Analysis
-
max time kernel
100s -
max time network
287s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 21:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://farmatec.net/wp-content/plugins/contact-form-7-to-database-extension/Spout-2.7.1/Autoloader
Resource
win7-20231215-en
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1112 2056 chrome.exe 28 PID 2056 wrote to memory of 1112 2056 chrome.exe 28 PID 2056 wrote to memory of 1112 2056 chrome.exe 28 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2684 2056 chrome.exe 30 PID 2056 wrote to memory of 2796 2056 chrome.exe 31 PID 2056 wrote to memory of 2796 2056 chrome.exe 31 PID 2056 wrote to memory of 2796 2056 chrome.exe 31 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32 PID 2056 wrote to memory of 2788 2056 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://farmatec.net/wp-content/plugins/contact-form-7-to-database-extension/Spout-2.7.1/Autoloader1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e39758,0x7fef6e39768,0x7fef6e397782⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:22⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:82⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:82⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:12⤵PID:3036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2120 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:12⤵PID:2460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:22⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3204 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:22⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1468 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:12⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3896 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:12⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 --field-trial-handle=1216,i,10429920706981371464,15384780830169718727,131072 /prefetch:82⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD57368469776be0a09161e11002451d6f4
SHA11de9aea2f8d2acaff678d7c8360145f472fbed68
SHA2569fd8e268dcc84a4c471db0d20c646980e1cfe3f3702433866c5ca0535ed1fdf8
SHA5121314d7174e131c00050d07ad99c7e502beb7fdb65eb0671d50ec5e01e3aee860a777342cd9f1ed436ef518f56d3e2941a3eec7a3f55da01bcf8f2b3d8330addb
-
Filesize
1014B
MD5ab2689e157b8b3b4c7886312d050c2f4
SHA12ae6c7e341d776140cf6c575026eadb548fcf691
SHA256c54049e814923540d4d35b06ffd6320e81754cd780fba77f9de8fd07d6aa842d
SHA51265c98d028d84f47f4851a244e9f749d62d4a3730af9856748215ca2a0cd5f4f9028f5fcc90e16ce4b2b89ee1eafc000d023bf6b615f1b33d4baa84f14c342457
-
Filesize
5KB
MD5591ca2d286e459dfaecacc0feba14448
SHA194be2df76934c0890277b9bf7eaa0dbb3955be8f
SHA2565a9f277d500b44d6fe91bdede0ca045ae2be5560dddbd5c93692de7440fa546c
SHA51225ab54709a8a6d4bfdd7aac34fd2fc4012b71c1250e1d9c3f9f12d43e7780b0c0db96b3cb0246924f129b47a66d2e3e654fbd20903b068b8157e17c407e824c8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f03449fd-933b-4315-bafb-a17fb3baf38f.tmp
Filesize5KB
MD5548d95f0f8d849fa26e11820871f4b76
SHA198e5e068d74b71f78bbfd02efb97d479e19cfd52
SHA25626b039d358a117ff35e0d13d4d1d6c43a9901f2f0e49f19435c4f2ab343a357e
SHA512121b0a3307bd4601d0423df54c19c224442fa79547850d7f9fef4f8e8ba03c8b03884b0b90e6bdb389dcd49d6c7a055d53473345a74e2684b183fcc4bc8399bd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06