Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 12:15
Static task
static1
Behavioral task
behavioral1
Sample
ass.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ass.vbs
Resource
win10v2004-20240412-en
General
-
Target
ass.vbs
-
Size
1KB
-
MD5
3882c6557bbffa5d7b2c2e0a930d1ffb
-
SHA1
816c260eec9dc0d2b12f3fbc6d7684c8e3732e55
-
SHA256
63ac6addc77e66d84566218084d2e707dbfffbcf35ee07cbffeccb45ccc583fb
-
SHA512
75a8dcb980e05b3323cbbdea48e38682af4e498359fdf98518f1ac445f7fda9ec22fd485a566935c1d0a40bfd2c3c2a2f2dc7babcb4968ec24d187008644bdfd
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" reg.exe -
Disables Task Manager via registry modification
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2772 chrome.exe 2772 chrome.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
chrome.exepid process 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WScript.exechrome.exedescription pid process target process PID 2884 wrote to memory of 2932 2884 WScript.exe reg.exe PID 2884 wrote to memory of 2932 2884 WScript.exe reg.exe PID 2884 wrote to memory of 2932 2884 WScript.exe reg.exe PID 2884 wrote to memory of 2668 2884 WScript.exe reg.exe PID 2884 wrote to memory of 2668 2884 WScript.exe reg.exe PID 2884 wrote to memory of 2668 2884 WScript.exe reg.exe PID 2884 wrote to memory of 2772 2884 WScript.exe chrome.exe PID 2884 wrote to memory of 2772 2884 WScript.exe chrome.exe PID 2884 wrote to memory of 2772 2884 WScript.exe chrome.exe PID 2772 wrote to memory of 2568 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2568 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2568 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2432 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2340 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2340 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2340 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe PID 2772 wrote to memory of 2128 2772 chrome.exe chrome.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ass.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
PID:2932 -
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵
- Disables RegEdit via registry modification
- Modifies registry key
PID:2668 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/watch?v=BbeeuzU5Qc8&ab_channel=MetroGirlzStation2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef61d9758,0x7fef61d9768,0x7fef61d97783⤵PID:2568
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:23⤵PID:2432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:83⤵PID:2340
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:83⤵PID:2128
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2196 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:13⤵PID:1416
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2204 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:13⤵PID:240
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1324 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:23⤵PID:2508
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3112 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:13⤵PID:2944
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2224 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:23⤵PID:3028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3284 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:13⤵PID:1676
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3724 --field-trial-handle=1308,i,9763272926087520173,11561917941481845413,131072 /prefetch:83⤵PID:2124
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\48afb60b-3076-43bf-b470-318c0622cef9.tmpFilesize
266KB
MD57f9d3ceaf26287ac54756eb2f73ca3a5
SHA18f97cdcf5847ce039de2e410779e56bc4391d704
SHA256a73748c65f0c810ab6299b492077a24913c3bfb3103d6c73f621c0955a71f49d
SHA512789e1317f1b8aa595d2b1d66428f41ed9561e7f773ce807de3fce5d85c4a1db6116e7837fbad562d445c91ab6da0d78fb9410937bece0dbcdb76e4d03c47c26d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf7691f3.TMPFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD527ce61ab6f9eb92ef8a8beef57c8137f
SHA1887eb7cc13f788ffbd01c2a348cd924b30942e94
SHA256e28ee525bbd7c4b2a2a2df9492a18a856db5b00005281a0df6b901f2b90cfdde
SHA512ddab0fca3bff2c0cbf3664ff40903ed272e0aa0cc8d32ec7b197ef07069fb8e8257b82fc0607b1f8e0b97231c785d3b1e581b08f4364b664869b8368d147c0c4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
176B
MD5c0447bab33c6f8e1938bb82f99d9e4ba
SHA1afa465a22fecfca79fcb3b0be462334f8584798d
SHA2561fd1fb638fcaf76b2326f0ae9e04f9cfc6fb67113835dc9e1956aa89a6dc8156
SHA5126a97dce9a358ad10ef527bac64c3024b1ca8b835928e2281feb447f96be6ac389882bad6099b800e1c7aed352cb3d355a324ee4b7dc92468a50f2502d34a157b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000002.dbtmpFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
266KB
MD5ab3fe3b6b4ce329f02d4d241b02f5bb7
SHA1b69c3c1736eb6c73c293208fd4071bbe8ebb93fe
SHA2561589ac7dfd8e35ab55934963ac1b0d5935e9bb5d874de6fe1fa6dfb384e4cc22
SHA512a6e7abbd7e49c03cdf1ffed47212e30fe79618ad9a9f350eca0b2f5db87203ab45091871ff80ede3789074222b69e485a860b061ae7783b847119d6462551a7b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
\??\pipe\crashpad_2772_KQQNFUPZOJAZIYMIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e