Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2024, 18:00
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
General
-
Target
file.exe
-
Size
6.8MB
-
MD5
facce1c977e6ad7a85a601602af026a8
-
SHA1
22b401eb9d7c1996c8830cd082f013b8db4b12a8
-
SHA256
dfdc63994c85f7161e25a26b762835781ce5578c6a5b5c2839324fc7faa591d3
-
SHA512
3b530cfdc84b42dd2413805b65f697bda70aeadfb4b058e55ac2ec21e6b2f55e6d9ff5e9a18d91e0508f35508841ede351d98f915a581bf649da6feb6366bbdc
-
SSDEEP
49152:K4O/KlhMfZVTtu3zGUfEk/5QHdPKA3yCvhQ0F7QqlZeFhThKa9aK6bPcZ+HP7ke:K43MZVsztskBQ9PviC5nF/+3gKtZ+v
Malware Config
Signatures
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5064 chrome.exe 4864 chrome.exe 1948 chrome.exe 216 chrome.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation file.exe -
Executes dropped EXE 2 IoCs
pid Process 4876 service123.exe 2012 service123.exe -
Loads dropped DLL 2 IoCs
pid Process 4876 service123.exe 2012 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4080 4840 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2012 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 5064 4840 file.exe 98 PID 4840 wrote to memory of 5064 4840 file.exe 98 PID 5064 wrote to memory of 4188 5064 chrome.exe 99 PID 5064 wrote to memory of 4188 5064 chrome.exe 99 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 2192 5064 chrome.exe 100 PID 5064 wrote to memory of 1176 5064 chrome.exe 101 PID 5064 wrote to memory of 1176 5064 chrome.exe 101 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102 PID 5064 wrote to memory of 1636 5064 chrome.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc7b2dcc40,0x7ffc7b2dcc4c,0x7ffc7b2dcc583⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,314327420825658876,14416994799072543658,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1908 /prefetch:23⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2160,i,314327420825658876,14416994799072543658,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:33⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,314327420825658876,14416994799072543658,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2476 /prefetch:83⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,314327420825658876,14416994799072543658,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:13⤵
- Uses browser remote debugging
PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,314327420825658876,14416994799072543658,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3268 /prefetch:13⤵
- Uses browser remote debugging
PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4584,i,314327420825658876,14416994799072543658,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4300 /prefetch:13⤵
- Uses browser remote debugging
PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4648,i,314327420825658876,14416994799072543658,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:83⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4528,i,314327420825658876,14416994799072543658,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4880 /prefetch:83⤵PID:3952
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4876
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 16362⤵
- Program crash
PID:4080
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4840 -ip 48401⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012
Network
MITRE ATT&CK Enterprise v15
Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1