Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 21:27

General

  • Target

    file.exe

  • Size

    4.2MB

  • MD5

    e61852d0a596d91897c3e731f18b4ae7

  • SHA1

    fa10a42495e023ae6cbd464842352cccf0d0ee28

  • SHA256

    16606d62af0e28e4c9359802f1e9f329eae01edee0b31b8b84b0fbc51818a129

  • SHA512

    c47dc92cd52c0efec3c993812965ad74a710ce8600f069d6d7d18c04e777682a2c77881a61443f9f4c425c79627ab6d06db0461f0622d1f0c6414eca2215a310

  • SSDEEP

    98304:NdeG17aqfo5H5ar78VZ7/sDesW71J9qCotF:T17aqfQHOQ/LsY39C

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8bdffcc40,0x7ff8bdffcc4c,0x7ff8bdffcc58
        3⤵
          PID:756
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,11093913421944396869,1898375457848801853,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1904 /prefetch:2
          3⤵
            PID:428
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,11093913421944396869,1898375457848801853,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2148 /prefetch:3
            3⤵
              PID:1464
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,11093913421944396869,1898375457848801853,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2584 /prefetch:8
              3⤵
                PID:1096
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,11093913421944396869,1898375457848801853,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3204 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:4692
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,11093913421944396869,1898375457848801853,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3316 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:3308
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4252,i,11093913421944396869,1898375457848801853,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4280 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:4904
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4576,i,11093913421944396869,1898375457848801853,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4532 /prefetch:8
                3⤵
                  PID:220
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4500,i,11093913421944396869,1898375457848801853,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4744 /prefetch:8
                  3⤵
                    PID:1396
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2600
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:2100
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1300
                  2⤵
                  • Program crash
                  PID:2456
              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                1⤵
                  PID:1032
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4084 -ip 4084
                  1⤵
                    PID:4588
                  • C:\Users\Admin\AppData\Local\Temp\service123.exe
                    C:\Users\Admin\AppData\Local\Temp\/service123.exe
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4112

                  Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • memory/2600-71-0x0000000073B40000-0x0000000073C74000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/2600-70-0x0000000000050000-0x0000000000062000-memory.dmp

                          Filesize

                          72KB

                        • memory/4084-10-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                          Filesize

                          10.4MB

                        • memory/4084-19-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-6-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-7-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-8-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-9-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-0-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-5-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-4-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-3-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-56-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-58-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-69-0x0000000000960000-0x000000000154C000-memory.dmp

                          Filesize

                          11.9MB

                        • memory/4084-2-0x0000000000961000-0x0000000000BD8000-memory.dmp

                          Filesize

                          2.5MB

                        • memory/4084-1-0x0000000077A14000-0x0000000077A16000-memory.dmp

                          Filesize

                          8KB

                        • memory/4112-82-0x0000000000050000-0x0000000000062000-memory.dmp

                          Filesize

                          72KB