Analysis

  • max time kernel
    1245s
  • max time network
    1694s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2024 20:01

General

  • Target

    bin/NativeTrainer.dll

  • Size

    211KB

  • MD5

    e107b94ae23ec9a56bfa1faaf7118e85

  • SHA1

    191d9a3a09ee0cfc0754226988c0373a5f074068

  • SHA256

    f2302573ced45cdaaf190f332deeafd3f32e179d7e9102d939608a9ab774b3cf

  • SHA512

    86720525ebfa76628a4540a0344de29cf7135ed89dc0c38665fcc2d9ea83c0a2b9341f7d8945e54083317e2dbbb120c68afeb4a7cbbe182db5711c3638d04e90

  • SSDEEP

    3072:UPjp1DjzsOn9DTtDs5hmmFlPV1GuV1YTrsof+/3YFoYr6SXvfVd5u:UbbD/PFTK3mydcuDa40iYr6SXTo

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\NativeTrainer.dll,#1
    1⤵
      PID:2812
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d59758,0x7fef6d59768,0x7fef6d59778
        2⤵
          PID:2848
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:2
          2⤵
            PID:580
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:8
            2⤵
              PID:628
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1540 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:8
              2⤵
                PID:1308
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2136 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:1
                2⤵
                  PID:1716
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2148 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:1
                  2⤵
                    PID:2616
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2220 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:2
                    2⤵
                      PID:2184
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3056 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:1
                      2⤵
                        PID:836
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:8
                        2⤵
                          PID:3012
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3844 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:1
                          2⤵
                            PID:2368
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3964 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:8
                            2⤵
                              PID:2792
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4012 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:8
                              2⤵
                                PID:2372
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:8
                                2⤵
                                  PID:664
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4088 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:8
                                  2⤵
                                    PID:2360
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2460 --field-trial-handle=1612,i,15252901985912298563,13968284421338227944,131072 /prefetch:8
                                    2⤵
                                      PID:2452
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:2888

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                      Filesize

                                      16B

                                      MD5

                                      aefd77f47fb84fae5ea194496b44c67a

                                      SHA1

                                      dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                      SHA256

                                      4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                      SHA512

                                      b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      f50f89a0a91564d0b8a211f8921aa7de

                                      SHA1

                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                      SHA256

                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                      SHA512

                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      02a0fcb65eddacd79115ecc36935f2c9

                                      SHA1

                                      2e940c9684914c4d1d9d54f151f3e314001037f5

                                      SHA256

                                      db816c5ce1d290a3a4dda8e8e059ee06fa1d431d0256773706603425e6686a26

                                      SHA512

                                      832d960d44a9ab0c6cec92406814f8ddd8f157f73be544f1bae49638c3c244b4ac53c501c86c2ff26238632b9422a20e582db45760fc4500d5c4ec5634e94490

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      e6f426821eed95b2f6f6892db192a0e6

                                      SHA1

                                      ea8161fc8df8e4dcf46e24373b2f4ccee507ae2b

                                      SHA256

                                      8d172887d4ad8e313116acf5c1b7a57714ad1e6ec7776795592aff44ff7407c9

                                      SHA512

                                      6a549f99c1ed1f0c5e4e23545684087e7f2eb5939230a15e79b572017576bcb86eca64319ad3f07a29d441957ace6b67905aff31af690921f49d07108e6f3ae3

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      363B

                                      MD5

                                      1189f1a2fc74aafad0a7886055cd6032

                                      SHA1

                                      094d046b99de13a510681d56379df9d21a3ba137

                                      SHA256

                                      b28cf4bfd5f4aa676a2653fb465e786f25e99219a16274c60c82407142ac58a7

                                      SHA512

                                      759b222600e9cab048ca552a10ab676d3c9d75adafd97db9f5073779d2ea18a223e4bedd7d823b8410fee15f7233e6bd97e3b908ea0692f21a8557e509b3b404

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      72b3a2a74b2e3b9525cca530fe8ed309

