Resubmissions
01/01/2024, 20:41
240101-zgwvasacdl 131/12/2023, 01:27
231231-bt7wbsfhh4 130/12/2023, 18:44
231230-xdklrabbcl 129/12/2023, 19:32
231229-x89t5abgfm 119/12/2023, 06:04
231219-gs1cragfh3 119/12/2023, 05:54
231219-gl8esagfe4 1Analysis
-
max time kernel
13s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 20:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2804 chrome.exe 2804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe Token: SeShutdownPrivilege 2804 chrome.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe 2804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2956 2804 chrome.exe 16 PID 2804 wrote to memory of 2956 2804 chrome.exe 16 PID 2804 wrote to memory of 2956 2804 chrome.exe 16 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2708 2804 chrome.exe 34 PID 2804 wrote to memory of 2740 2804 chrome.exe 29 PID 2804 wrote to memory of 2740 2804 chrome.exe 29 PID 2804 wrote to memory of 2740 2804 chrome.exe 29 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 PID 2804 wrote to memory of 2640 2804 chrome.exe 30 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7119758,0x7fef7119768,0x7fef71197781⤵PID:2956
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:82⤵PID:2740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:82⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2104 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:12⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2112 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:12⤵PID:592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:22⤵PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:22⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:82⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3336 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:82⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3284 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:82⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:82⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2088 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:12⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5aab9ec842ccd25c30ec1ff62764dbba1
SHA16a24218aac058314738305ff1b2dcb21c41e0407
SHA2563603a4e0aa5b66e8195a91cd3ba08f4b30ff8e5119c4630dd6e2bad513fa0b96
SHA512fb22d109a98f4b687b275d19a4f447d7f194b426ce1cdf340e34b0dfa9cd01a7eb20f55fdf21b4545d17e0c77502dbca803b336fa270eee148ad30b439a8c431
-
Filesize
4KB
MD5cc03c17f09d8f8f646c21905d5be9d21
SHA195e2adb01f2e49b80dd0ed30af562488050c8361
SHA256f1e327c8c475347207689d1a039c34a55a745e3b0bf11ceed2acee14e645c4ec
SHA512da46894e0d817c78398c4837bb70407745bad3888d4182c3f255fe00293c40b078333d03f80df380c0d62408b41dc29e5a848a8f08a9770e25eea7444335586d