86e83909b8c60293456d350adc3e52665e46671e01de66eba46c52329b0b7c02

Analysis

max time kernel
20s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb98a88346b10b19b1e13e4e50e7e635bd400c3f6ab932ceddb943e758b62b50.exe
Size

150KB
MD5

a3b4748618c8fca2523c5c83cdcf7e65
SHA1

c4067c1412f2e310a9757fbd2499e43e0b69e89f
SHA256

86e83909b8c60293456d350adc3e52665e46671e01de66eba46c52329b0b7c02
SHA512

1a203a139bc4a5056b02058598f9a1211ccaba4ca2522f7d5a414b27147efb3df26c5f7598a8953955a8745a02f3cb91075df4b2045b0ececbd130e0d75e3be7
SSDEEP

3072:T5VF+XC9GAJ3+3BI0WhAtAAAAA+j7aJRide/iAbB9ZoSnm3vTZKPO:T5VP9Ge3+hoAvdeJBbLnMvTZOO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2716	3064	bb98a88346b10b19b1e13e4e50e7e635bd400c3f6ab932ceddb943e758b62b50.exe	28
PID 3064 wrote to memory of 2716	3064	bb98a88346b10b19b1e13e4e50e7e635bd400c3f6ab932ceddb943e758b62b50.exe	28
PID 3064 wrote to memory of 2716	3064	bb98a88346b10b19b1e13e4e50e7e635bd400c3f6ab932ceddb943e758b62b50.exe	28
PID 3064 wrote to memory of 2716	3064	bb98a88346b10b19b1e13e4e50e7e635bd400c3f6ab932ceddb943e758b62b50.exe	28
PID 2716 wrote to memory of 1060	2716	cmd.exe	30
PID 2716 wrote to memory of 1060	2716	cmd.exe	30
PID 2716 wrote to memory of 1060	2716	cmd.exe	30
PID 1060 wrote to memory of 2844	1060	chrome.exe	31
PID 1060 wrote to memory of 2844	1060	chrome.exe	31
PID 1060 wrote to memory of 2844	1060	chrome.exe	31
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 292	1060	chrome.exe	33
PID 1060 wrote to memory of 524	1060	chrome.exe	34
PID 1060 wrote to memory of 524	1060	chrome.exe	34
PID 1060 wrote to memory of 524	1060	chrome.exe	34
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35
PID 1060 wrote to memory of 1636	1060	chrome.exe	35

C:\Users\Admin\AppData\Local\Temp\bb98a88346b10b19b1e13e4e50e7e635bd400c3f6ab932ceddb943e758b62b50.exe
"C:\Users\Admin\AppData\Local\Temp\bb98a88346b10b19b1e13e4e50e7e635bd400c3f6ab932ceddb943e758b62b50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\exclude.bat" /verysilent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://247info.click/ofertaprezi.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66a9758,0x7fef66a9768,0x7fef66a9778
      4⤵
      PID:2844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1320,i,16071221050247883520,16743620636146428404,131072 /prefetch:2
      4⤵
      PID:292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1408 --field-trial-handle=1320,i,16071221050247883520,16743620636146428404,131072 /prefetch:8
      4⤵
      PID:524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1320,i,16071221050247883520,16743620636146428404,131072 /prefetch:8
      4⤵
      PID:1636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1320,i,16071221050247883520,16743620636146428404,131072 /prefetch:1
      4⤵
      PID:1320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2256 --field-trial-handle=1320,i,16071221050247883520,16743620636146428404,131072 /prefetch:1
      4⤵
      PID:2676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1572 --field-trial-handle=1320,i,16071221050247883520,16743620636146428404,131072 /prefetch:2
      4⤵
      PID:2964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 --field-trial-handle=1320,i,16071221050247883520,16743620636146428404,131072 /prefetch:8
      4⤵
      PID:2468

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
cf8b54a40b45b6e025f5c9d0ffb98892

SHA1
3efdecf1a0c5199a7f589d6e34c39f402357ed75

SHA256
953073564964410e7a9f22f3d873f0eb022601e799ee57060c4a9857eb78a3a7

SHA512
8188a94aecb8ad41297ce71516c557a0ceb2bab8cb4e37747a8d40e890719515b74324d109623c3aa7b4c1d48a020b98faf706bdfe9a3bc699b05d64cdc991cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFf76ea11.TMP

Filesize
5KB

MD5
f82f9736888134476ae01f1b33b9619e

SHA1
b306830cd0f027a78d01dab5d1ef825788b3faa4

SHA256
7c5010a961b675b21460ccca74fdee895d4ad6f26123a5722bedb092042f4771

SHA512
be4ddfaa36d555c9a754ed7b23db3ee5b826120486cc41f36dbf0ac95f3640cc686fcbfff1f3faa8d8547e8bb0730d0ab04a18836c9af509f09a8d27995d5a53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\exclude.bat

Filesize
179B

MD5
607e039223410a84376dc461212752ea

SHA1
534d6ab1115dc594660fcb3a9206cd8d5d2bda71

SHA256
0adae4ac13aaa05f218534c243490bcf19661f2171d5e44112ad0586537be048

SHA512
767525bbeb80a4ea86b38381eaafd314be2e412c9bfb9901253d9f42f585ae3d8249268d9a81e29b12f193db2c02e1044790781e30d488081027173f542cc7b8

Download Submit
memory/3064-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3064-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3064-11-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/3064-29-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download