Analysis
-
max time kernel
141s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20-03-2023 23:56
Behavioral task
behavioral1
Sample
chrome.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
chrome.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
chrome.exe
-
Size
743KB
-
MD5
f59d2a3c925f331aae7437dd7ac1a7c8
-
SHA1
40b7b386c2c6944a6571c6dcfb23aaae026e8e82
-
SHA256
46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed
-
SHA512
04e0165e9b029b28c2d86659f99cb3d01246995fc4125548f68877c545daa20b36aa4824f59fc387a35a8390d6a1fe390812d38f9a3b545b61877df27d975ca5
-
SSDEEP
12288:srSPZ0yEmwXpaYcV9/H3a3jAX1lo+PJeyzOFHBBJJOi/9/AGrib4NufaWpMG8SJN:sGPKyhYp/u/H3ijALpPJmljl9/ATpMb8
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1768 chrome.exe 1768 chrome.exe 1768 chrome.exe 1768 chrome.exe 1768 chrome.exe 1768 chrome.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1512 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1512 taskmgr.exe Token: 33 1608 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1608 AUDIODG.EXE Token: 33 1608 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1608 AUDIODG.EXE Token: SeDebugPrivilege 948 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 1512 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe 948 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeC:\Users\Admin\AppData\Local\Temp\chrome.exe runrun1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1512
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:268
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5781⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:948
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1472