hxxps://cdn[.]discordapp[.]com/attachments/1186715831414030426/1256963554695839775/Aristois-Free[.]zip?ex=6682ae08&is=66815c88&hm=77f5c9baba2f9ccc16ddff763ac3b30e7a9d971d63713c1db9091d52423942cd&

Resubmissions

30/06/2024, 20:35

240630-zdbd7avcna 1

30/06/2024, 20:34

240630-zceefsyajm 1

30/06/2024, 20:31

240630-za4lkavbqd 1

30/06/2024, 20:23

240630-y54dlsxfpk 7

Analysis

max time kernel
1s
max time network
118s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
30/06/2024, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1186715831414030426/1256963554695839775/Aristois-Free.zip?ex=6682ae08&is=66815c88&hm=77f5c9baba2f9ccc16ddff763ac3b30e7a9d971d63713c1db9091d52423942cd&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2868	4764	chrome.exe	71
PID 4764 wrote to memory of 2868	4764	chrome.exe	71

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1186715831414030426/1256963554695839775/Aristois-Free.zip?ex=6682ae08&is=66815c88&hm=77f5c9baba2f9ccc16ddff763ac3b30e7a9d971d63713c1db9091d52423942cd&
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc6ba29758,0x7ffc6ba29768,0x7ffc6ba29778
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:2
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:8
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1752,i,12320651071389112957,13543386968044427488,131072 /prefetch:8
  2⤵
  PID:1816

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
8a30d4b3e4599e0a02a23c202459a84d

SHA1
95731f6942c1a7cff1067684c92333761bb1fd1c

SHA256
48d01bfd49d8d438c6dfa8a3f4bd32716d3aa67c6bddc96117aa814653de4eb5

SHA512
f4f354ddc5de74f9bb55db5903026e1ef310ee5a67217805338883d1c97f3d135c376ffe201a6b3c1021cb0d3ccc55111c91d2a0391b6e22405be46d370eb61a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
8ed2d218118af015a8b883408712758c

SHA1
b410483fbf703c45ac5cb0b23b672d2a75481e89

SHA256
68eaa50eb22ae2e55d8343858f9c02df5ee412930927a00a750ebb5523b51adf

SHA512
eab3168fb25a0b84e0516f50030fbd955ccaa567c91332d3dc2059588bef61a80f67636b165c2c8e6dff32168881a47e4448a415d8db38adf59d54895fe8dcd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a674418e6d7aa5e101c34229d0d6098d

SHA1
7380ffb79c2dc4c718adb41cee17206796ff97ce

SHA256
ea3a9a5b62661643a7fab87690e02675f1fc418b2eae888c34c44e9ee384a2da

SHA512
3a57f3edcf009e2c49547327ce547088fe437f8b64a05800bf8a0e67ec135abcbfb001431b8daf1f0f446f13a9bf1e3376bbe89216bb1dbe41b3960cd2ea0712

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
8d2cbc26f9558b40503f5a7155932714

SHA1
8256f5527c49f4df655fce868945cb09750e027c

SHA256
721a7f1a5ddfa26d06c33077677ca829ee36c1f14f99015cacff9acdfa6475d8

SHA512
315be3c8c037ddb355a210c43c645a0d53356376a62be3f90b0cf360a3036a73a7a7a1d2b35f0741d11ceed558ba6ee95c5889fadad2bb69c342e53ffa8d20e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
3fbc3b5a4e7b2dc6e9db268e1d38d415

SHA1
8689673cf9356abfad5bb223b7d053a68edda439

SHA256
06047480df654ac44a6817f1c12dfc1c2014c0e22a7b33a570d154ede1de333d

SHA512
dade6c29ba57ed067387ab93398dcc21cb76493b3eee62e72b8922908fc25ea6bf61d01c0388713e8af1dcc8aead9a91c594eee7fd0d577c348276635224a299

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
168KB

MD5
d39a5f8964443884d59dd16d85004c67

SHA1
08ef1c81e5734f0175d99bfa00dd4f179c9e4cd3

SHA256
92206bd2bc012dbd4783c94abccf535aa9977328720f4dbb2f8488cf037c4210

SHA512
64dc0d19b3c24f78275c9080389bc780f434faf73a4a0d58005c00c440911de981abdbf796e3c65c84d7d1acf48fc56d03a2ce15bdcefa4a4905d4787463b671

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
c6e1348230264f7a66c3afd2cd3eec85

SHA1
61ea8e92d94f4e1997dff9c7c91df435026594e6

SHA256
ead43b594c6426549b01be353829056b96adfdc1cf5e8c661b90ea39069561c1

SHA512
ea936814d17c52bea6085f7624359e64c768d9b1a1411eeb3b20008ebb1e95a546b1249254549f0d8f6ca9b6803e01531244534d4d9e7f9f14ea10db9aabdac6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
02f61ce82452659c420040f2a1901f1c

SHA1
2b31a189051c523b6154635f116a01959159c3b4

SHA256
b3ad8590eb6c4327e9f029a89cbf017f77ed3e3f1f0c1de41119068dfdda5faa

SHA512
03c4cad066d8cadc86425136d6005176b5138183805c99692ea463f6296f37049c46d5e6497043f25e337c719d067b8f94a8aafbc3bc418fc2f4cec2fd49ee24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
4d36b38888415675f82fec5878888b95

SHA1
8bb017216abf9de4623b4507c560782cad60c55c

SHA256
6d462908d60e71db8d2c48100eb54b219fe5ca42130129b9b6b9cb83b2db084c

SHA512
8efc328a206de143ad50a7b665b30af3be0bfb650c83c56dca4be07addbafa7a390789acc32eae5d0d3cadaf01dcf8c51184bba99f558c9f6e57fad65c2a2c08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit