Analysis
- max time kernel
135s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2023, 02:29
Static task
static1
Behavioral task
behavioral1
Sample
ChatGPT4.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ChatGPT4.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target ChatGPT4.exe
- Size 10.9MB
- Sample230603-cykr2afb95
- SHA256 2fc949e23c1f908288f59ee5f760cb3d7634bb1cb473072916eb770c69c553d5
- MD5 2cefa380de4493783aba97a50fee9a7f
- SHA1 8a70e11e29739079e4f3425ef4f3692801e92033
- SHA512 6efd5ccb47ee49072aa0777455e8845e78ea070abc1d9fb0bffeb061ae9b20226027a388023b381093cddb3774d323e6d71e1486ac8a247296eb0d0c5f270a5a
- SSDEEP 196608:WoTlRxfE99KNqO2pb8KNkr26Wt2EpfbV0tO1Z0JEFVpOiG5pAt6mF:HTXm99KNqOgFNkr2d4EpfbqtO7t7ljtd
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 7 IoCs
pid Process 4732 MsiExec.exe 4732 MsiExec.exe 4732 MsiExec.exe 4732 MsiExec.exe 4732 MsiExec.exe 4732 MsiExec.exe 4732 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: ChatGPT4.exe File opened (read-only) \??\J: ChatGPT4.exe File opened (read-only) \??\M: ChatGPT4.exe File opened (read-only) \??\P: ChatGPT4.exe File opened (read-only) \??\Y: ChatGPT4.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: ChatGPT4.exe File opened (read-only) \??\I: ChatGPT4.exe File opened (read-only) \??\Q: ChatGPT4.exe File opened (read-only) \??\U: ChatGPT4.exe File opened (read-only) \??\Z: ChatGPT4.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: ChatGPT4.exe File opened (read-only) \??\H: ChatGPT4.exe File opened (read-only) \??\L: ChatGPT4.exe File opened (read-only) \??\T: ChatGPT4.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: ChatGPT4.exe File opened (read-only) \??\R: ChatGPT4.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: ChatGPT4.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: ChatGPT4.exe File opened (read-only) \??\W: ChatGPT4.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: ChatGPT4.exe File opened (read-only) \??\V: ChatGPT4.exe File opened (read-only) \??\X: ChatGPT4.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: ChatGPT4.exe File opened (read-only) \??\N: ChatGPT4.exe File opened (read-only) \??\O: msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\New ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\tabback ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\cmdlinkarrow ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\insticon ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\removico ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\completi ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\repairic ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\banner.jpg ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\lzmaextractor.dll ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\custicon ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\exclamic ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\info ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\Up ChatGPT4.exe File opened for modification C:\Windows\SystemTemp\shi9129.tmp ChatGPT4.exe File created C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\dialog.jpg ChatGPT4.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ChatGPT4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ChatGPT4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ChatGPT4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ChatGPT4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ChatGPT4.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1496 msiexec.exe Token: SeCreateTokenPrivilege 4740 ChatGPT4.exe Token: SeAssignPrimaryTokenPrivilege 4740 ChatGPT4.exe Token: SeLockMemoryPrivilege 4740 ChatGPT4.exe Token: SeIncreaseQuotaPrivilege 4740 ChatGPT4.exe Token: SeMachineAccountPrivilege 4740 ChatGPT4.exe Token: SeTcbPrivilege 4740 ChatGPT4.exe Token: SeSecurityPrivilege 4740 ChatGPT4.exe Token: SeTakeOwnershipPrivilege 4740 ChatGPT4.exe Token: SeLoadDriverPrivilege 4740 ChatGPT4.exe Token: SeSystemProfilePrivilege 4740 ChatGPT4.exe Token: SeSystemtimePrivilege 4740 ChatGPT4.exe Token: SeProfSingleProcessPrivilege 4740 ChatGPT4.exe Token: SeIncBasePriorityPrivilege 4740 ChatGPT4.exe Token: SeCreatePagefilePrivilege 4740 ChatGPT4.exe Token: SeCreatePermanentPrivilege 4740 ChatGPT4.exe Token: SeBackupPrivilege 4740 ChatGPT4.exe Token: SeRestorePrivilege 4740 ChatGPT4.exe Token: SeShutdownPrivilege 4740 ChatGPT4.exe Token: SeDebugPrivilege 4740 ChatGPT4.exe Token: SeAuditPrivilege 4740 ChatGPT4.exe Token: SeSystemEnvironmentPrivilege 4740 ChatGPT4.exe Token: SeChangeNotifyPrivilege 4740 ChatGPT4.exe Token: SeRemoteShutdownPrivilege 4740 ChatGPT4.exe