c92e4255a897d6d97295724e5934a5315238a63bb8e0b8b320c5f9b21eb0f531

Analysis

max time kernel
106s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

restart.exe
Size

63KB
MD5

8242ce426ad462eff02edae1487a6949
SHA1

9a4f382d427e0de729053535aaa3310cac5f087b
SHA256

b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
SHA512

aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
SSDEEP

768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	restart64.exe
File opened for modification	C:\Windows\setupact.log	restart64.exe
File opened for modification	C:\Windows\setuperr.log	restart64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2864	restart64.exe
Token: SeLoadDriverPrivilege	2864	restart64.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2864	2844	restart.exe	28
PID 2844 wrote to memory of 2864	2844	restart.exe	28
PID 2844 wrote to memory of 2864	2844	restart.exe	28
PID 2844 wrote to memory of 2864	2844	restart.exe	28
PID 2484 wrote to memory of 2784	2484	chrome.exe	32
PID 2484 wrote to memory of 2784	2484	chrome.exe	32
PID 2484 wrote to memory of 2784	2484	chrome.exe	32
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2616	2484	chrome.exe	34
PID 2484 wrote to memory of 2540	2484	chrome.exe	35
PID 2484 wrote to memory of 2540	2484	chrome.exe	35
PID 2484 wrote to memory of 2540	2484	chrome.exe	35
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36
PID 2484 wrote to memory of 1952	2484	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\restart.exe
"C:\Users\Admin\AppData\Local\Temp\restart.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\restart64.exe
  restart64.exe
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6eb9758,0x7fef6eb9768,0x7fef6eb9778
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1416 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1508 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3188 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2740 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3768 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2524 --field-trial-handle=1328,i,13533468798245906017,18061501789107910855,131072 /prefetch:1
  2⤵
  PID:588

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_developers.google.com_0.indexeddb.leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
740899c55f114f9e2a53d972ccd81c73

SHA1
3eb6cc1b49f51297b401d53b2e01d20b2eddbb25

SHA256
7d1cfea6db9d50e88818b19aeaeca7546257018f9e1cef95297b603fca5e0cba

SHA512
c029736d7133b9744328372959dbd369f77527ef34c7449558c20c53eb629f92ff72df95c748d190890f251892ff040165ff4c4c98c831c1080ee2c2579a9f0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
24723f6384a4542c84c329dfa6c3a349

SHA1
a24c5868122d9bf84c3e259ada0767727f72a28b

SHA256
2fbb1f6f3a6110ce64bd5b2019ced24e7ebef633e2a359c146f5e0f42f8d75b7

SHA512
11700696b9391f82c976dde167a1cae957781936bcb2129eaa6fe32aee1630f8e705b73b1e2d61b187ec67777073cd78329045461b2352df149540144fa9dbad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
3cbf24aa5b8a477ac5ac50f329622adb

SHA1
0fabb1d7dd71a65bc6506c2e00a128647a5200e9

SHA256
d242e8f5280157aba5fd5e031aad946bbdf0ec603b8d4bbf16df089fcb65c507

SHA512
684d7d39d586feac72f8c59b9215c3fad41dc65145d58ab4aa526c8c4c2b36a762e4ea5a508f45cf1d0777cb9c018b241f44a09048ce4633999da649cb362465

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT~RFf78bcca.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit