Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08-08-2024 10:54

General

  • Target

    https://cdn.discordapp.com/attachments/1041172158463868968/1270618733773328505/Bootstrapper_2.exe?ex=66b45b69&is=66b309e9&hm=925edf55c595c2cdc0091b1b387d02e2c071bd347b18b5cec2dcad84550d453f&

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1041172158463868968/1270618733773328505/Bootstrapper_2.exe?ex=66b45b69&is=66b309e9&hm=925edf55c595c2cdc0091b1b387d02e2c071bd347b18b5cec2dcad84550d453f&
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce1a3cc40,0x7ffce1a3cc4c,0x7ffce1a3cc58
      2⤵
        PID:3100
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2004,i,13611553820799765469,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2000 /prefetch:2
        2⤵
          PID:2228
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1724,i,13611553820799765469,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2036 /prefetch:3
          2⤵
            PID:3988
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,13611553820799765469,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2184 /prefetch:8
            2⤵
              PID:1612
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,13611553820799765469,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3108 /prefetch:1
              2⤵
                PID:1232
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,13611553820799765469,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:1
                2⤵
                  PID:3284
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4504,i,13611553820799765469,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4512 /prefetch:8
                  2⤵
                    PID:408
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4812,i,13611553820799765469,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4796 /prefetch:1
                    2⤵
                      PID:2648
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4760,i,13611553820799765469,6070642878500089327,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4804 /prefetch:8
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3268
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:4540
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:3156

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                        Filesize

                        64KB

                        MD5

                        b5ad5caaaee00cb8cf445427975ae66c

                        SHA1

                        dcde6527290a326e048f9c3a85280d3fa71e1e22

                        SHA256

                        b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                        SHA512

                        92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                        Filesize

                        4B

                        MD5

                        f49655f856acb8884cc0ace29216f511

                        SHA1

                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                        SHA256

                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                        SHA512

                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                        Filesize

                        1008B

                        MD5

                        d222b77a61527f2c177b0869e7babc24

                        SHA1

                        3f23acb984307a4aeba41ebbb70439c97ad1f268

                        SHA256

                        80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                        SHA512

                        d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                        Filesize

                        210KB

                        MD5

                        48d2860dd3168b6f06a4f27c6791bcaa

                        SHA1

                        f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

                        SHA256

                        04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

                        SHA512

                        172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        192B

                        MD5

                        616f0b235ee1d4b5dd36a7ee83e6457a

                        SHA1

                        088cd87a6ca050fa2e00125f4957223a6841aeec

                        SHA256

                        23c913b49843a9ac98f4f5b2f08a6d7523accbe76322a7280b4dbae1f01afd33

                        SHA512

                        c8c231746a6a4500ea96299dadeb64b64257c5296e0456d9db756788e32ad85a71cfb8caf41527a04bc79ef05f98344d0cf6ee7e9951ed110c52fd1e23372c34

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        19d72b44a5df8b5f8919b49780f4bcbf

                        SHA1

                        44c8aa6c8f8c29acff7643a0268c9356b199b147

                        SHA256

                        bca9e3ae8847b98cbf487d697c5930688f60ef40b29e1f0a4eae55d42a092711

                        SHA512

                        1aca369440de158282e79edd3a74d7db15e1147178da857640e7188c00554d0aa26a59311335bb311b87dd4115e3096e291757967e6ece12814b6a911de90191

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        fbee85953a42a3867dbfc5fdd43ae1bf

                        SHA1

                        343458b8185c0a4aaba29f4281e59c12491b072c

                        SHA256

                        168ae782610dc879852550ccbd8514c0a9d2fceeb51856a9e68881ce1e419b3f

                        SHA512

                        2da771057a0454b02919f4ad95e78f51df0cf6a2f274633e2e2da158872194aa66d181912ca29c5513563fcbc34c4fcd44c666034101c6fc7d004e2c5166951f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        356B

                        MD5

                        2a22b410875892d7eca4b0c6f8f43e5a

                        SHA1

                        091fbfd94512981c26310eb8812b6ef0fca4c689

                        SHA256

                        ec0ff65d84043ea3c23ca19783defd16676b4772aebbdbade2cf4665017c3490

                        SHA512

                        048f45da64c951fc6c8d621a5c787709fce0214a860563c018227cc1633f4200e7ea9a4c64ba77c3635f52ee2fbc062719207a64a7946e64750a290cdf20bb43

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        339f09fdc19293e8cfeb42189aa14eb0

                        SHA1

                        125000817d4fccf9f0f72294e4c2cef60088a86d

                        SHA256

                        a7965c92633f9d93758548710d059901f886ee28160b0a99247618f03a9c750a

                        SHA512

                        4a78a4c4e61b3b26e6a48e7c3dacfec823dbd480284a13a66a126c60f5428ecff86c13174a5735c3d5a13ae1b0e55ef9ec8e98494982f26068fbef58298de98c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        9449c289ad5a06587ef050973d9cea5e

                        SHA1

                        62764787d6740362b69c49b192265a1b15105ba9

                        SHA256

                        9c8293238b6ea52416a3ec58e852a3aca9e8460d62473e40a0bdd013b14dc353

                        SHA512

                        7882a37d22e8c2d5f6b5b050917b36082472e950fe629fcbc002832b827fe25b9f000cd9933705b689f264953687eef513e84de0ad7e794fa9c103dc23eae9ea

