Analysis
-
max time kernel
599s -
max time network
592s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 09:34
Static task
static1
Behavioral task
behavioral1
Sample
ErinevPredictorV2.exe.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ErinevPredictorV2.exe.html
Resource
win10v2004-20240221-en
General
-
Target
ErinevPredictorV2.exe.html
-
Size
18KB
-
MD5
788250e99763cda5e83633dad97b443a
-
SHA1
cc544bbe5351f88683fb92c1bb3d8c70f035d2fa
-
SHA256
6a8692cc210a46295f418f8afb6cfe4d3563a3e33e6eea57ad08af719cc8056a
-
SHA512
f433a44eef156aa39c305fdc5cdafbfd49edbbb55b6992c20ca516cae000f083041978ec2b86661c6e3634de1857799b0eb112ca0e809e53499defba77bc2268
-
SSDEEP
384:GoJFdlIn7xpYwuu504YCeHYhDRzhU3E8+UUKIz40qoOgxKNI3ME:GoJdIn7XY20t+DRzh4E8+UUKIz40qolF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133532409650661555" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2548 chrome.exe 2548 chrome.exe 2948 chrome.exe 2948 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe Token: SeShutdownPrivilege 2548 chrome.exe Token: SeCreatePagefilePrivilege 2548 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe 2548 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2452 2548 chrome.exe 90 PID 2548 wrote to memory of 2452 2548 chrome.exe 90 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 392 2548 chrome.exe 94 PID 2548 wrote to memory of 4012 2548 chrome.exe 93 PID 2548 wrote to memory of 4012 2548 chrome.exe 93 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95 PID 2548 wrote to memory of 3224 2548 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ErinevPredictorV2.exe.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c05e9758,0x7ff8c05e9768,0x7ff8c05e97782⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:82⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:22⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:82⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2828 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:12⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:12⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4736 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:12⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4980 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:12⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3064 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:12⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3200 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:12⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:82⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:82⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3088 --field-trial-handle=1860,i,18030099664681494015,9618033806074578726,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD56406b9da9de55d0937c112a0797c2532
SHA131cdef3e632658ed526b21b43dfaca2cdb70aec7
SHA256851f2535e1ef9e4b0114f8a07825cfd86602489a19f206c687a63022de836051
SHA51267d8a77020c65cf419f3ef3efbf34036c57852b2e3af72786d6505f1a268afc703897fd7490078a4863985b7fa74f92935fae64b375394c18a4228c4f5ab50a0
-
Filesize
3KB
MD507eb771bc8d51abe740905cb81de5c3e
SHA1cc20df4ada20b851870e616ea856af5bbb0f106e
SHA25674cb1c7edf82274322f523230d4147fafdc4b51c582ca829e5c136b989d008ee
SHA512018f12abfcb9d352e72e59ec85e2a583262613153022d68b96545ab1c6041c748f0ff833fb474d4459e7392965f1eeb367023b031d17c9b38f67a76716d336ba
-
Filesize
1KB
MD5068e3160f12f4c07838ccdba03e5515a
SHA1ef0b874a2bf561cc9e9e3a07b5924dc72cc32afd
SHA2563775a11488509c74ed2e4eb9823eb15eba398285c8c3dd4fec1caec282a0fede
SHA51218f2477e1250f4733cff46ec9c5656cf25cd8d7d1e2e03c245951721bc80a64016b5171172af625eca0e8c8a825a5f21a9a8ae1684c5c0876fbbecc0b87b9551
-
Filesize
6KB
MD505b8a0bc1c59c9024eedb3a7c17e8b55
SHA111bb730ce66768f41c80ec93bac0e11fa1b5d9cb
SHA256964f08377808c91ebe8d9802175468e0a4e16c0a9fef7434270d3443821d14c4
SHA512f01712775baec865010799b58e61a4c92689d3eea47e05976675ddc97f7e08311636e0011460976711e9102fd8e6e093fd78ea61ccfd4a3b09f3216a498f9973
-
Filesize
6KB
MD594df168911d576581a6d8ec522a48b49
SHA102a9c268f6aa399f0822d93438d44da4da6cb558
SHA256fceee6b8ce32b7abb88c4f7192f1ce8bae070118b9a3553cbdba30a721923eaa
SHA5127cb830f05fdf8731604f3080b90b5e250d52a94d17e818a2efd62cb8caaab8bf71cbc3d0441fd5772053801bba982306f199d06db11d1d4b66d6d623e870355d
-
Filesize
130KB
MD5ad77595bb84e6549276af6537895563d
SHA1756ba8edefafba7532b20b414c629174a5a0148f
SHA256ee0e2b0ee56c4631c65e268ab791f31823add940fe771517e127a9f480574588
SHA512d0ea866fec44b1f0ee32fbbdb82709b06a7e478980ea1618459b3a747371b8af1158fbbd10fa9c61f916a2883d8c5f67912c3b1519f467b1e5cf8b137985544e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd