Analysis
-
max time kernel
147s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2024, 20:13
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
General
-
Target
file.exe
-
Size
6.9MB
-
MD5
5a4bac60b4b5c2889a19197e077f0916
-
SHA1
11e3e2903c663477505f2f92dde1a09c9433c1e4
-
SHA256
a175dbaa581c7064effea9150163c84d5e6e12f975103c31dc13caeb85b62e47
-
SHA512
2cd7c793202c8779e8b4cf358d9c621589037ab99a7330353bfd346a4106b72702e61d8b115a97d4b0c9da5744c447c3ca4422fd2468fd38703d18c8d133ffce
-
SSDEEP
49152:bZxRiBLgWGClmlijd/AymvPn36POCx4yW6JjEi1WsPQfrUehh1SMQ4MKGbf6kjIS:bZuvGCdjd0P36PZqyWggiJ4DfW5Kb
Malware Config
Signatures
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 4800 chrome.exe 1640 chrome.exe 4964 chrome.exe 2664 chrome.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation file.exe -
Executes dropped EXE 2 IoCs
pid Process 1780 service123.exe 1424 service123.exe -
Loads dropped DLL 2 IoCs
pid Process 1780 service123.exe 1424 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3748 3000 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3248 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4964 chrome.exe 4964 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 4964 3000 file.exe 101 PID 3000 wrote to memory of 4964 3000 file.exe 101 PID 4964 wrote to memory of 1828 4964 chrome.exe 102 PID 4964 wrote to memory of 1828 4964 chrome.exe 102 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 4852 4964 chrome.exe 103 PID 4964 wrote to memory of 2944 4964 chrome.exe 104 PID 4964 wrote to memory of 2944 4964 chrome.exe 104 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105 PID 4964 wrote to memory of 2896 4964 chrome.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3827cc40,0x7ffe3827cc4c,0x7ffe3827cc583⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,12063272795753765707,1526384320946285617,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1972 /prefetch:23⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1592,i,12063272795753765707,1526384320946285617,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2016 /prefetch:33⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2004,i,12063272795753765707,1526384320946285617,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2260 /prefetch:83⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,12063272795753765707,1526384320946285617,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:13⤵
- Uses browser remote debugging
PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,12063272795753765707,1526384320946285617,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:13⤵
- Uses browser remote debugging
PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4420,i,12063272795753765707,1526384320946285617,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4564 /prefetch:13⤵
- Uses browser remote debugging
PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,12063272795753765707,1526384320946285617,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:83⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,12063272795753765707,1526384320946285617,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4708 /prefetch:83⤵PID:1428
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1780
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 10962⤵
- Program crash
PID:3748
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3000 -ip 30001⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424
Network
MITRE ATT&CK Enterprise v15
Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af