                                      SHA1

                                      d8a9e9bdd409c0d1b3639b8a19ee8788c2656380

                                      SHA256

                                      213b7ce0c97cf339663d2c0febc67970fd17f2fd807bd66a86d275415b1577c1

                                      SHA512

                                      03c4dd024c3a591542a1e73bf12b9f4f45e5268b3e39e5880279db1358ddfb65b9fdf4e48c85142b6e3ca5c5df5f724b74b1f0a0d6738128ff15d511eafa878f

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      9a818c960559776844426873b26e852b

                                      SHA1

                                      5b136158a89c6de453abc35f85f3174b5698735a

                                      SHA256

                                      ff94a387fc51c4712c45834c9b68463182bbf781d44b8411c5f8a9c291043e14

                                      SHA512

                                      893ab5e24c7712965d8765bb99723ae7730ba441115f03891de9941a051f006516ed58d1dfbb5a98d2653ca3f824637df9e36a5c7fd6626b5093db97e9c76066

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      54d21f77e017f354610b50c2a9f5025b

                                      SHA1

                                      e5a2d3e424721d32fca9f3eeef2c886981f899ac

                                      SHA256

                                      048c3a5f489d65dc19782238397663fae3123d80c469593adf5eaf9b1537e9f8

                                      SHA512

                                      bd82d7390c13c6a69b8ae45483cbf39844b4989142afb25abca0592052f574dcf5c08fdc6e3521cd711fb3fcb1ba145ee5d16f3b197383373740fc36357d7195

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                      Filesize

                                      16B

                                      MD5

                                      18e723571b00fb1694a3bad6c78e4054

                                      SHA1

                                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                      SHA256

                                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                      SHA512

                                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      347KB

                                      MD5

                                      484f28a0c8a49a30a1a6454d20f8c6dd

                                      SHA1

                                      5b33defdb87f910a9e6a3a2b97e8b468339232f9

                                      SHA256

                                      e7857cd306117350393afae88e981a95f50aa30ace275eff08563fad87c39865

                                      SHA512

                                      5872474c84b4055e73ce73bb2ea8fdef64d71acc6f0213044ce28e05c3e5bbe3bbedd4dcde34f58f50d0b19479bdc6636c4c5025de795d7a3218a3b9b721a648

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      334KB

                                      MD5

                                      d8c001cdb94ac2bf2cf84af3b7b10318

                                      SHA1

                                      a6ed503804f854cad0197cc9e24d0fa9ec11417c

                                      SHA256

                                      2cbafcfe70b1b8e6443ff9b1c0dbd360ea364c376069d340f94548b3857409f8

                                      SHA512

                                      d0af946a052608fed4f5c34944293b7b35cce21a4021c0e8491c782a89377675c2a923a93652f093c617b1383c43f1b94424d048222669c14e98f6640c6188f8

                                    • C:\Users\Admin\AppData\Local\Temp\CabD71F.tmp

                                      Filesize

                                      70KB

                                      MD5

                                      49aebf8cbd62d92ac215b2923fb1b9f5

                                      SHA1

                                      1723be06719828dda65ad804298d0431f6aff976

                                      SHA256

                                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                      SHA512

                                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                    • C:\Users\Admin\AppData\Local\Temp\TarD741.tmp

                                      Filesize

                                      181KB

                                      MD5

                                      4ea6026cf93ec6338144661bf1202cd1

                                      SHA1

                                      a1dec9044f750ad887935a01430bf49322fbdcb7

                                      SHA256

                                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                      SHA512

                                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                    • C:\Users\Admin\Downloads\Rutherfordium.exe

                                      Filesize

                                      268KB

                                      MD5

                                      c662389dd97b2d0f2db4bb934a3e56c9

                                      SHA1

                                      b8af9a043affe159abd3706fa229cb25ef34432c

                                      SHA256

                                      18d22aee54f3b07e884c0b710131806ad0ff28b8c42cf444f7778c2bf2a4b425

                                      SHA512

                                      4c1c810976d0ab21d06af45dab12fcba4952886916f4f89fe6b8fb4165d845b22e390e0ca8107ad6cd2ab3da54e2593c26677f5267c23fe6843c53267bebbbfc