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        77df6b3e9b0d164ec8e002d40c06a168

                        SHA1

                        41a5f890e87e0ae82e31f660013e91881b87bfc8

                        SHA256

                        33cb983d7345e3b81ce97b9a6e3947a697605874cc985dc1ac72cdf95839b5af

                        SHA512

                        eb5389ef29312b6368cbf53d6b9b0f836922276323389e202e584479eb3b236c90d7f3486508384d9db61ed69d4faf08448acbad577764adc749b9ea23607863

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        75f709d105db892e3cc27dcc005c3548

                        SHA1

                        9b6475dcf4465cdb82f15a5d2d79671ef4c0935f

                        SHA256

                        0772bc27d718626bf5c8de8b1b932caa58eed07ee816b3a5015585b6d8be5f56

                        SHA512

                        867aacfbb77448c271ca2262b68b9845e489cb05e9e9ea92a3c0a18df9fae872262c74066e2f972784123a0336ef0f07e1aab37a1c691399451fce977f708ca1

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        93f55dce115c53e10fa8b325f49c162b

                        SHA1

                        944f606111f9d130a01ebe2dd4c7856872737b07

                        SHA256

                        1d3c042e142c8499793517bcaae511eb39109f363e10a0245d8f02c329e6ecc2

                        SHA512

                        d8b839691c5d98f2cda7db14160b0e61e654a11160e52b3ba0e6ea93d943d1a67ecffad0b128fa4fd3578539731617af130bfcedb4155b1b0a1b1d3a71f0376b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        8a6697429de08e4258136f6d5fe79ae1

                        SHA1

                        467ff43bbede340c848da6b332fb3989fb1a0e45

                        SHA256

                        a0676f3f74f0e0f88808e9be208d734f3e795ff488a9a8a530d9ea850978cef9

                        SHA512

                        2cca5b318f66329a0ed8a19b33b3b80b0c9172cfed552c3ef5df2cc1da2b734781a27c1bef3bf9750ff4a17364f99a23570b6f18dd5a640671335aa34ed2ada7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        0c90bb88cb8893d0415129527d6b9046

                        SHA1

                        2c8ec45a992e6bb0058cd12745743495af909030

                        SHA256

                        2215a1c35e51de2af3c2f10eda8e6476f8305729bfe0e613a6ca2d21a26192f2

                        SHA512

                        91935ba5a6e65fdf06b441e6006652a6004728a6efc2aaa0ac968d169896c2b0e86ae523b8e2e11ff2237c2821f9a183f02bd40c7d1c6aa463f82fafd1ab9e6c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        5d8c9c99c58ba148fe800533da7cad46

                        SHA1

                        059b15fcab531e49c26a9d502f379d15f97b253a

                        SHA256

                        50655f249455ceb959e490f38d06951f2c782e37e9473b6e9aa176e7aed897cf

                        SHA512

                        dd170ccddc497b3e3b04fe9c9af9ad6f25771b4091f9b5ada10e7ff365ef736ec8b442d9597f136a811d16a000ac8d083c6baabdca009d03113dec208adc713a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        13340382e13e4928b7ba402d0b46317b

                        SHA1

                        80ebcd9119843de97df30d2d4abd363047de5ee7

                        SHA256

                        a77167ad251f9af2e5bea11a6c1f669c70fec3f946ccf41d5b1daa9edefeb257

                        SHA512

                        d5c6e87592ef4da127a76caa1b4c5f489743f87e6eb54d6f08646a2b323b83496b411e162596a03abe075ba24542577440ea2597fc3528be99dd20a9f28ab0d9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        53cd50b69131d9cf4bc235cb3b7fa2cd

                        SHA1

                        b374b944153cc84bc99016c10c6b143b2d382121

                        SHA256

                        c0905b7f515177d364bf5b0ac71abf3af52c14ed5080b2e4269697d9d0c89a17

                        SHA512

                        d2989808339f66a26c68777395dfa674c7aec1b4f0eadfa00a5b4764db894b79381764b28b304f5a9d6f49218a4a1c52e36fdfd69344305e5fcc01b64da403c9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        8b00c82e56eba4c9449e35a6426edaab

                        SHA1

                        fcc4e330fb06ceffac924782c10ddbd9c992dab4

                        SHA256

                        4986d63356ff37f66bf6836a8add83616a328724068464a15b3353ff47eae297

                        SHA512

                        f75138834614862f507093fda4afb24304153d417716e4465890fd3f89f162d71038250fd3c4071992856f4991ac7923ff45f352af33044a6d6272a560407c1a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        e4c6a376d7c3ddaccdf784977c6b60a5

                        SHA1

                        b2d857a1789d1c13340e7a5fa41c78911ce9fe76

                        SHA256

                        779b9f3761647e615b80fab20423e2aa9c4633388f06efd3542de3d993508fb1

                        SHA512

                        7d0eeb302512a923350fd7f8aa2eef286e97ac7af1b14508d00852a21806c12d0264cbe93a90b308e9b250be8e455a26c778a609324d9b117deb71404acfa170