0b3fcce21c7df51cd88bbfb9de77e17bafd85e8614b30d2f7fcb90624fd2e8c7

Analysis

max time kernel
24s
max time network
58s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EXT.exe
Size

17.2MB
MD5

cc6f02b774b0961ceb94a8a4834ca04a
SHA1

13a71dda01a40c8c92c2414e88fa5fe5ad5e8f19
SHA256

0b3fcce21c7df51cd88bbfb9de77e17bafd85e8614b30d2f7fcb90624fd2e8c7
SHA512

f47882eebf1074940f7d8b2e236fc96feaa3aa5e143af77a1b98bdd57b65abcab42127830f0b65d42ffb63087e9e71503585d00e22dba645029d200c21573e8f
SSDEEP

393216:nEk/+4uSQUJWQsUcR4NzQW+eGQRe9jo7BGeiGH1mzrwrFeOC3MALY:n3+RnUYQFIW+e5Re9M/swraLY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1712	EXT.exe
1712	EXT.exe
1712	EXT.exe
1712	EXT.exe
1712	EXT.exe
1712	EXT.exe
1712	EXT.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
720	chrome.exe
720	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1712	2756	EXT.exe	28
PID 2756 wrote to memory of 1712	2756	EXT.exe	28
PID 2756 wrote to memory of 1712	2756	EXT.exe	28
PID 720 wrote to memory of 588	720	chrome.exe	30
PID 720 wrote to memory of 588	720	chrome.exe	30
PID 720 wrote to memory of 588	720	chrome.exe	30
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1784	720	chrome.exe	32
PID 720 wrote to memory of 1688	720	chrome.exe	33
PID 720 wrote to memory of 1688	720	chrome.exe	33
PID 720 wrote to memory of 1688	720	chrome.exe	33
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34
PID 720 wrote to memory of 864	720	chrome.exe	34

C:\Users\Admin\AppData\Local\Temp\EXT.exe
"C:\Users\Admin\AppData\Local\Temp\EXT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\EXT.exe
  "C:\Users\Admin\AppData\Local\Temp\EXT.exe"
  2⤵
  - Loads dropped DLL
  PID:1712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6eb9758,0x7fef6eb9768,0x7fef6eb9778
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:8
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2300 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1320 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:2
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3204 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3432 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3584 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 --field-trial-handle=1304,i,8073577597178067126,8731255842182896098,131072 /prefetch:8
  2⤵
  PID:2624

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2316

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
16eb1c991633ad2601f312747cc078a8

SHA1
28ca9c444c33f825d36a18a860eccaac9c7c6a1b

SHA256
218266e094e67fdca08206920490ee5f11c490285231af39d297c29f27fb5306

SHA512
37aa5bb163d38ce7d8a85d388963483d0233e209383ac2152788c36914f15e6447f8d2ee5f1223a78e445758cf9baff32aeac26b0fe4a6e96a32e3d24a140675

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27562\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
3473bc217562594b5b126d7aeb9380e9

SHA1
b551b9d9aa80be070f577376e484610e01c5171a

SHA256
0d8190fd619feb20df123931108d499132f7051f1ebb0ef246082f4c52c88b22

SHA512
036b93457ade632ad68264d81ff26ee1156038e234c606882386d6babcbe722a18e9ced1655f97caecaf5fd514e261dafe999a3e9fec00cc677e177f0bf8e203

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27562\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
50abf0a7ee67f00f247bada185a7661c

SHA1
0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

SHA256
f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

SHA512
c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27562\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
953c63ef10ec30ef7c89a6f0f7074041

SHA1
4b4f1ff3085fded9dbd737f273585ad43175b0a3

SHA256
c93954167c12e15b58ac95240d2e0a2fbd94561d739d9f6aca906d9c30453496

SHA512
b4534785e4d02ad387e3c6082884d438cc4b3cd8758aabcf99620052f5842dbd298351bc1723c274d4f7d3fce0cc940df3d47865fece2f07cdb1151376ba852e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27562\python312.dll

Filesize
6.6MB

MD5
5c5602cda7ab8418420f223366fff5db

SHA1
52f81ee0aef9b6906f7751fd2bbd4953e3f3b798

SHA256
e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce

SHA512
51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27562\ucrtbase.dll

Filesize
1.1MB

MD5
3b337c2d41069b0a1e43e30f891c3813

SHA1
ebee2827b5cb153cbbb51c9718da1549fa80fc5c

SHA256
c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

SHA512
fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27562\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
0414909b279ea61ca344edbe8e33e40b

SHA1
4ece0dabe954c43f9bd5032de76ec29c47b22e10

SHA256
05b0c773a77850f3d50ddb4b82cc4d5f19316fe1aaa65e21b4709ae73f60a28e

SHA512
edbd33540cd1ef69f2ce824cfb991903ec6e4edda815f07d610247594ceeb2ebc78f05a44b4de8c5c937191b7e8b2ef221423c06df303d73deea721c25d15eed

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27562\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
b1ba47d8389c40c2dda3c56cbed14fc5

SHA1
2eef9ffa32171d53affa44e3db7727aa383f7fac

SHA256
c7277c05dc6b905fad5cb930b0ecfbbc4676b46974b4571e54ca44cb6f6be404

SHA512
466e31f17f73bda5149343b23f4966502a8597d2a2e43f9a6c9c32387451d92c6b658ccaae27044e68e4a9fd0ef9c89e32dc7639d59fcf04c596b6abfa09658b

Download Submit