Analysis
-
max time kernel
64s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 23:58
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
General
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2460 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2772 chrome.exe 2772 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2088 WMIC.exe Token: SeSecurityPrivilege 2088 WMIC.exe Token: SeTakeOwnershipPrivilege 2088 WMIC.exe Token: SeLoadDriverPrivilege 2088 WMIC.exe Token: SeSystemProfilePrivilege 2088 WMIC.exe Token: SeSystemtimePrivilege 2088 WMIC.exe Token: SeProfSingleProcessPrivilege 2088 WMIC.exe Token: SeIncBasePriorityPrivilege 2088 WMIC.exe Token: SeCreatePagefilePrivilege 2088 WMIC.exe Token: SeBackupPrivilege 2088 WMIC.exe Token: SeRestorePrivilege 2088 WMIC.exe Token: SeShutdownPrivilege 2088 WMIC.exe Token: SeDebugPrivilege 2088 WMIC.exe Token: SeSystemEnvironmentPrivilege 2088 WMIC.exe Token: SeRemoteShutdownPrivilege 2088 WMIC.exe Token: SeUndockPrivilege 2088 WMIC.exe Token: SeManageVolumePrivilege 2088 WMIC.exe Token: 33 2088 WMIC.exe Token: 34 2088 WMIC.exe Token: 35 2088 WMIC.exe Token: SeIncreaseQuotaPrivilege 2088 WMIC.exe Token: SeSecurityPrivilege 2088 WMIC.exe Token: SeTakeOwnershipPrivilege 2088 WMIC.exe Token: SeLoadDriverPrivilege 2088 WMIC.exe Token: SeSystemProfilePrivilege 2088 WMIC.exe Token: SeSystemtimePrivilege 2088 WMIC.exe Token: SeProfSingleProcessPrivilege 2088 WMIC.exe Token: SeIncBasePriorityPrivilege 2088 WMIC.exe Token: SeCreatePagefilePrivilege 2088 WMIC.exe Token: SeBackupPrivilege 2088 WMIC.exe Token: SeRestorePrivilege 2088 WMIC.exe Token: SeShutdownPrivilege 2088 WMIC.exe Token: SeDebugPrivilege 2088 WMIC.exe Token: SeSystemEnvironmentPrivilege 2088 WMIC.exe Token: SeRemoteShutdownPrivilege 2088 WMIC.exe Token: SeUndockPrivilege 2088 WMIC.exe Token: SeManageVolumePrivilege 2088 WMIC.exe Token: 33 2088 WMIC.exe Token: 34 2088 WMIC.exe Token: 35 2088 WMIC.exe Token: SeDebugPrivilege 2644 Bootstrapper.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe Token: SeShutdownPrivilege 2772 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe 2772 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2364 2644 Bootstrapper.exe 32 PID 2644 wrote to memory of 2364 2644 Bootstrapper.exe 32 PID 2644 wrote to memory of 2364 2644 Bootstrapper.exe 32 PID 2364 wrote to memory of 2460 2364 cmd.exe 34 PID 2364 wrote to memory of 2460 2364 cmd.exe 34 PID 2364 wrote to memory of 2460 2364 cmd.exe 34 PID 2644 wrote to memory of 1632 2644 Bootstrapper.exe 35 PID 2644 wrote to memory of 1632 2644 Bootstrapper.exe 35 PID 2644 wrote to memory of 1632 2644 Bootstrapper.exe 35 PID 1632 wrote to memory of 2088 1632 cmd.exe 37 PID 1632 wrote to memory of 2088 1632 cmd.exe 37 PID 1632 wrote to memory of 2088 1632 cmd.exe 37 PID 2644 wrote to memory of 2776 2644 Bootstrapper.exe 39 PID 2644 wrote to memory of 2776 2644 Bootstrapper.exe 39 PID 2644 wrote to memory of 2776 2644 Bootstrapper.exe 39 PID 2772 wrote to memory of 2164 2772 chrome.exe 41 PID 2772 wrote to memory of 2164 2772 chrome.exe 41 PID 2772 wrote to memory of 2164 2772 chrome.exe 41 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 2084 2772 chrome.exe 42 PID 2772 wrote to memory of 1564 2772 chrome.exe 43 PID 2772 wrote to memory of 1564 2772 chrome.exe 43 PID 2772 wrote to memory of 1564 2772 chrome.exe 43 PID 2772 wrote to memory of 2016 2772 chrome.exe 44 PID 2772 wrote to memory of 2016 2772 chrome.exe 44 PID 2772 wrote to memory of 2016 2772 chrome.exe 44 PID 2772 wrote to memory of 2016 2772 chrome.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2460
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\System32\Wbem\WMIC.exewmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2644 -s 11362⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6b39758,0x7fef6b39768,0x7fef6b397782⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:22⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:82⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:82⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:12⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2328 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:12⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1008 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:22⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1440 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:12⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:82⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3744 --field-trial-handle=1228,i,1222246070593369285,13299598152557016051,131072 /prefetch:12⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD59dcf96946f6db686f2139708e046111b
SHA11d684a0116b699945054766b16d76673529483f3
SHA256dcf103c4af72ce126529f8ec716340913fd58ec0b13051e215d89778d5b97910
SHA512c51b2c955976b3f04be77a0970a0be42b295e4ee4133a69501f172ff22312967eb582f2d8a087ad18c6588eaee057baa144bdcbdc73cd248430d2ab47f20a536
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
347KB
MD5f67d054ff3d3a2598898f7e94299ca20
SHA1bbb1cab4f2e7cd6621cab1a30e438d61d5b44ad6
SHA256937a081beef6323377f7cb1982276a85319b7c267a8e10026a0a6646a81e3e0d
SHA5128f107a645c0b5490b6b3997c61a21023b7e6351fcb51f13dd996d96856594d9548df4e52b3eecc6ef9929cb5928aa3b3a6475d83ee2252ca0e14a413ad5ea6bb
-
Filesize
347KB
MD58334857459e580b8b24654ca5116749f
SHA170a9a950900da5102d5b1fb266396eab00548dc2
SHA256b0468c6f62cdc78d402bd27f04e329b2bae39aa9506d2c1acce0ff0443e05138
SHA5126597412574ef98d65e334ecd162adda70c8b228d8573441f54b7848d3f09c82588741fd7b32d664af54bc67c6d76776e71ba00370f42155c805d93b840a41004