Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
General
-
Target
file.exe
-
Size
4.2MB
-
MD5
e61852d0a596d91897c3e731f18b4ae7
-
SHA1
fa10a42495e023ae6cbd464842352cccf0d0ee28
-
SHA256
16606d62af0e28e4c9359802f1e9f329eae01edee0b31b8b84b0fbc51818a129
-
SHA512
c47dc92cd52c0efec3c993812965ad74a710ce8600f069d6d7d18c04e777682a2c77881a61443f9f4c425c79627ab6d06db0461f0622d1f0c6414eca2215a310
-
SSDEEP
98304:NdeG17aqfo5H5ar78VZ7/sDesW71J9qCotF:T17aqfQHOQ/LsY39C
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe -
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1688 chrome.exe 2356 chrome.exe 3060 chrome.exe 600 chrome.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe -
Executes dropped EXE 2 IoCs
pid Process 1008 service123.exe 1676 service123.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine file.exe -
Loads dropped DLL 4 IoCs
pid Process 2504 file.exe 2504 file.exe 1008 service123.exe 1676 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2504 file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2728 2504 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2300 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2504 file.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 3060 2504 file.exe 31 PID 2504 wrote to memory of 3060 2504 file.exe 31 PID 2504 wrote to memory of 3060 2504 file.exe 31 PID 2504 wrote to memory of 3060 2504 file.exe 31 PID 3060 wrote to memory of 2496 3060 chrome.exe 32 PID 3060 wrote to memory of 2496 3060 chrome.exe 32 PID 3060 wrote to memory of 2496 3060 chrome.exe 32 PID 3060 wrote to memory of 2840 3060 chrome.exe 33 PID 3060 wrote to memory of 2840 3060 chrome.exe 33 PID 3060 wrote to memory of 2840 3060 chrome.exe 33 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 2672 3060 chrome.exe 35 PID 3060 wrote to memory of 3052 3060 chrome.exe 36 PID 3060 wrote to memory of 3052 3060 chrome.exe 36 PID 3060 wrote to memory of 3052 3060 chrome.exe 36 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37 PID 3060 wrote to memory of 1420 3060 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6549758,0x7fef6549768,0x7fef65497783⤵PID:2496
-
-
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:23⤵PID:2672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:83⤵PID:3052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:83⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2360 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:23⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1436 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3328 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:83⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3660 --field-trial-handle=1216,i,9822910089200050210,13748574940971510064,131072 /prefetch:83⤵PID:2372
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 9682⤵
- Program crash
PID:2728
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:404
-
C:\Windows\system32\taskeng.exetaskeng.exe {B168631C-D2B5-44A7-B29D-95669BBC1D37} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]1⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2