Analysis
-
max time kernel
51s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 16:26
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20241007-en
General
-
Target
Built.exe
-
Size
6.6MB
-
MD5
79477b79441378ba1d3e2108460530c2
-
SHA1
e150dbbf3a3a35999fcc301f6d44807cf48d96ac
-
SHA256
57ee6c06c7d1d61da8fc502a10cefd2a2e69f2e30d2df148add19fcd79953f38
-
SHA512
57e258877662089763414b089c702dc904338d688871149f63cd86f6dcbce777b12bab44aaf4f626a27d0648244fbed4b56038e68912e462df6d0581ce206b45
-
SSDEEP
196608:1Cf8DOYjJlpZstQoS9Hf12VKXMSEkblC1V7:RBpGt7G/Mynbm7
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 2724 Built.exe 2724 Built.exe 2724 Built.exe 2724 Built.exe 2724 Built.exe 2724 Built.exe 2724 Built.exe -
resource yara_rule behavioral1/files/0x00050000000196ac-72.dat upx -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 596 chrome.exe 596 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe Token: SeShutdownPrivilege 596 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe 596 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2724 1984 Built.exe 30 PID 1984 wrote to memory of 2724 1984 Built.exe 30 PID 1984 wrote to memory of 2724 1984 Built.exe 30 PID 596 wrote to memory of 2968 596 chrome.exe 32 PID 596 wrote to memory of 2968 596 chrome.exe 32 PID 596 wrote to memory of 2968 596 chrome.exe 32 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 768 596 chrome.exe 34 PID 596 wrote to memory of 1960 596 chrome.exe 35 PID 596 wrote to memory of 1960 596 chrome.exe 35 PID 596 wrote to memory of 1960 596 chrome.exe 35 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36 PID 596 wrote to memory of 2224 596 chrome.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"2⤵
- Loads dropped DLL
PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7289758,0x7fef7289768,0x7fef72897782⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 --field-trial-handle=1380,i,17519673550002680897,5275995170972788131,131072 /prefetch:22⤵PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1380,i,17519673550002680897,5275995170972788131,131072 /prefetch:82⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1380,i,17519673550002680897,5275995170972788131,131072 /prefetch:82⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2352 --field-trial-handle=1380,i,17519673550002680897,5275995170972788131,131072 /prefetch:12⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2384 --field-trial-handle=1380,i,17519673550002680897,5275995170972788131,131072 /prefetch:12⤵PID:704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1196 --field-trial-handle=1380,i,17519673550002680897,5275995170972788131,131072 /prefetch:22⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1576 --field-trial-handle=1380,i,17519673550002680897,5275995170972788131,131072 /prefetch:12⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 --field-trial-handle=1380,i,17519673550002680897,5275995170972788131,131072 /prefetch:82⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
633B
MD5ca6b0f50b7565e3e81cf6f2e099cf85c
SHA14b89793ff16676410207e63652fb3b10f4ef9b8e
SHA256740724412bfe1ecb5210d40faa2a76c9f05ea466221f5cbcfd079bcec0c627da
SHA512280ebef83628e2f4111dac837c0acb1cb7fb53049b62750e78919688e1c4b8922cf347050326cb66bcdeb97c76e7b81ce80b66f4c071c238cddcfbc3d1b375ff
-
Filesize
5KB
MD5de686942d7e3b5fd0a498a9b9d3edc5b
SHA16c11d3c6cd169b04651661c5721f7b2bcd8dc9c7
SHA2567047a2a32faa44f89d1a0b81a2ba2e756fc0d9f0a10907c74bdc206a74e00cbd
SHA5120da9fb08023d99788b8b2161d591bd404efb298bfd8c3763cc16841ab371af33a204c27e3be2a927570c994011d66aabdf00fc82f1138f680ab4816642c6c267
-
Filesize
5KB
MD53c87a1881d024c8854c8765c8054c04d
SHA1b728817493742b47edf3eb2cc357210e388d98a6
SHA256ff92b196a74d35272429460443c12e9489dcc3e3b0c860cd60dfb8d41ae0191f
SHA512f9f2c3351690be99c705539096777a00e8712431c6bbb7c6f84e6bc20166712945667222790f41dbd041cc78e765ad5897eefd878b6064f1ff3216072bc9132a
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
21KB
MD51c58526d681efe507deb8f1935c75487
SHA10e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA5128edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1
-
Filesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
Filesize
21KB
MD5724223109e49cb01d61d63a8be926b8f
SHA1072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA2564e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA51219b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c
-
Filesize
21KB
MD5517eb9e2cb671ae49f99173d7f7ce43f
SHA14ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA25657cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be
-
Filesize
21KB
MD5d12403ee11359259ba2b0706e5e5111c
SHA103cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA5129004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0
-
Filesize
1.4MB
MD5b93eda8cc111a5bde906505224b717c3
SHA15f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba
-
Filesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd