Analysis
-
max time kernel
48s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NoEscape.exe.zip
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
NoEscape.exe.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
NoEscape.exe/NoEscape.exe-Latest Version/NoEscape.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
NoEscape.exe/NoEscape.exe-Latest Version/NoEscape.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
NoEscape.exe/NoEscape.exe-Latest Version/vc_redist.x86.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
NoEscape.exe/NoEscape.exe-Latest Version/vc_redist.x86.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
NoEscape.exe.zip
-
Size
13.5MB
-
MD5
660708319a500f1865fa9d2fadfa712d
-
SHA1
b2ae3aef17095ab26410e0f1792a379a4a2966f8
-
SHA256
542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c
-
SHA512
18f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517
-
SSDEEP
393216:BATeK1bYlJbM9tAlAkRCnG7H+KlzMNCPm5lvvayDPk15DBJ:BoX16blXonYeKdKCPGayDPiJ
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3000 chrome.exe 3000 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3068 3000 chrome.exe 29 PID 3000 wrote to memory of 3068 3000 chrome.exe 29 PID 3000 wrote to memory of 3068 3000 chrome.exe 29 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2592 3000 chrome.exe 31 PID 3000 wrote to memory of 2552 3000 chrome.exe 32 PID 3000 wrote to memory of 2552 3000 chrome.exe 32 PID 3000 wrote to memory of 2552 3000 chrome.exe 32 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33 PID 3000 wrote to memory of 2472 3000 chrome.exe 33
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\NoEscape.exe.zip1⤵PID:2848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7509758,0x7fef7509768,0x7fef75097782⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1192,i,8151319425196024344,7694994120400599254,131072 /prefetch:22⤵PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1192,i,8151319425196024344,7694994120400599254,131072 /prefetch:82⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1192,i,8151319425196024344,7694994120400599254,131072 /prefetch:82⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2344 --field-trial-handle=1192,i,8151319425196024344,7694994120400599254,131072 /prefetch:12⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2368 --field-trial-handle=1192,i,8151319425196024344,7694994120400599254,131072 /prefetch:12⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1216 --field-trial-handle=1192,i,8151319425196024344,7694994120400599254,131072 /prefetch:22⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1196 --field-trial-handle=1192,i,8151319425196024344,7694994120400599254,131072 /prefetch:12⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 --field-trial-handle=1192,i,8151319425196024344,7694994120400599254,131072 /prefetch:82⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:344
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
632B
MD5e4c391dddedc0f248b3eaa990d2f1c3b
SHA18e056f9f0e7a3693554d0e5cfa217b248cbfc5e6
SHA2562b3a2384351cb88e73e179c964a6fc29ceae41dbe24bd39fd6b34a9b9770756b
SHA5123c91bf18ca31a402fee122be793610025ddfe87de1f9b17171bc9e3d25af7c32bac43567f488d62382e5f512b563d4aa3879360d5fb108921a407c272d1df2db
-
Filesize
4KB
MD5d2498c19af4996be2218b2be3569b75f
SHA19895d050a7afe8ddff7b9f8eb867a18caf6f26fc
SHA2566ee807ad425906c5f6ac06a15ffc152711d928b40be788d7be0aa9b1dafbbec0
SHA5122e01a4e2a6aabc4b670259342df425f15268c10585f6158d404aa47eddf03f148e0a88d7aa3b99975e706895d841b5e4fefee571f51c81c741e80446c28d19f7
-
Filesize
4KB
MD5cde5ca7ca37ab8793de67e303b251867
SHA140b54a7128da481a310a1775878b6c58a0995877
SHA256768e751a1f777163391d7c1983752e0a17ae18ca7cc5a322aa2e55ebbe0298e7
SHA512944555aa83fa4631e5e42bf730e7f4b528c8b090c9e2bf7bee21e4dcff07fe23663ff789a214c861ce050cf84fa2d5242248bfd9d8eb578e81eeab7d03f40479