Resubmissions
03-04-2024 06:34
240403-hb3bfsab7v 303-04-2024 06:29
240403-g9cm1sag36 303-04-2024 06:18
240403-g2ms1saa5y 3Analysis
-
max time kernel
101s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-04-2024 06:29
Static task
static1
Behavioral task
behavioral1
Sample
optsatadc.dll
Resource
win7-20240221-en
General
-
Target
optsatadc.dll
-
Size
396KB
-
MD5
df5958459f89d775687190650de4f08b
-
SHA1
4d3a703db690e975540d6d29cdab2f75fbbcb61c
-
SHA256
1122cf610bbd39b4bbae11f2e93bcbefb371aa301aac45da7ef7e5f6963ac8f4
-
SHA512
7c7bacee56cefbf3d44a5fe2c570c2eb12a800402133032419d2886f119fb0a098526f76b73174e9c1537569852a7f7c2a095589e5dc2f8ac1ddb7b832346ea9
-
SSDEEP
12288:PFFIBSCdHo3p5CJHj9wc3gXERHTYKNviwl:7IBSCdHo3p5C9BwtyHTYMX
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2772 chrome.exe 2772 chrome.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exechrome.exedescription pid process target process PID 1692 wrote to memory of 2488 1692 rundll32.exe rundll32.exe PID 1692 wrote to memory of 2488 1692 rundll32.exe rundll32.exe PID 1692 wrote to memory of 2488 1692 rundll32.exe rundll32.exe PID 1692 wrote to memory of 2488 1692 rundll32.exe rundll32.exe PID 1692 wrote to memory of 2488 1692 rundll32.exe rundll32.exe PID 1692 wrote to memory of 2488 1692 rundll32.exe rundll32.exe PID 1692 wrote to memory of 2488 1692 rundll32.exe rundll32.exe PID 2772 wrote to memory of 2808 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2808 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2808 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2324 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2700 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2700 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2700 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 524 2772 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\optsatadc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\optsatadc.dll,#12⤵PID:2488
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2416
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef69e9758,0x7fef69e9768,0x7fef69e97782⤵PID:2808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:22⤵PID:2324
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:82⤵PID:2700
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:82⤵PID:524
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:12⤵PID:2776
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:12⤵PID:1744
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1408 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:22⤵PID:1772
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3168 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:12⤵PID:556
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3828 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:82⤵PID:1712
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3848 --field-trial-handle=1208,i,100481386483615957,7471116497476702464,131072 /prefetch:12⤵PID:1556
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
441KB
MD54604e676a0a7d18770853919e24ec465
SHA1415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f
SHA256a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
SHA5123d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774
-
Filesize
262KB
MD5422f395a9480e5b83a5e55c32551b6ff
SHA12e8111a5a780d30972d4bbc65cb7d425d1e2474e
SHA256f310f653ae746eff54a2694b8fb51bf3a858f2f95353f53b7e885a0baace4d5c
SHA512ee0618ca0f5742dc0f01bc5f61713d9de1b840e3f3e7cb3c680128f4d2ff35f550976961834568b9f98c720b53e77b09eafd852cd853a283cccb03213f25dae9
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5d35c34599f4d7b0be10bf81076e10f7b
SHA1de4a1a2f1801998d05707d5f0640f0fc0fc6f7bd
SHA256c9fdba8bb45858367efaa06daa6f7db05e52733a5278a9c58e5c10d01d0ce1bf
SHA512ed5620f0e47c67b4f71f63f0d1dfee8a3199bd0e8c610f6ea7db5842cc1d7b5b08a115499daa444476281a156b4461e0674b0385e12b59f388cf9964c0a58bde
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
262KB
MD590c5fd6efbfbe8bd67b370bab7a7d33f
SHA16c450016c572959008a1a33d5391c9ebfef0698e
SHA256e950391d2bd803e8f9ee6a7a19050bfb7b9c145a6a894b6436bcae4d839a9460
SHA51218fd80791b3846dd567bbf97055ac1d930f53233f42f63497118fa6b3a13fa66300430d1e2322bcdeceb039fccadc18d6f683044ba3f3da4214d6129dad0b7e0
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e