Token: SeUndockPrivilege 4740 ChatGPT4.exe Token: SeSyncAgentPrivilege 4740 ChatGPT4.exe Token: SeEnableDelegationPrivilege 4740 ChatGPT4.exe Token: SeManageVolumePrivilege 4740 ChatGPT4.exe Token: SeImpersonatePrivilege 4740 ChatGPT4.exe Token: SeCreateGlobalPrivilege 4740 ChatGPT4.exe Token: SeCreateTokenPrivilege 4740 ChatGPT4.exe Token: SeAssignPrimaryTokenPrivilege 4740 ChatGPT4.exe Token: SeLockMemoryPrivilege 4740 ChatGPT4.exe Token: SeIncreaseQuotaPrivilege 4740 ChatGPT4.exe Token: SeMachineAccountPrivilege 4740 ChatGPT4.exe Token: SeTcbPrivilege 4740 ChatGPT4.exe Token: SeSecurityPrivilege 4740 ChatGPT4.exe Token: SeTakeOwnershipPrivilege 4740 ChatGPT4.exe Token: SeLoadDriverPrivilege 4740 ChatGPT4.exe Token: SeSystemProfilePrivilege 4740 ChatGPT4.exe Token: SeSystemtimePrivilege 4740 ChatGPT4.exe Token: SeProfSingleProcessPrivilege 4740 ChatGPT4.exe Token: SeIncBasePriorityPrivilege 4740 ChatGPT4.exe Token: SeCreatePagefilePrivilege 4740 ChatGPT4.exe Token: SeCreatePermanentPrivilege 4740 ChatGPT4.exe Token: SeBackupPrivilege 4740 ChatGPT4.exe Token: SeRestorePrivilege 4740 ChatGPT4.exe Token: SeShutdownPrivilege 4740 ChatGPT4.exe Token: SeDebugPrivilege 4740 ChatGPT4.exe Token: SeAuditPrivilege 4740 ChatGPT4.exe Token: SeSystemEnvironmentPrivilege 4740 ChatGPT4.exe Token: SeChangeNotifyPrivilege 4740 ChatGPT4.exe Token: SeRemoteShutdownPrivilege 4740 ChatGPT4.exe Token: SeUndockPrivilege 4740 ChatGPT4.exe Token: SeSyncAgentPrivilege 4740 ChatGPT4.exe Token: SeEnableDelegationPrivilege 4740 ChatGPT4.exe Token: SeManageVolumePrivilege 4740 ChatGPT4.exe Token: SeImpersonatePrivilege 4740 ChatGPT4.exe Token: SeCreateGlobalPrivilege 4740 ChatGPT4.exe Token: SeCreateTokenPrivilege 4740 ChatGPT4.exe Token: SeAssignPrimaryTokenPrivilege 4740 ChatGPT4.exe Token: SeLockMemoryPrivilege 4740 ChatGPT4.exe Token: SeIncreaseQuotaPrivilege 4740 ChatGPT4.exe Token: SeMachineAccountPrivilege 4740 ChatGPT4.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4740 ChatGPT4.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1496 wrote to memory of 4732 1496 msiexec.exe 87 PID 1496 wrote to memory of 4732 1496 msiexec.exe 87 PID 1496 wrote to memory of 4732 1496 msiexec.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChatGPT4.exe"C:\Users\Admin\AppData\Local\Temp\ChatGPT4.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4740
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6F3C53095FD93B320DDCEBBAC2A706C1 C2⤵
- Loads dropped DLL
PID:4732
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI9197.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9197.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI92D1.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI92D1.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9310.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9310.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9310.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9340.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9340.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9370.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9370.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9517.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9517.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9566.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI9566.tmp
- Size 555KB
- SHA256 6cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
- MD5 4d436978faaef6c90ad5b208102fa0b4
- SHA1 08930ae826c426ebfc3f96c324319bd9384472c0
- SHA512 692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
- SSDEEP 12288:nV30ISQvKKwR5GAauHX4qih45ggXnotXs8c:V30IlvKKwc44q55ggXotc8c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\ChatGPT\ChatGPT 1.5.9\install\9859550\ChatGPT.msi
- Size 1.8MB
- SHA256 bcf88e4961378b50b73e394c97aba85b95561bd7e4af457e6412cab20e041fb2
- MD5 f7595cf5ae9278bbbc43d236e2d26ef5
- SHA1 da1facaf75fdff1e2a2cc7d266036908c26e241f
- SHA512 ceb5b6c9f9311d379bab1d7056e63e478c0fffd944e99358a6d9c23bcb7d8076b2fcfab101618d07d43124d11df209738378714722cd1245248503ad0517fea8
- SSDEEP 49152:f8rrwc44q55ggXotc8ctul0Wa55vCtTb:W/6ul0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SystemTemp\AI_EXTUI_BIN_4740\dialog.jpg
- Size 10KB
- SHA256 9c44745b7dcee21460bddddbfa926fe60d2680e38bb0ce65354cbd7a0445b97f
- MD5 c5279c5534cd4d0b6c046451aa0fc854
- SHA1 f1c07c41b7145104c78396a2638995fd40f55b17
- SHA512 363548f65a2d06e6259015f528458fb14a7c8324a9d264de2eca3ce64ff65f15f599a704e1f293b6709bc9fb71868b6bc2addbe854353ebd56b99450deabaed7
- SSDEEP 192:MBUwg1+VNXIicDJ4UMSoQZmC0VOBHUmmpx8WiQNsNs5TKU13C:8TXozT0cBH/ZBk6s5T33C
- MD5 SHA1 SHA512 SSDEEP
