55b81c16beda606292ae831ffb53b4b99743de87563b9da576516104252abda1

Analysis

max time kernel
16s
max time network
140s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-05-2023 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bec4733.html
Size

1KB
MD5

7f2ab1b742b76d0f7d9d9f9f8c1e438f
SHA1

b32fff0c232a83c56372e53f2a92a31127404c42
SHA256

55b81c16beda606292ae831ffb53b4b99743de87563b9da576516104252abda1
SHA512

7e92640f5c1e0a6e59852e45786272f300582ccb07cc802b8184e928a4410f853c9496e0e951317d65a2fc1486db16ef45b3e0a4c9e04531a4f9d49de7eb5322

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	chrome.exe
1344	chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1696	1344	chrome.exe	27
PID 1344 wrote to memory of 1696	1344	chrome.exe	27
PID 1344 wrote to memory of 1696	1344	chrome.exe	27
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 816	1344	chrome.exe	29
PID 1344 wrote to memory of 1508	1344	chrome.exe	30
PID 1344 wrote to memory of 1508	1344	chrome.exe	30
PID 1344 wrote to memory of 1508	1344	chrome.exe	30
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31
PID 1344 wrote to memory of 900	1344	chrome.exe	31

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\5bec4733.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef71a9758,0x7fef71a9768,0x7fef71a9778
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:2
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:8
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2236 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2244 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1172 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1240 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3864 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1836 --field-trial-handle=1220,i,14688728470727101051,923572331883666989,131072 /prefetch:1
  2⤵
  PID:2308

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2515ca8060d103980715bd2fb72e1cfb

SHA1
0e67f6f02c04ab44e99b9a4d12ee8f859043563f

SHA256
9c13615a57c326579e6b24477b006d4aefeecb90122c5272749ffa9fb2ffd1f9

SHA512
dcdc7c9eac2234098a421258c1cb292ad74aee159a4aec37fadd876c2dafd6b2d4f854b4207bb57298dcf5b5cf6068faaf08b31f33ea354e1d8ec327a6163524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
97ef839123d27f08f85c52097eb7f719

SHA1
0d28a6257cc73ebc140f46873c22741724e9da03

SHA256
7329420cd0cec1d43c0000d78504ac33b4d9c6947a6e3a82b6b0d6f2d02b6586

SHA512
40f99a01870c3685455699cf26e86b4c157b6e02f50b76d47ffcce33dac57d566d6a082d8ba5cd59c4b3281a0cec6157b44e6ab7c342100d47641cdf971b378e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b39a9eef46eca2a37ed80a520fc69107

SHA1
02fdf883741c5b00e17aa1e8ce19e2916e37a099

SHA256
84fa730eb8c62c181dd808257c03bf58d373ebae6b176d36288e32553abb24ce

SHA512
df2ee23d7204a94679975702f51cd2f42ade43f4f2c4c86242b2b6da2799ef200ef2b79ad31468ce4f1a6f3eb7fcd600689e42f39fa1227cdba7b257856ec9c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8ccd8a0ca50bc8720305224fb70dc17c

SHA1
8386f5bfcffdfdfedc6ca443bda4f3c356c83bb4

SHA256
ae7991c32becca06095b46b3c92bc3a59f6ebe18bb208a70eeef0b68813418b6

SHA512
15f77c92b49dcbdd51bb2172184e9a63e1e48ec70a067d2623e0e9dc4418a179991a20c543b2b2b69473089217a1b1dedf85c08ff2811733f4a389027a9ca210

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
1dfff08c14681aea484c33d0c81a6f2d

SHA1
e835564a58858f216b9ef97e746f9c47f1a83317

SHA256
daf0127c4f68fa15c8295b683562d087e7687ff825bbc5bc1831d189e34f6a50

SHA512
2a0e5210a8fb3707ed7880e5825e7b5d0845020c35feb87b64fcc595cff6f4464eba7811e5df09d050135dc1749c71afd7f0bbad7064188bed5237e0ff1c5faf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
5c4c44db4c868d47b76f28f22883a6fa

SHA1
677882a389a387081f85cc8631bd53c6328ef114

SHA256
e29fb7480a128ffa0e229e851fa061cde70f3e8dd708b774af596a1a00d947fd

SHA512
c2908304414f7a352bf77fa71780eed98b3e4457104a3ccc218b19a07f6b72c0dd4aad1126f4fd22deb627f6120a818473a629608348aaca56374e1f3bc7a1e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
b34a6127512927641d289fb59bc7fa28

SHA1
8cc2205aafc72083eecab3f7229b3f73759ce52e

SHA256
5199d5e48dd7c4c2e6c9a0ecbfc349f3bf792923dc981a0b9e3a4e5b9586c0b8

SHA512
91c8607bedb00c8f46570539bb955f87911dd87acabfa6b1bb99fdd4bd6b56d7eaee4a5be23cb3da7423740defcc414357914cb05b615c99755236ac29841143

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4905.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B4D.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit