Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2023, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
phish_alert_sp2_2.0.0.0.eml
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
phish_alert_sp2_2.0.0.0.eml
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
email-html-1.html
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
email-html-1.html
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
lfmg.png
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
lfmg.png
Resource
win10v2004-20230220-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
email-html-1.html
-
Size
2KB
-
MD5
535915bdb6b829980cbc6411bfe2c756
-
SHA1
5e1dcafb1479036ba0d64aa27e29c826c99d5022
-
SHA256
2aa57848097c336be4bd455eeb35263b918f162bb962e1b2ab1e775b272953e7
-
SHA512
f78f74f4fd8b76aea461fb07ce68e089b2a3a99d28b4a20fc24b8bb352278be464d53f77269f3fb9483c53f817e593fb43cd20acccb2eeb5dd150eb41048b93a
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133263163355005347" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1368 chrome.exe 1368 chrome.exe 4092 chrome.exe 4092 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1368 chrome.exe 1368 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2204 1368 chrome.exe 84 PID 1368 wrote to memory of 2204 1368 chrome.exe 84 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 85 PID 1368 wrote to memory of 1896 1368 chrome.exe 86 PID 1368 wrote to memory of 1896 1368 chrome.exe 86 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87 PID 1368 wrote to memory of 4812 1368 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\email-html-1.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffbd3bc9758,0x7ffbd3bc9768,0x7ffbd3bc97782⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1812,i,11798928842586341833,9806623385883285581,131072 /prefetch:22⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,11798928842586341833,9806623385883285581,131072 /prefetch:82⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1812,i,11798928842586341833,9806623385883285581,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3188 --field-trial-handle=1812,i,11798928842586341833,9806623385883285581,131072 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1812,i,11798928842586341833,9806623385883285581,131072 /prefetch:12⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1812,i,11798928842586341833,9806623385883285581,131072 /prefetch:82⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1812,i,11798928842586341833,9806623385883285581,131072 /prefetch:82⤵PID:776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1812,i,11798928842586341833,9806623385883285581,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4220
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5c14f1498e64d82044e285a27623a59a8
SHA19d2d5a594d68e6f46b2f0849610edd065216beb0
SHA25622afc15449a185b8435b9a3afcb115f4fd5ff293e1edba8f30a946a4117fd2dc
SHA512e4d7ed56dbdf91166ef39ea61ded4a18de97bb5be0c9ae283c2c5762f1ce0fece983c51e7717128b4230138048a74629760bc09d5172d3ced3a2a46746d255de
-
Filesize
5KB
MD5b7041ed52aa1eebca388f6c5cb88f630
SHA148fc82db22e7f802f6d62056155989ec2ee0082b
SHA2564027ed1c5c6724be6df66fb66b9d98a2c29b4f32225fb30b6ecae9b2da24a2d1
SHA5127e4b4dd63025d746a8ba32b3ae71927b40c436ce0f219a2d4c92e72948616d36c002fc19f677b0bfe40e63f1027a8f2e3fd49ae3aec3b3c6a305b81dc5a491d0
-
Filesize
5KB
MD5d39bdab4d3c822d5c5cfe91737fa0e2a
SHA193c901df4782627ee573df6d55f4f31694b874ea
SHA256eeb4ae5dc1856844335239043dc07e397ca47a95554612f5ac21153a4302e7d4
SHA5127c8ab8da834ac71face1bcf5e69309d75fa48ead9f1e243677012ff62b260f3b2dff2414f28a4c018b99140da4eb057c58abfe8c6457cf7ab9f9e0bb8380c09a
-
Filesize
199KB
MD5a77797216bc6d0ab4ad6997cb891a0ed
SHA195486132d74138f6461fd78b5e62919c1e4d33b3
SHA2566f4c9fec86533b2a4bf0758ce6f316d79d92c9e78f762fe94185d19f055a5078
SHA5128869a0a5a3a87cc4cbcb72aa1230f0505401c65161a62d90b4b620dea07bb967f4234bd548c6e9a949a62a2ae5bd4690657d0b9c2e2e0509dbb1e3d8a42cb004
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd