fcdb330d3323935ce117f9a457282b7d7aa6a13e7bdbfaca5b82d310f0f6ee59

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ChrоmеSеtuр.exe
Size

18.5MB
MD5

aab9abec81f255e7f73d3ac2b393b82f
SHA1

66294e12d96a95dfecd59dd07bf1a7d77827a17d
SHA256

fcdb330d3323935ce117f9a457282b7d7aa6a13e7bdbfaca5b82d310f0f6ee59
SHA512

cd413c7f935f8cefc1aa6bfb712af06315304fc56946f97d400f2b00ec368f3c34f5637c59f33c3bdb3ce161b02953f5df07b7c4e3db4f5b70563742c5b71261
SSDEEP

393216:FeeErqRTbb2awJ9ry9izxOLzdZZn2rSDnBlnNn+Wv+yegR0XS1TxJsqN/IMzTzJH:FeeErqRTbb2awJ9ry9izxOLzdZZn2rSn

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	ChrоmеSеtuр.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	ChrоmеSеtuр.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	ChrоmеSеtuр.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	ChrоmеSеtuр.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ChrоmеSеtuр.exe = "11000"	ChrоmеSеtuр.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2212	ChrоmеSеtuр.exe
2212	ChrоmеSеtuр.exe
2212	ChrоmеSеtuр.exe
2212	ChrоmеSеtuр.exe
2212	ChrоmеSеtuр.exe
2212	ChrоmеSеtuр.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2212	ChrоmеSеtuр.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	ChrоmеSеtuр.exe
2212	ChrоmеSеtuр.exe

C:\Users\Admin\AppData\Local\Temp\ChrоmеSеtuр.exe
"C:\Users\Admin\AppData\Local\Temp\ChrоmеSеtuр.exe"
1⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2212-1-0x0000000000900000-0x0000000001B8E000-memory.dmp

Filesize
18.6MB

Download
memory/2212-2-0x000000001BDF0000-0x000000001BE70000-memory.dmp

Filesize
512KB

Download
memory/2212-3-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2212-4-0x000000001BDF0000-0x000000001BE70000-memory.dmp

Filesize
512KB

Download
memory/2212-5-0x000000001D3C0000-0x000000001D5DE000-memory.dmp

Filesize
2.1MB

Download
memory/2212-6-0x000000001D5E0000-0x000000001D7E6000-memory.dmp

Filesize
2.0MB

Download
memory/2212-7-0x000000001D7F0000-0x000000001D9F6000-memory.dmp

Filesize
2.0MB

Download
memory/2212-8-0x000000001B880000-0x000000001B8CC000-memory.dmp

Filesize
304KB

Download
memory/2212-9-0x000000001DD30000-0x000000001DF0D000-memory.dmp

Filesize
1.9MB

Download