Analysis

  • max time kernel
    25s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    23/04/2024, 15:33

General

  • Target

    env-fix_1_1.bat

  • Size

    815B

  • MD5

    b6fe6ea789cfb4b3f4e5d5159d4eddb7

  • SHA1

    2cf6427b2eda14c106449901dc99f59a199be6b4

  • SHA256

    07b08528b1bffffe03b6f8a347156cf114ae1ff0c9bd18cc2d2c7b28b97434de

  • SHA512

    8c280db72ae51bbfd8bcd16d866bee70980d0a79b6cd9b6e5dca969c2e21f940c2901a2148d11187466c2360492d60e558972449a35e53b59a5b3600811f4675

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\env-fix_1_1.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:2340
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c set OPENSSL_ia32cap
        2⤵
          PID:2388
        • C:\Windows\system32\setx.exe
          setx OPENSSL_ia32cap ~0x20000000
          2⤵
            PID:2400
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          1⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ad9758,0x7fef6ad9768,0x7fef6ad9778
            2⤵
              PID:2168
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:2
              2⤵
                PID:2596
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:8
                2⤵
                  PID:2632
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1664 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:8
                  2⤵
                    PID:2516
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2176 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:1
                    2⤵
                      PID:1996
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2208 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:1
                      2⤵
                        PID:1820
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1420 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:2
                        2⤵
                          PID:2252
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2472 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:1
                          2⤵
                            PID:1452
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:8
                            2⤵
                              PID:1676
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3704 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:8
                              2⤵
                                PID:784
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3028 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:8
                                2⤵
                                  PID:1204
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3668 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:8
                                  2⤵
                                    PID:2308
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:8
                                    2⤵
                                      PID:896
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3568 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:1
                                      2⤵
                                        PID:2492
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2204 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:1
                                        2⤵
                                          PID:2016
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2076 --field-trial-handle=1236,i,17112031827347598412,10902949631531038227,131072 /prefetch:1
                                          2⤵
                                            PID:2216
                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                          1⤵
                                            PID:2116

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            68KB

                                            MD5

                                            29f65ba8e88c063813cc50a4ea544e93

                                            SHA1

                                            05a7040d5c127e68c25d81cc51271ffb8bef3568

                                            SHA256

                                            1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                            SHA512

                                            e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

                                            Filesize

                                            1KB

                                            MD5

                                            a266bb7dcc38a562631361bbf61dd11b

                                            SHA1

                                            3b1efd3a66ea28b16697394703a72ca340a05bd5

                                            SHA256

                                            df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                            SHA512

                                            0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            344B

                                            MD5

                                            51bba42d88c3cb246828d10cf9786e3b

                                            SHA1

                                            3d6f56fd88e08758886458b0c2cef797f4e50866

                                            SHA256

                                            497991f09714b12389651c132e33f232c7562dedf9a0ae545a05c82f970e7846

                                            SHA512

                                            65604e212f7e5bf81522975ac8b39ab5ed66e49a0c12fdd7418fab1c9e53b038a5cac7af0f36fd83497ce4f5ac1034f6fcfccb64f1a83a4b453bc6774a841f20

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

                                            Filesize

                                            242B

                                            MD5

                                            182c96a799e9416fda9bd944431ae73f

                                            SHA1

                                            3823412034a4c1422343faa7e51f8fe81d93e60a

                                            SHA256

                                            0ba80842fdd43b01e5ad1690a465598b84c3206a89f47a46c95e64eed9c729ca

                                            SHA512

                                            0e68964ac7cbb8893451fec43cc731b6a6bd54d5c5e27a25d53cccbc2415ff23f5c5c71671479f483b1d67edac3a6002bf70a9eebc092fc6a557a7b523fef7a1

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                            Filesize

                                            16B

                                            MD5

                                            aefd77f47fb84fae5ea194496b44c67a

                                            SHA1

                                            dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                            SHA256

                                            4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                            SHA512

                                            b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                            Filesize

                                            264KB

                                            MD5

                                            f50f89a0a91564d0b8a211f8921aa7de

                                            SHA1

                                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                                            SHA256

