Resubmissions
06-04-2024 02:27
240406-cxx1zahg83 106-04-2024 02:26
240406-cw36lahg68 106-04-2024 02:25
240406-cwfejahb4v 101-04-2024 08:39
240401-kkrbnahf4y 6Analysis
-
max time kernel
335s -
max time network
333s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-04-2024 02:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Hasandwcevhir/Ro-Exec
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://github.com/Hasandwcevhir/Ro-Exec
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
150 seconds
General
-
Target
https://github.com/Hasandwcevhir/Ro-Exec
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133568441045221930" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3648 chrome.exe 3648 chrome.exe 1148 chrome.exe 1148 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3648 chrome.exe 3648 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe Token: SeShutdownPrivilege 3648 chrome.exe Token: SeCreatePagefilePrivilege 3648 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe 3648 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3648 wrote to memory of 4512 3648 chrome.exe 80 PID 3648 wrote to memory of 4512 3648 chrome.exe 80 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 240 3648 chrome.exe 82 PID 3648 wrote to memory of 700 3648 chrome.exe 83 PID 3648 wrote to memory of 700 3648 chrome.exe 83 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84 PID 3648 wrote to memory of 1616 3648 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Hasandwcevhir/Ro-Exec1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaf7309758,0x7ffaf7309768,0x7ffaf73097782⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1948,i,9736126154336096816,12781139108041662700,131072 /prefetch:22⤵PID:240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1848 --field-trial-handle=1948,i,9736126154336096816,12781139108041662700,131072 /prefetch:82⤵PID:700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2040 --field-trial-handle=1948,i,9736126154336096816,12781139108041662700,131072 /prefetch:82⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1948,i,9736126154336096816,12781139108041662700,131072 /prefetch:12⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1948,i,9736126154336096816,12781139108041662700,131072 /prefetch:12⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1948,i,9736126154336096816,12781139108041662700,131072 /prefetch:82⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1948,i,9736126154336096816,12781139108041662700,131072 /prefetch:82⤵PID:3892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4584 --field-trial-handle=1948,i,9736126154336096816,12781139108041662700,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1148
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5521c5238333e37a51f03959c40cf8a18
SHA1b6862d6c9c843176301bc62d5817622886d2ed42
SHA256b33ed5bfd58dfc813d65af491304315b49f41ff33d2cbf255d35deef177b3937
SHA512d9be485e18ad6641bb025ced27fc7cd722d56f7750ba3c670ef64b4bdfe65a8dac5772acddf22335a496435c60ab7094a576cb65e652b5513746b00fdcccc92c
-
Filesize
1KB
MD561f68708263dcfea0b30312509bf53bb
SHA1e357ae725249332239b39162b99b21e89f0304fe
SHA256c16fd7b3b62b078990c58feadd586b16fef1772f4d95a1692a2b382f893a18a4
SHA5122e66ae9df7fab634d986174d23a1967b671a7245cba0027d2688725612b1563041f5155126c91c8f40016047ebb56f745d2b9a073f1131a3f4267ee46eb14880
-
Filesize
1KB
MD5604474d225531b009a39738ad2d0054f
SHA18c5ce427cd03a34b2eb8e92af51ce86fa171341e
SHA256bea8e5e8e819bea8a7c83caa7958f63b8339002987ef5bd370a2a60eb0986e38
SHA51254648b8fc5cc8c6212ca36bf2e85c01a4ebd4beb30243680506fc74d6c64e8e15ba39ba3f96a8e14816ba418278b8e66ab37395908b4d0f9383799524e844ee0
-
Filesize
6KB
MD5c0b506dba40adccb864dc824deb7e0af
SHA1330d8db46a42dc0e4440d9c7c70ba5452cd45bd7
SHA256de243588e3c5865fa0989edb892004f5e6d58ce2398658b8711ac090238b346d
SHA5125c891a59974215686e599801a4fab14a93c4e6c5dba7dde3f79e6ac21f14500abc9275a659f1dedbaeba58bbee123a225871a5f8d2eb965097639f4bd121bd0c
-
Filesize
130KB
MD5ec887d72a908511f15e56377fe251ac0
SHA11cba593a576f97a28a49acddaea83a38e8e42b4a
SHA2567d88b0bde00d7d23b74ae3868cd375654aa3fc8b5401d873ac49471d2a5daf7d
SHA5129563e6c7bab410c4cb253d469f12b4ef7e4c60f1851a273e497c0d8ec63b857bc9e82abed5a710e2a70452390591b2753bf4e463db63a07506477cf3defd0f79
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd