bd0c7aee9ac9c415b44371e4c3b0c6d34058b25c3dfaad3a927f692fe2b65ff3

Analysis

max time kernel
22s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2023 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

547KB
MD5

6e5381f92be816c614e5393e00054ae2
SHA1

4d06ea37fbdd969415bab91a28a3268701e7f209
SHA256

bd0c7aee9ac9c415b44371e4c3b0c6d34058b25c3dfaad3a927f692fe2b65ff3
SHA512

c1ab2e3a54d3a5406b1185d9760ba76c01148f60c8b6ff15b3c9be158af082f58f719c0926e41d91635a5754972f21eea32d147b4d74c32ff19d2f1b19cef26f
SSDEEP

12288:rG2u5SO1+UQ39o/fHY76LluS2tvBQ2hXTetZlS2YAhy:rG2u5SO1+UQ39o/fHY7dS2dBQ2hXTeTg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1460	chrome.exe
1460	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1804	1460	chrome.exe	84
PID 1460 wrote to memory of 1804	1460	chrome.exe	84
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 4412	1460	chrome.exe	85
PID 1460 wrote to memory of 1428	1460	chrome.exe	86
PID 1460 wrote to memory of 1428	1460	chrome.exe	86
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87
PID 1460 wrote to memory of 3240	1460	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa662a9758,0x7ffa662a9768,0x7ffa662a9778
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1804,i,2140135601246915311,3599615618208826964,131072 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1804,i,2140135601246915311,3599615618208826964,131072 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1804,i,2140135601246915311,3599615618208826964,131072 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1804,i,2140135601246915311,3599615618208826964,131072 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1804,i,2140135601246915311,3599615618208826964,131072 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4536 --field-trial-handle=1804,i,2140135601246915311,3599615618208826964,131072 /prefetch:1
  2⤵
  PID:3104

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
40KB

MD5
a2730501cf232fd712793b82a4b5ba19

SHA1
10f07229d1f817ffe66c74c3d59e9fa19c2d8852

SHA256
dabc003b191559dd009a4b05ef73ec18068e109826ae084d9b936e7283c5bcd7

SHA512
06eba2e1f597d2ec0174a1b3fc3eeebae8eab92fa39dfaf9b299019079772dbc1de5dd36e8b0c60616d31eaf6afd2554a2b37ac2c26c8dd325c6c2cc9ecc12ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
a4d5f5230ab30a2cd5adafdb736c8f52

SHA1
74ab63b9caff55625432cf1ddc415cc9a9dde51e

SHA256
906ed901245cd3faddb4e5c6b6f5ddf83b0ea5d9922d3f418f86eed2c726042c

SHA512
ea5b28aafd12f39f7bcd55211c453ebfa5f0cbf27378c650cdb41838552b6533f84e18963222d002895e095d8e484b421db48f7b6f71c11dab8811c800e07a44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3656d68869883ed79782e287aa148a44

SHA1
58efbfb908bd1858ee3285d329a5d504ae0e3838

SHA256
374b9f00bb5cfb2d700dd5e38191e6b8c3487c728d8460cd0b60cc0dbc379cbe

SHA512
b5f966c008e47fc2267acd540e9cae137e6a64f78d100edc92ef234623e74c08d07146af68df2f1aaeb99e069923353d7e27015f5bc8bd64c9047dd4b5797285

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
6543b569789399685728af805c18c941

SHA1
2d5eeb2057ec5736d1e856aad50c649cb291b082

SHA256
333f065295d916f0cc3c8f31d8c7a8c4c06f3f263c987c44f334b9862c238f71

SHA512
d014e967eb54127682984499b5dbeb119bbebbbe8fa63287c7079f8aff6fa02fce36dee26f652b2a2f7c89b56de5809d590abeffe1b64b694906b6d59f2c12a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
7a67e57a496a7d3f5701b6b7baa67d05

SHA1
d71e169a50c9af8b6410a55a4b38ef7489a77123

SHA256
91d42b21afbc020896d93202aa0bd54fc9fc732d07df81ec6471164ce15a44ce

SHA512
baf4bcb79496316185ff71be18a7a7c07197be47793f18db3f6415dbb601ecb4ad2cf35590fd98fcfd289e109641a4d5a8710bd7ce4ae513d628e7379a393cd1

Download Submit