23ab38a52ae8e57e58bf37e2655aed5e72ddace6f9512130a1907b57f899f332

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/05/2023, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1467224019-54d447ac41a88-walterdef.jpg
Size

34KB
MD5

7ad1f35c39c99b0ef64f94e03eded87e
SHA1

ae5e301c0212b6b3953273bf1ca05083d5888817
SHA256

23ab38a52ae8e57e58bf37e2655aed5e72ddace6f9512130a1907b57f899f332
SHA512

2cf3974e33126cc057c65cf80aecfb37148655d2ced692dbdcc31a932b6d33d93d60a9e8791026d5b914ed59c8ec5cd691b9cf4180f7adf15427c72fb40cc208
SSDEEP

768:jylhEYlQZag6TLZXY1RJi4ULp2BMJzgDheCn0+pjqBteox:jyfQj2ZXORJi4ULpCMuhWteox

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe
Token: SeShutdownPrivilege	1316	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1084	rundll32.exe
1084	rundll32.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe
1316	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1860	1316	chrome.exe	28
PID 1316 wrote to memory of 1860	1316	chrome.exe	28
PID 1316 wrote to memory of 1860	1316	chrome.exe	28
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 600	1316	chrome.exe	30
PID 1316 wrote to memory of 1576	1316	chrome.exe	31
PID 1316 wrote to memory of 1576	1316	chrome.exe	31
PID 1316 wrote to memory of 1576	1316	chrome.exe	31
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32
PID 1316 wrote to memory of 1976	1316	chrome.exe	32

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\1467224019-54d447ac41a88-walterdef.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7469758,0x7fef7469768,0x7fef7469778
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:2
  2⤵
  PID:600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2208 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1432 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1492 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3800 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3916 --field-trial-handle=1328,i,18370767115029373280,12448314406332613190,131072 /prefetch:8
  2⤵
  PID:2112

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
878b95516a990efa492153c3a6378675

SHA1
47a4f5add47d1712be4b7c2244a48ce5b41281a5

SHA256
aefe08fff673f98ab96286b9ba757677e43e4fa9806fc8abfe54faf2cb51c617

SHA512
42f99900c345139e352e2d0c3e2ecddd9e507458d205b685dd252f76b36989843053c33ccfbaf02e9db495f602a28c5312f34960bb089ded6c0d7923a1e1c75d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF6d19d8.TMP

Filesize
4KB

MD5
123d83fafd45f646e0deac8bd246ad03

SHA1
074e097cd9ac321865c1ccef6f94c133604699a4

SHA256
2954589c51d49e4f7cb704eb961e11cb87754ce6d3715ef0e7d56b75aed808bf

SHA512
0607b20262b83cdb794489130822bff53e2e41f589f91e4d7a4f45ccce284bbcf83c7a6d9eafdef0a4e2f1f30a5c22c267c4758d1c6e738932c621985dbed962

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
memory/1084-54-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download