ccd0fc615fa0ba25e61c2a6a57b97b07d97057e662d083a6707bcdd41cfc2dd2

Analysis

max time kernel
96s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2-OptiCraft Vanilla.bat
Size

3KB
MD5

7ed050a3d9bc74a14f002e83f2cba8b8
SHA1

280a91de7a064b62e8ea84f248e005cf1cef3616
SHA256

ccd0fc615fa0ba25e61c2a6a57b97b07d97057e662d083a6707bcdd41cfc2dd2
SHA512

6a69b0687035094eca71ca2d05fd17fe17a05e8c6c53b8f0135be83f6c9a5d49562bf8d0333152d70f8a264fc98169ea3e59f3b4ce95d48bce66bc2c3cc91210

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	chrome.exe
1068	chrome.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeDebugPrivilege	1324	ehshell.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1728	1068	chrome.exe	31
PID 1068 wrote to memory of 1728	1068	chrome.exe	31
PID 1068 wrote to memory of 1728	1068	chrome.exe	31
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2292	1068	chrome.exe	33
PID 1068 wrote to memory of 2876	1068	chrome.exe	34
PID 1068 wrote to memory of 2876	1068	chrome.exe	34
PID 1068 wrote to memory of 2876	1068	chrome.exe	34
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35
PID 1068 wrote to memory of 2596	1068	chrome.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\2-OptiCraft Vanilla.bat"
1⤵
PID:2280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7f29758,0x7fef7f29768,0x7fef7f29778
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1312,i,16360775187510182480,12106235752696544117,131072 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1036 --field-trial-handle=1312,i,16360775187510182480,12106235752696544117,131072 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1312,i,16360775187510182480,12106235752696544117,131072 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2108 --field-trial-handle=1312,i,16360775187510182480,12106235752696544117,131072 /prefetch:1
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2128 --field-trial-handle=1312,i,16360775187510182480,12106235752696544117,131072 /prefetch:1
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1324 --field-trial-handle=1312,i,16360775187510182480,12106235752696544117,131072 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1340 --field-trial-handle=1312,i,16360775187510182480,12106235752696544117,131072 /prefetch:1
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 --field-trial-handle=1312,i,16360775187510182480,12106235752696544117,131072 /prefetch:8
  2⤵
  PID:928

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:828

C:\Windows\ehome\ehshell.exe
"C:\Windows\ehome\ehshell.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /SkipFUE /RemoteOCXLaunch /SuppressDialogs
  2⤵
  PID:1556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e8
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9144d016-c940-4507-a0f2-4d95cdfa489a.tmp

Filesize
324KB

MD5
5e6c7e815da490f8dcdc7efcaf6fa863

SHA1
222f4ca1180980baa1461790d9fe982d3fcce973

SHA256
ab3c1cfa829956097bb305e13c3fcd5d270c17b383991526bbd9e74723ae5df0

SHA512
4ace4ed22e89c0a9df41a2816a71c8ec7f90872406180f43f173ba2f08d4dc92de45de31ba4974a96b3b3510d1aedb2ecfd4584d65fdbe17891771cae7c4af34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5e63e866d0b15e159f7cd292e54c8e14

SHA1
665aebac0670cefeb1d60d972b8f36ffc96e29fc

SHA256
08cd53c27a1467b8930bc24bf856bb345017efb57779139073d432062815042f

SHA512
5362eb12aad31d07599b87693365c29c619ca1e8686f6a273872527d761420277c0ee118679a5f7bb4cf7a28b6bef440b103dd2d41fbb5e464961197c7941a72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
324KB

MD5
b7efbf2f2faa6c7201877aae7312d8ca

SHA1
e253d7c9cb814f4ca6800d45fd71e68ba265a8a1

SHA256
b2c2b6ea3fcb0a764b7bcb4cf2724d377c90f1f711b9254fb41dc2ed0803b0ac

SHA512
5302a565e90d75901c297afdcba23031e949009f67759927f06ebe0dd34491fa70997c7ea18700986947f1afa2697ffbc3745e69633c857bc6e39b87ae8ac3d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
162KB

MD5
ba2856b42b642d35dc782e73ef6d98c0

SHA1
2aae7e368c38c5b4bed44d6aa180f4ed24236109

SHA256
0331164e76ae90c093773ea68232951ff3d6ab7ce457e3f6d7af0c356649f794

SHA512
af811cb6aad33beb1a1d9486291c22ab27ec3c8f9f0d0a2d3b31f76b0920efc1495947b2e8c28b14e97b0c6eb9644ca42a36d993a58687d0b671063b0125a5b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\{209D17EA-BE24-41DF-B255-B7DA164C1A5B}.jpg

Filesize
23KB

MD5
fd5fd28e41676618aac733b243ad54db

SHA1
b2d69ad6a2e22c30ef1806ac4f990790c3b44763

SHA256
a26544648ef8ceffad6c789a3677031be3c515918627d7c8f8e0587d3033c431

SHA512
4c32623796679be7066b719f231d08d24341784ecfd5d6461e8140379f5b394216e446865df56e05b5f1e36962c9d34d2b5041275366aeabcd606f4536217fe4

Download Submit
memory/1324-76-0x000007FEF492E000-0x000007FEF492F000-memory.dmp

Filesize
4KB

Download
memory/1324-83-0x000000001BCF0000-0x000000001BD8E000-memory.dmp

Filesize
632KB

Download
memory/1324-87-0x000007FEF492E000-0x000007FEF492F000-memory.dmp

Filesize
4KB

Download
memory/1324-88-0x000007FEF4670000-0x000007FEF500D000-memory.dmp

Filesize
9.6MB

Download
memory/1324-84-0x000000001E150000-0x000000001E208000-memory.dmp

Filesize
736KB

Download
memory/1324-82-0x000000001EDD0000-0x000000001EF54000-memory.dmp

Filesize
1.5MB

Download
memory/1324-81-0x000000001E7C0000-0x000000001EDC8000-memory.dmp

Filesize
6.0MB

Download
memory/1324-77-0x000007FEF4670000-0x000007FEF500D000-memory.dmp

Filesize
9.6MB

Download