832654398d6aaecf7213b9b15c7c527054dd8d2a4ff14d368a657a5a1c53b2c3

Analysis

max time kernel
62s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2023 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gui/log.html
Size

604B
MD5

1a2782abf9d045bbcb20982d441d038f
SHA1

20e763832fd364aab5d32b75e82569d2455c501a
SHA256

b504cfa31c1c3309e9de6bb27042ad034af1270dddaff704ce2ca01497a90284
SHA512

4f285cc842f7da6880a1df87f34d6979184e71a3b885d52e009d113df11d7db2591c8badaa5d5628ca168cee4f16d9edb5a72b95bd749a126014c895c06bd535

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133267718010550511"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

4568 chrome.exe
4568 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4568 chrome.exe
4568 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe
Token: SeShutdownPrivilege	4568	chrome.exe
Token: SeCreatePagefilePrivilege	4568	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe
4568	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4568 wrote to memory of 4700	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 4700	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3988	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 5116	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 5116	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe
PID 4568 wrote to memory of 3088	4568	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\gui\log.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc2f8f9758,0x7ffc2f8f9768,0x7ffc2f8f9778
2⤵
PID:4700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:2
2⤵
PID:3988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:8
2⤵
PID:5116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:8
2⤵
PID:3088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:1
2⤵
PID:3480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3228 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:1
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:8
2⤵
PID:4948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:8
2⤵
PID:4196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:8
2⤵
PID:2296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:8
2⤵
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1904,i,2803701783817552637,4009763386462391076,131072 /prefetch:8
2⤵
PID:852

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2f93ca964dc576f300eced4da2b6c830

SHA1
c0d66f6954cdb48f4592f9deb92d35ce3dd06d72

SHA256
93fe3c5b62f9d7101d5c6d7d36889d6267d4830669566952b2db0b936647ced1

SHA512
94886aeb7f4a5b836e11d36c2c2431d71c59c6654f31999befe31312f0d77ef162b1de1cda18821def0aa85417f6d33d315aca109cc0f48ab5ed14faf8145902

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
cb914c54d8bc2c6286d4d8a6311ba40d

SHA1
44020c0de13b74ea7a1e23080b2a0e340ddcee83

SHA256
d3e0fcbe36402a8b558b788604ba128ddfcec872f2cad223678e23ad92205cf7

SHA512
dfa2d80c20c04cd769cea12a1df3e12245dd5f510b4543933c0e751a15e28d5d67ddd0d4b6221a667a2353bf59941349e1954df8b4a410b7032c07f13cae4193

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
3cae8ea5e534d66d8b4755e3f721cb78

SHA1
2eab817ba3f5772ca82711f252433704dca21db7

SHA256
dce9d499678bfb51bcd3398f6108e2bbaa900f00c8574ddd67360693b3afdb29

SHA512
5a6e56a43c27a0770d26591c7e910376135e1bac748e9b1a1c47a2dd486e7f2424863cc0d5f2179a92f20440058e39187dabfcd889d1919b121a730e84b72567

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
202KB

MD5
f25e40b2f583186ff3b2297534f0f0a2

SHA1
b4464cfc1b153fcbeb258266d4637e7c75dd2e14

SHA256
4f77c8c8e3f79cbc311885a5af1ee3b3bf5c15817da434f9450dc7c8e0f244de

SHA512
c55d2c4d5d48287d3369f2f20ca17f0102631782b8ac4c4d458dc389b89634ebf882bbb399ae70e9d18eff0ce702fb0dd089cdabda75fa91afec7209484adbd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
72KB

MD5
a462e9305c5c79e74d49fde3fa523cc5

SHA1
c4761c94f2740fda429767041390f258b236c9cc

SHA256
e86ca57d911c34b0913988be6a6318928b8b9cd8f2e038c9035cee113417a041

SHA512
e506f472618257fede7f84b4aabf25e6d94dc1d7fc40aa0b3f1b3cdf1cf13c3085620a50e71259db19892853a2db12c2ba12c26e130f5343ba6d6004e98451d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4568_GXRIWTJUZASJYEFQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit