Analysis
-
max time kernel
65s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
18/11/2023, 13:16
Static task
static1
Behavioral task
behavioral1
Sample
AimstarCS2_External_1XQYjmwUUaNOad3 (1).zip
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
AimstarCS2_External_1XQYjmwUUaNOad3 (1).zip
Resource
win10v2004-20231023-en
General
-
Target
AimstarCS2_External_1XQYjmwUUaNOad3 (1).zip
-
Size
524KB
-
MD5
8777f6a2b35d7b0a93319427ff18fbfd
-
SHA1
baaf189f3bb24034ef18a41d20c6b5da1fe889d9
-
SHA256
e2147a2e0365cdd6889698c149da3d26c225094a43677d7abb3b89fbd01552b6
-
SHA512
a46c6c82e371c69d35ed6a9edd4f3785565235d8422bb97a89703db3f707b8ef8ea5bdeff139f98d9df72273c5165d9989ba5c6612676987c603dda618ecd3ef
-
SSDEEP
12288:xnRKgc+UJL6+Ur9/uX2JPUL565Ty5Vuiy0WfW/hjP14j:3WL6+sPJAo5TyKR0WfW/h6
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2220 2216 chrome.exe 29 PID 2216 wrote to memory of 2220 2216 chrome.exe 29 PID 2216 wrote to memory of 2220 2216 chrome.exe 29 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2676 2216 chrome.exe 31 PID 2216 wrote to memory of 2844 2216 chrome.exe 33 PID 2216 wrote to memory of 2844 2216 chrome.exe 33 PID 2216 wrote to memory of 2844 2216 chrome.exe 33 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32 PID 2216 wrote to memory of 2704 2216 chrome.exe 32
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\AimstarCS2_External_1XQYjmwUUaNOad3 (1).zip"1⤵PID:2508
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72a9758,0x7fef72a9768,0x7fef72a97782⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:22⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:82⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:82⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2244 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:12⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2256 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:12⤵PID:2460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2632 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:22⤵PID:1016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1308 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3448 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:82⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3564 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:82⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:82⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2792 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:82⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 --field-trial-handle=1156,i,14701898953871063564,11544837685112047685,131072 /prefetch:82⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD578167f6ea937838f4a1dade2d9fe806e
SHA1bc93fc88062538e75420932949a24440310ef2d8
SHA256e0a6b9f80bf8c9c679a8f1f28e3ecf38c3ae33cbdab6a70ac613202be8792d9e
SHA512d88831e5246d9ece2026bf75bd8d1c6237012263132adf6ce03126c361fb7f2a1f1456d0408a0771d29ffbb30d669778851eb4fb7d21c3e6eba9aac38016edf3
-
Filesize
4KB
MD5d6c896b1cba262b6f18fd7a4a23cc176
SHA12ac30a49847ee89d2448d5d28e354c522939bed6
SHA2560ad9f54086fcd5c02ed197a8af1537fb66ab72b0a976e6c05d9b32551a70f3bf
SHA5127a2cc5f29a456c34abfe239b7a1b56ea77d15d3a6f14ea72831f121ec3540dba26845e1554f51cbb24785f8fef2985b54185369d62a3d25a78419f3ae4354c4e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
239KB
MD5a49ffa4118e3e16beb864612c078231d
SHA17e2d2c2ae1d340b361e1ed293eaec7bae8dcf379
SHA2564f89334dec4c68cbd111dc39c91ac627f3346a0133c3858f29872a3c8177e3e5
SHA512d418525895d419a45f7b05040a76d7f7d2bb8e0696d2d6b19faacd7a30495a53adbd75f275ca4cd78192561770db8dac675599a23dc7563fef8d0448f2333f6b
-
Filesize
222KB
MD536ac56ce3a97ff5db33a6923fec2f97c
SHA130441c9a1e245b621c9156401cb86154071f7ab8
SHA25690a12836b6c25964093f6893f51acae9366b853f45526f403f77404ca0cabcdc
SHA512f1c498bd8519bb1cecb177a9f028df954370ab46ff07ea566051e3d5bd84e6fb4f0cdbb9f6e99ea1bbde85756f0715d3938b327c374feb44bbd01ecf679f3516
-
Filesize
239KB
MD5bcdf2962c2915e749e89bfee3ee1f630
SHA12d1f58c9a6110ba103886099e6faa7a231e5a8d7
SHA2564d579895d6db6b76f6ead0affafe78d646befc4a5b2ec31b233937808d47a340
SHA51275864ff52f59b4fb12b84b27cfe9c254597f22c006d86c96dc9d671b434327f6c2fac36427e464fe9008aa0f2d248392435c52a4a4b59b19d9d4a882d1a87879
-
Filesize
110KB
MD5d0fd92153e3ef07169a36417441af257
SHA1b745a3cea7d1f56b5b6fb7d4fb58b3ba1e6337df
SHA256ea9b1ec8170916799f94bc709e626cb42199026499ca51b8322082bb2451610d
SHA5124eb689ab60f0b7e22027d2525e5ef0206deda1f4d8bec333219ddc99ea08aa6e5707906549bb1b1e03a4a15b5e32de6f4e1e33442ec3611f4d7914a9ec99fee7