Analysis
-
max time kernel
1799s -
max time network
1694s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 21:59
Static task
static1
Behavioral task
behavioral1
Sample
lp.js
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
lp.js
Resource
win10v2004-20241007-en
General
-
Target
lp.js
-
Size
3KB
-
MD5
878c2e3784f992b7bbfaf0ddf484f6c2
-
SHA1
5fc23376d19b9d4ddb0f395baae5fedf89a976a5
-
SHA256
a5f65dba9f803729ece14ca1e67ca989e24f61669bd35a4cc0b938104d9bf0b3
-
SHA512
470109e34d88b3575ed0ca23a6a20692c9e12bf490b9e76c6fcf6936cfe3e19e3e4b0c2f8a0d564be54a322913f6301d1cf7cbdf8c4429d0c74211a5c2693f2d
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2816 2760 chrome.exe 31 PID 2760 wrote to memory of 2816 2760 chrome.exe 31 PID 2760 wrote to memory of 2816 2760 chrome.exe 31 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2624 2760 chrome.exe 33 PID 2760 wrote to memory of 2236 2760 chrome.exe 34 PID 2760 wrote to memory of 2236 2760 chrome.exe 34 PID 2760 wrote to memory of 2236 2760 chrome.exe 34 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35 PID 2760 wrote to memory of 2656 2760 chrome.exe 35
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\lp.js1⤵PID:2652
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7489758,0x7fef7489768,0x7fef74897782⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1212 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:22⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:82⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:82⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:12⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1808 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:22⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3028 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:12⤵PID:708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3516 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:82⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3880 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:82⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 --field-trial-handle=1412,i,9275532664094896847,5044965350111294051,131072 /prefetch:82⤵PID:344
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD50d6930461850d5980b5caab9f42bfb3a
SHA1a65582421477c2e95dd63adfe32f178b099f0550
SHA2569afdc3c19d37ee2542f363d7b6fcdff3b681adffe28499f0fe4d9ae230a853d0
SHA512a00252f9ec0fa3af552188e0e38c9e98588bf96762a9b89528ff2141bae2728f421a80d5e9fb9ba4697a3a489f2739db9039bfd0344893d0f8e990e64c828501
-
Filesize
5KB
MD51d7f36d9aa6c5c59ed5d0d6c9d144695
SHA199372c8378e1dcb7909a1cf6aa31d40aa7d9b2cb
SHA2562e45d9a2ae5afe181c00e86f2c1445ab461be2c79c089b2373a6c1ec3bb90914
SHA512767547e6c0208e60dc132ab69f6bac1053865e64c975a25716d52ac58bcfff99edc6846c8e47cbde9fecfb40da9b297d0348c75144e563ac9c509d8cbf09de8a
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
347KB
MD55dfee2270ef86d59f0183f75fcbe1eaa
SHA1622b68f766dc6711dab191e18061e198d79751e2
SHA256330cca3076bdc93cb3c0542b302f5ba7fe6896f265ef3e2a57e9ca1bfaea4771
SHA512af1e9f08709736ba9f6a7569ab73f995a7458a211269ed0c0dee98f52b490191dbe6e22c07395a53437b63ff36a15d7fc43b4e133381457a91d42954169f024d
-
Filesize
347KB
MD5ab6eb0cb7be442f34b443dceab1d3f03
SHA11a32b6c84430b4d0bbe3a1b01fbf7bd50a4f59c0
SHA256e8db158e2d5bf88d84853c2e6a434ec2eef8942fea744ee35594a8a7c7505b76
SHA5127b2fc1967e7a523482cb86c6c05c1c31086760fbb3b47decacf260e16f152ef4f0e9304d4c3272fb0cc2ee3e4daa9c0955db2f5c9d5920c7641ba42e37fab5cf
-
Filesize
170KB
MD5b9827acfb19f4e5b5c4771b194ddfa58
SHA1a9b800b577cd0dec917346f157b431ad936d59ce
SHA256f5dd4e1b3dd5b55a380f8b9eece4fe1a06c5ac86a477c599193f642cd85b31e5
SHA512001b97b7469246843e26969a6c3ba0276dd81e68a0305560c28df310ebea4f3b9fb895e57c4aea8318e9d57320edf1fab29a542292fe9d91b1b687cc125ee366
-
Filesize
376KB
MD5a700b454f0c22e67f1edf2615a939297
SHA1522edc0219e85d8a4916d4b80b360d8643cda8bc
SHA2568c5b00537fb4bb9c89d0ebab9b2c1643cf092046b746997c4f4ea216e77bf8a5
SHA5124c6e688553c6cdd3e45fdadf950d22e1da0a2a52fea1f36704aa3d6a7616471f040e71bc1fefa6ef9e78165e02c811e81d397ea260193263722be85b35a15c64