d724f14b97cc137255e050d3143e15d503fba115c7c3a3358c3f6e3807408497

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zeip.html
Size

206B
MD5

acb17fcfab38f28872df2dc71ca7977e
SHA1

e88b6e90b5b7cad00a564eaef2d712a9531cd0a9
SHA256

d724f14b97cc137255e050d3143e15d503fba115c7c3a3358c3f6e3807408497
SHA512

5a2eeddbef6dc8ef7a1f67f4bf2b7e6e721b0e6ab155810ea3e4c723d54399cd6020078d8a4389b59e3afabb30485a7509b5c4d0e3521bb559471d9f15896ed0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4772	chrome.exe
4772	chrome.exe
1128	chrome.exe
1128	chrome.exe
3088	chrome.exe
3088	chrome.exe
452	chrome.exe
452	chrome.exe
4092	chrome.exe
4092	chrome.exe
4576	chrome.exe
4576	chrome.exe
452	chrome.exe
452	chrome.exe
4704	chrome.exe
4704	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe
1128	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3612	1128	chrome.exe	81
PID 1128 wrote to memory of 3612	1128	chrome.exe	81
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 3540	1128	chrome.exe	84
PID 1128 wrote to memory of 4772	1128	chrome.exe	85
PID 1128 wrote to memory of 4772	1128	chrome.exe	85
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86
PID 1128 wrote to memory of 2764	1128	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Users\Admin\AppData\Local\Temp\Zeip.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f47e4f50,0x7ff8f47e4f60,0x7ff8f47e4f70
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1152 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7311297831761559151,10696749485447575906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads