Analysis
-
max time kernel
30s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 11:18
Behavioral task
behavioral1
Sample
Evolution.exe
Resource
win7-20240419-en
General
-
Target
Evolution.exe
-
Size
31.2MB
-
MD5
08fb33bdf4080c02ec6ba47705b56053
-
SHA1
fa357caee3c400ba3a45d7decd2839e385edb843
-
SHA256
f3a7f1289bfa4483d5fc6758a2137eb85f8cbd1c75f31574514d95bcfffd7d6a
-
SHA512
06a6ac0e9e65d3bbfc0bc1058abb71b73610e00e4405e18c0ba6dd3ee4e571477d0d8d699e033a664bae7d6466b18d70864cdaca55718f40cca85a08d7b21f10
-
SSDEEP
786432:tpbi9YQFS1QtIJ2j6+s7LWB75zuPNdS3ILn6eEFRJu++da:e9zOiIJ2qHWB75iVdSGgFebA
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2796 Evolution.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2796 2256 Evolution.exe 28 PID 2256 wrote to memory of 2796 2256 Evolution.exe 28 PID 2256 wrote to memory of 2796 2256 Evolution.exe 28 PID 2180 wrote to memory of 2384 2180 chrome.exe 30 PID 2180 wrote to memory of 2384 2180 chrome.exe 30 PID 2180 wrote to memory of 2384 2180 chrome.exe 30 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 2036 2180 chrome.exe 32 PID 2180 wrote to memory of 444 2180 chrome.exe 33 PID 2180 wrote to memory of 444 2180 chrome.exe 33 PID 2180 wrote to memory of 444 2180 chrome.exe 33 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34 PID 2180 wrote to memory of 1136 2180 chrome.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Evolution.exe"C:\Users\Admin\AppData\Local\Temp\Evolution.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\Evolution.exe"C:\Users\Admin\AppData\Local\Temp\Evolution.exe"2⤵
- Loads dropped DLL
PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7349758,0x7fef7349768,0x7fef73497782⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1116 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:22⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:82⤵PID:444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1532 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:82⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:12⤵PID:572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:12⤵PID:692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1020 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:22⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3356 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:12⤵PID:2672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3464 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:82⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3576 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:82⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:82⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3696 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:12⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3540 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:12⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:82⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2756 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:12⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3356 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:12⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:82⤵PID:284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 --field-trial-handle=1196,i,359270662050102434,13523395381314021032,131072 /prefetch:82⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
363B
MD51c957cca16afae0750fa5e4b00d7783b
SHA1626e1815e2e35d31a4fc0863da8be5f81a2c6fe2
SHA2565422d8f7aff32d683513a28b9a9e4b883cdf2bcb8db9211aec369babdcbb9821
SHA512aa23a47f94e45757fb8d1f229e3243d08a5a853f7670ac0de0d02fe84ad64f6b4439f69dfe7d1f23bc456985e7e61f9de2c34509c73edd666f739f0378ca1e92
-
Filesize
5KB
MD59182c0bb96eb1df6010759b2fc93ee36
SHA1d889407a5403583bebfdf52af820d05aec02551d
SHA2560d52654e724b2bb09d99ef5e8fecc97cc516ac6d834eda131f0ae55e5af3e6b9
SHA51241ab07d87463a314b2f5fda5ae7284dcd7d51cdcf865a6d96ffd57170381e9a542f84dd4ba704c5a92ce89c9d4f9a0aba4b5d18dc061ca301bcbb01f08f72588
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
140KB
MD5472853235f239978b69b62423f596041
SHA1202596054833840e31752da43a7a092a1383fc9f
SHA25685e63e6eea1ff4a6b7db36f902c9e5ec5e3e40b11db0f70a4f257b07161652c7
SHA5121ef3130966881c2110e9c1d8c583131293fda4c365e2e62bab826817872e48ad991740177b5c7294ba4c379aeb686bdeb08ac6e93b34c8fb9188e86444f93db2
-
Filesize
6.7MB
MD5550288a078dffc3430c08da888e70810
SHA101b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA256789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
SHA5127244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723