Behavioral Report

Analysis

max time kernel
80s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:36

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

Capita TI_About Us_pdf.html
Size

626B
MD5

83d05193a82114efbe2ddbcdc99b41ab
SHA1

055b15d460f44e6373fbd499917c82df60220fff
SHA256

9cf6cff0455cc91d0358d00961ecc42129579723dd79cc6bb0d6b45998915705
SHA512

7318a9cb045acec2fc5e0c6e7b763273da3027d95e11e3dc1cd10ef19e2d559feb7c8d4167e1cd996bf14cb7881730983620290de3190ed90a3fbca9426de50b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
4768	chrome.exe
4768	chrome.exe
4928	chrome.exe
4928	chrome.exe
3532	chrome.exe
3532	chrome.exe
2372	chrome.exe
2372	chrome.exe
1048	chrome.exe
1048	chrome.exe
3396	chrome.exe
3396	chrome.exe
3604	chrome.exe
3604	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid process

4928 chrome.exe
4928 chrome.exe
4928 chrome.exe
4928 chrome.exe
4928 chrome.exe
4928 chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

Processes:

chrome.exe

pid	process
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4928 wrote to memory of 4844	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4844	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4488	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4768	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 4768	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe
PID 4928 wrote to memory of 2796	4928	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\Admin\AppData\Local\Temp\Capita TI_About Us_pdf.html"

Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory

PID:4928

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa68f54f50,0x7ffa68f54f60,0x7ffa68f54f70

PID:4844

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1728 /prefetch:2

PID:4488

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2328 /prefetch:8

PID:2796

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1

PID:1948

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1

PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1

PID:636

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:8

PID:4752

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4840 /prefetch:8

PID:4960

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:3532

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4980 /prefetch:8

PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3884 /prefetch:8

PID:4360

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:8

PID:5104

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1

PID:3964

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3732 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:1048

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:3396

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2844 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:3604

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1

PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1

PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=ppapi --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5168 /prefetch:3

PID:5040

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5636 /prefetch:8

PID:2168

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,13866122039966881846,12497806660954481783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2776 /prefetch:8

Suspicious behavior: EnumeratesProcesses

PID:1664

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

PID:4592

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Query Registry

T1012

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_4928_PJGIRTFNUAKSEQXF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit