Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 20:13

General

  • Target

    file.exe

  • Size

    6.9MB

  • MD5

    5a4bac60b4b5c2889a19197e077f0916

  • SHA1

    11e3e2903c663477505f2f92dde1a09c9433c1e4

  • SHA256

    a175dbaa581c7064effea9150163c84d5e6e12f975103c31dc13caeb85b62e47

  • SHA512

    2cd7c793202c8779e8b4cf358d9c621589037ab99a7330353bfd346a4106b72702e61d8b115a97d4b0c9da5744c447c3ca4422fd2468fd38703d18c8d133ffce

  • SSDEEP

    49152:bZxRiBLgWGClmlijd/AymvPn36POCx4yW6JjEi1WsPQfrUehh1SMQ4MKGbf6kjIS:bZuvGCdjd0P36PZqyWggiJ4DfW5Kb

Malware Config

Signatures

  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef8189758,0x7fef8189768,0x7fef8189778
        3⤵
          PID:2648
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:2064
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1208 --field-trial-handle=1280,i,5683781143959504282,1193237565047763141,131072 /prefetch:2
            3⤵
              PID:1636
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1576 --field-trial-handle=1280,i,5683781143959504282,1193237565047763141,131072 /prefetch:8
              3⤵
                PID:2632
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1280,i,5683781143959504282,1193237565047763141,131072 /prefetch:8
                3⤵
                  PID:2868
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2212 --field-trial-handle=1280,i,5683781143959504282,1193237565047763141,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:2176
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2224 --field-trial-handle=1280,i,5683781143959504282,1193237565047763141,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:820
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1432 --field-trial-handle=1280,i,5683781143959504282,1193237565047763141,131072 /prefetch:2
                  3⤵
                    PID:644
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1424 --field-trial-handle=1280,i,5683781143959504282,1193237565047763141,131072 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:1012
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3560 --field-trial-handle=1280,i,5683781143959504282,1193237565047763141,131072 /prefetch:8
                    3⤵
                      PID:2324
                  • C:\Users\Admin\AppData\Local\Temp\service123.exe
                    "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2756
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:2840
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 776
                    2⤵
                    • Program crash
                    PID:2572
                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                  1⤵
                    PID:2184
                  • C:\Windows\system32\taskeng.exe
                    taskeng.exe {1DB321CE-7C3B-4349-9430-CFA48F01D1B2} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
                    1⤵
                      PID:2668
                      • C:\Users\Admin\AppData\Local\Temp\service123.exe
                        C:\Users\Admin\AppData\Local\Temp\/service123.exe
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2608

                    Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                            Filesize

                            264KB

                            MD5

                            f50f89a0a91564d0b8a211f8921aa7de

                            SHA1

                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                            SHA256

                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                            SHA512

                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                            Filesize

                            16B

                            MD5

                            18e723571b00fb1694a3bad6c78e4054

                            SHA1

                            afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                            SHA256

                            8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                            SHA512

                            43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            335KB

                            MD5

                            eb3ea0714cbf76cbbbb13b0c52aed392

                            SHA1

                            27da6e8151e1957f2fd9b2332844fccd40d0c5cb

                            SHA256

                            53bf13a44624b203f6076f1c498fdd2615400dbb445d865ab56fb4ccb39e0219

                            SHA512

                            542a2fdd7f19a409322738c654dd583ea97f442c1b27aea1f7eb4396244d55d3ad205b9faad746fa17850d1ca2dd6d832a160d7dccec4665f597f52ff7716b5a

                          • memory/2608-91-0x0000000001090000-0x00000000010A2000-memory.dmp

                            Filesize

                            72KB

                          • memory/2756-92-0x0000000001090000-0x00000000010A2000-memory.dmp

                            Filesize

                            72KB

                          • memory/2756-93-0x0000000074510000-0x0000000074644000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/3052-0-0x0000000000C00000-0x00000000012EB000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/3052-6-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                            Filesize

                            10.4MB

                          • memory/3052-15-0x0000000000C00000-0x00000000012EB000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/3052-86-0x0000000000C00000-0x00000000012EB000-memory.dmp

                            Filesize

                            6.9MB