Resubmissions
19/05/2023, 20:14
230519-yz2b3afh92 6Analysis
-
max time kernel
5s -
max time network
7s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
19/05/2023, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
gah.gif
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
300 seconds
General
-
Target
gah.gif
-
Size
178KB
-
MD5
7f9a62642ed33591f41109673e356b88
-
SHA1
4b480d4e64d0561a0a756c0f95f7b2336e8a6c14
-
SHA256
009e4fdcb12c8da1976adbea36a893c0e71fb779754e5a8f0b8284a687e584c8
-
SHA512
e03de7e2d210ceea18b7177767b3c4871acb99f40a06e4908db985382c0ce0c11f76fd6219f8943659cf1f4a662d585ab63257c4d8170757fc23207a23d21042
-
SSDEEP
3072:I8H9nOwWlWY9EWD6VOqIjsN/usVu9JdiwisEIiz+1Vd2Lm5bQHxciPT:I8H9OwY9JOoFgdVuNiwi8vVkmJCeAT
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4100 chrome.exe 4100 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4100 chrome.exe 4100 chrome.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4100 wrote to memory of 1008 4100 chrome.exe 66 PID 4100 wrote to memory of 1008 4100 chrome.exe 66 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 4388 4100 chrome.exe 69 PID 4100 wrote to memory of 3844 4100 chrome.exe 68 PID 4100 wrote to memory of 3844 4100 chrome.exe 68 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70 PID 4100 wrote to memory of 4708 4100 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\gah.gif1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc33ec9758,0x7ffc33ec9768,0x7ffc33ec97782⤵PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1856 --field-trial-handle=1796,i,17454133306540237059,9018168586127573793,131072 /prefetch:82⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1796,i,17454133306540237059,9018168586127573793,131072 /prefetch:22⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1708 --field-trial-handle=1796,i,17454133306540237059,9018168586127573793,131072 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1796,i,17454133306540237059,9018168586127573793,131072 /prefetch:12⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1796,i,17454133306540237059,9018168586127573793,131072 /prefetch:12⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
570B
MD5dcf125435524c0635986d863567cf0ac
SHA12de5ce678494a2d07510deeeaa32eac0f6c6351d
SHA2567f7201a8fafa73a5c7a36dfdecc07e0a20788b6d4f8951b7f64095f0d44e0b07
SHA5120176cc8fce40837e90280abebb1f40b22b61fffcb65195ee177f41c62eb7f3c6daf0b5183067d16b9e7700ce882cce69a17e438b3a56b8ea77360bd92383c023
-
Filesize
5KB
MD568b3c742107c7d82d34438dc4ac0b5ec
SHA1ad87162dba444b4a25a6b100acea4c05d2cd72c4
SHA25623b1f1e2401d49fdc6c545cf55e69b127927518acac2b5074771f138cf1219bc
SHA512a06926b7456aebde524cf552912699ccb21f7022e99f87c23a9922fc932beb43fddf3402412bc1fc367d35278e051451ee8e1ae1a35a1b5dc1906287e93a1e5a
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
72KB
MD5138a42ff102ea0dea962d9c1854e7fad
SHA139d3bd06006c93bd39e9c3b097052316c16ea0c6
SHA256ae559a4a4c245ee45115c347f139c4aaf95e3f7380938a945be82b084bc9a6ae
SHA5123b589ac9b2e735e99f88b77b1187645bfc02a6d04006ce57b9f837a9cd788bef96da04b6e4576bd8598ed016ae32dfdfc80c96b9442f9f831e5b011c36c0a33f
-
Filesize
153KB
MD599a6de88426326aeedb78b50474b8365
SHA1b36d12bd02198a981d85719b8575999135ebc67f
SHA256081d3c7c536b4c534ed232ce7d737b2ad9aab50930e6632e5acd8bf8f2d0a28a
SHA512b593931311023629e76d2984a4785b7c61b214decfb88a91da884bd04bdc167fc7c28f03d40b7e6aee64ff76e8d57a111d0d994cd4a0ed7c78fcbf0fe0ea11fe