96065

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit