3e783b5a0ca45a430bfc7e7cee4d4331abd55d91e0da870daf724e24bf812b6f

Analysis

max time kernel
127s
max time network
275s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ElectronV3/ElectronV3.exe
Size

37.8MB
MD5

3b3a67fbdef30c60edace57f0879f62f
SHA1

b80ec72cd264e01798ba523fbb3cd76655663e21
SHA256

c277b4a4e4e38ec0667f01e9486eeb516caf589e24b7c573852dbc555c162666
SHA512

b1d4dba1f15ca87a1140e8ce7a21e791adbea46d525de549c46aa9128d12605e7eee1b1d4dbe5971604a5f0a2bca4a181579ecc54abcb080006f60bcd1ffe976
SSDEEP

786432:vpE/xQlr4/n82Vf0ZpGRexsQGj22uJBxffo8CXIs5qiI7/7K4rv3Fqb1:hc2lr4/n9gpGash48XIeG7/GUqb1

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2704	ElectronV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a423-47.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2088	chrome.exe
2088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe
Token: SeShutdownPrivilege	2088	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe
2088	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2704	2076	ElectronV3.exe	30
PID 2076 wrote to memory of 2704	2076	ElectronV3.exe	30
PID 2076 wrote to memory of 2704	2076	ElectronV3.exe	30
PID 2088 wrote to memory of 2900	2088	chrome.exe	32
PID 2088 wrote to memory of 2900	2088	chrome.exe	32
PID 2088 wrote to memory of 2900	2088	chrome.exe	32
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 804	2088	chrome.exe	34
PID 2088 wrote to memory of 1784	2088	chrome.exe	35
PID 2088 wrote to memory of 1784	2088	chrome.exe	35
PID 2088 wrote to memory of 1784	2088	chrome.exe	35
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36
PID 2088 wrote to memory of 1820	2088	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72b9758,0x7fef72b9768,0x7fef72b9778
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:2
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1612 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1416 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3260 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3472 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3532 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 --field-trial-handle=1320,i,14299351070684845885,18073798321165082769,131072 /prefetch:8
  2⤵
  PID:2316

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1532

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
002cd489be8f0f9fe837413d8297b1a3

SHA1
8bf06588fd38d2c5ca2a8a8cbc8ed752d2ca6ac9

SHA256
7e9ce39f1f09c719b76e3a6827df28893b68614826028b1974018cfc901499bd

SHA512
14d51a07d075a9cde93997da18d3c6ee8df44b00508e0e28270b9b4831e49523bc756d088f736a3084fcbe0f86addefec095bc25640947abbcc7f0c5ba6c2166

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
b983103a57eb9c93a9611d963bfb6116

SHA1
00b97516a56335a432f82f5664ae0410bb957555

SHA256
74f97fe2c94039183cec2ad621f9551101e948e9c4f715feeee159302efc07f5

SHA512
c819b43a7bb880b1dd7b9b8653419d8d64277c3d9fba2afb3443ff77278201f23e15a8795a34668ed42200f48a743a33f23ed90dcacb28a72cebab28abc0bbbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
d7f13fb9a4411deff47e132b23a3c7c0

SHA1
5c4e92eca8c0b753972e6b484f626df73c216fd2

SHA256
6215048dc889d67611c74ff0621a3da26bc437912e3798904671bfb583d528fa

SHA512
008ca69c397d071c1204bab18dbf01c2b98844c13386912e6cd84b520b2cca6da54c383724b986f2d8fa6af7720a06f2623f51b8be5e33cd2c412dfe7f563164

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20762\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2704-49-0x000007FEF5BA0000-0x000007FEF6005000-memory.dmp

Filesize
4.4MB

Download