                                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                            SHA512

                                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            111B

                                            MD5

                                            807419ca9a4734feaf8d8563a003b048

                                            SHA1

                                            a723c7d60a65886ffa068711f1e900ccc85922a6

                                            SHA256

                                            aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                            SHA512

                                            f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            1KB

                                            MD5

                                            69bf0f348d8c3285f8448a9657fb07b3

                                            SHA1

                                            5b072b9a2ecd515809af82c811d187aac29b38ed

                                            SHA256

                                            fc26a990ffe81d5ebe698e876b45d102b0f41930786a4f537af593da6796712c

                                            SHA512

                                            d925f215fb1680a638d09b22c4a2575266fb7089d2772a09182c41260dbf16c1a53dc0cb2fce9df3ab068297077e315a838f7684fa8884a523bc1d796f4f2fc0

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            111B

                                            MD5

                                            285252a2f6327d41eab203dc2f402c67

                                            SHA1

                                            acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                            SHA256

                                            5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                            SHA512

                                            11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            363B

                                            MD5

                                            92ca4c585638bbc99d512f0373cbb6eb

                                            SHA1

                                            9863fdd1f09b2d853724f307c2eb1de6145243c9

                                            SHA256

                                            a3cfc5b74c6cf4ca7965d6f57a55c1dc12aa41fa69b578a0e1d446d1098dee77

                                            SHA512

                                            c584f91cac26f014b0580a5b175420f25423434c79da149b7932e688665d4f59a370951814ba1dd7f93fbd7807cfdda2df6888a296d1254f639a13b91f082fb5

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            54de4aa7ba76990ee95fa78cb47e2046

                                            SHA1

                                            9f3a92cdd89c2c5f60b092b4a9b2dfb18dfb7462

                                            SHA256

                                            f90e16cb1b24b7de0b7ebc33709ba4cbcea70263563da8da8b32920f90a3ffc0

                                            SHA512

                                            9dddfdbcc3faa5c4afb53d3671ae1f650db6dc58107caf0b53b13a2baea61e68871a5e7b42b20aafa352e892cc1ccc4e537201f0cf2208b8423dcb0c6c5a71cc

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            5KB

                                            MD5

                                            c217181c0ff5bb5e386034c3f0915196

                                            SHA1

                                            780a41c272edf2c5353c8c5465e05da99b1f4a20

                                            SHA256

                                            75d7bc74deb7fcf4a7a92fc992f2deac31a600f8c71dcdee591ce6cbbb4d2aa4

                                            SHA512

                                            50c0128fd295ad65200b5e2b5e86dd3efeec2d20d897c4d7f85c2588693614efd06254885180145c0109de3877d44088e66babd3272b2d2af40104069ad84844

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                            Filesize

                                            16B

                                            MD5

                                            18e723571b00fb1694a3bad6c78e4054

                                            SHA1

                                            afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                            SHA256

                                            8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                            SHA512

                                            43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a715dfb9-81a9-489a-8c7c-572d8ee49f04.tmp

                                            Filesize

                                            6KB

                                            MD5

                                            955eac59d1ee950f54d3b06ffd4ca59c

                                            SHA1

                                            5abdf98077e0efbcde638c1bfec5200b2b00b6a1

                                            SHA256

                                            d7274f95fe93aac3d9ff0ddcd848089e97166895d8fc4e1f34f452e04c6953d6

                                            SHA512

                                            170aae19d2c3cd8debe942575f77f22d27274befa4447bc244b0e302cb384cb3735063b303646d16a8f00e48bfc3065118e6db12b6f28881836171b1e7d3883f

                                          • C:\Users\Admin\AppData\Local\Temp\Tar8126.tmp

                                            Filesize

                                            177KB

                                            MD5

                                            435a9ac180383f9fa094131b173a2f7b

                                            SHA1

                                            76944ea657a9db94f9a4bef38f88c46ed4166983

                                            SHA256

                                            67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                                            SHA512

                                            1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a