hxxps://www[.]mediafire[.]com/file/j61hk74zuboqvve/7DOcgVrSHL8WQaeh[.]exe/file

Analysis

max time kernel
599s
max time network
589s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/j61hk74zuboqvve/7DOcgVrSHL8WQaeh.exe/file

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133533760699396964"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2272	chrome.exe
2272	chrome.exe
3136	chrome.exe
3136	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2300	2272	chrome.exe	89
PID 2272 wrote to memory of 2300	2272	chrome.exe	89
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 3224	2272	chrome.exe	91
PID 2272 wrote to memory of 2904	2272	chrome.exe	93
PID 2272 wrote to memory of 2904	2272	chrome.exe	93
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92
PID 2272 wrote to memory of 3892	2272	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/j61hk74zuboqvve/7DOcgVrSHL8WQaeh.exe/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1c539758,0x7ffd1c539768,0x7ffd1c539778
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4732 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5472 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5316 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5172 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:8
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 --field-trial-handle=1844,i,15347809471728010766,648270906617076873,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
a2da1bc4e9addac00ab75ab19b13558f

SHA1
855e9c3d5ee1237546e298175b9a1dd992e0dfe8

SHA256
c400d56481fead42410e54b70d3756797b0c20a5c89cb6ae7cd9f2fa58ecacd4

SHA512
7feb9759d8e694276196accf3962803c43738849a6550aa018532372759d74cc6a2895bbfc8f0162900549864417957fd09bd31a3fa169baceee3dc2ac6d9fdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
7ed77302275a286e7f94127176e128f9

SHA1
9bfe3415d2aeba51e38a4eb9aa2d44cea68ed74d

SHA256
72d66d2b626f8ced3f1a78415fc15e19820d5426920443f31738c27788834c0e

SHA512
dcf8b94f11544757fad89f4defe1dfeee3259955527c860c95d77e29c095a4289a436ba9dfc4d49bbfc67c408668e7db6fbdb2e256c3109eecb3e6cf9074a007

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d9b1b0440f1c26ca57c9915381f7f2dc

SHA1
ddc06280eb8253a412190c844473df3c53fdb540

SHA256
2cc50ff792d13e0a7252fc29b1fcc13ab5cea2065c5631a8326df0fb70a84311

SHA512
040d53c1306a0eb629035dae7660b8225df6af3993a422d5aa8b44aaada817a411de430b1d8abc4c3bac363c950bc01f36c79d4d617c1aaa552d3352ff4d0895

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e5a0152b25697677686822f56c987e78

SHA1
e4c64567c33d61a34a5935fad22dba1c08ed6d1a

SHA256
30a8a42f8c586f34227918a723f91e135cc8aa36a34a015b3a65e199435d040c

SHA512
ca5b2c81f31e8f84a602df4ccbbff5d4954178c95fff31f46a6b57618887388fb08bbc9a89e92b325307a9a8289b227a888bc1a91ca293cd291dd0819fb70ef0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
8c3e4d7e70a79959757bbb589cb4d1ee

SHA1
ff3f9740fae824a634b0bcdc6c3502e478bed69c

SHA256
6fe02e1b82b59ae92bbe2ec264d941c12bfc7893d997fdf99c90a80deb786809

SHA512
250b3ec61791d79c0c777b4da8712c8faa804b264a718f7df2a05d124fb93a0b4b4448db09f59cb71317dbebb3f63217b701560dc8611fd5e81f794491f295b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit