e15e93db3ce3a8a22adb4b18e0e37b93f39c495e4a97008f9b1a9a42e1fac2b0

Resubmissions

26-06-2023 17:40

230626-v8wldsbh5w 8

26-06-2023 17:38

230626-v7qnraba39 8

26-06-2023 17:37

230626-v7jv7sba37 8

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
26-06-2023 17:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e15e93db3ce3a8a22adb4b18e0e37b93f39c495e4a97008f9b1a9a42e1fac2b0
Size

93KB
MD5

9a111588a7db15b796421bd13a949cd4
SHA1

034c8c51a58be11ca620ce3eb0d43d5a59275d2f
SHA256

e15e93db3ce3a8a22adb4b18e0e37b93f39c495e4a97008f9b1a9a42e1fac2b0
SHA512

820053864dd506fcf7c126f4a8df72ee6113ec07baaa2f440739782eb06e2768ee3dba5ba0c8e89d9c0dd03dffc51027e455f73601f41c07e02b19eef69f4aa9
SSDEEP

1536:pymLLU1F5kHIrIj0D6rhfd+lK3exiTCzxNtI4sZLi6UEbFEBFaW1EH6t6wfPP/Q:2F+ooxalK3exiTOijZLdUEbFlWPP/Q

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
920	chrome.exe
920	chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe
Token: SeShutdownPrivilege	920	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 856	920	chrome.exe	30
PID 920 wrote to memory of 856	920	chrome.exe	30
PID 920 wrote to memory of 856	920	chrome.exe	30
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 952	920	chrome.exe	32
PID 920 wrote to memory of 1092	920	chrome.exe	33
PID 920 wrote to memory of 1092	920	chrome.exe	33
PID 920 wrote to memory of 1092	920	chrome.exe	33
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34
PID 920 wrote to memory of 2020	920	chrome.exe	34

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\e15e93db3ce3a8a22adb4b18e0e37b93f39c495e4a97008f9b1a9a42e1fac2b0
1⤵
PID:1420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefaca9758,0x7fefaca9768,0x7fefaca9778
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:2
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1520 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2248 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:1
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1160 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1476 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3872 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3996 --field-trial-handle=1224,i,8221776958078158284,1596754564247306977,131072 /prefetch:8
  2⤵
  PID:2192

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6a5797fd-fbf5-45f0-b189-2f827a793057.tmp

Filesize
175KB

MD5
3c5c7766a34f0408c71865c8ce42a854

SHA1
2f2b178a270d25a9685634f84444ad7182d46b06

SHA256
12a92d0929c2cdf9b19c483fab0b1b647845dd20fdd56c036b8589fd07d1fc45

SHA512
b4fcc7d089f7245cd3ec9f6362fe545ebf2480b650ff2eac40e46f5dac9e33decd8ab8ec8e250d3951ee930999f8dc1289d963c25f415c96a5329177ef6901f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
01ff7c660b3b29f73138e00dfc6e2b50

SHA1
281f060ec9e79c6d6f9c6b9fd2ff4d7d52bda6af

SHA256
8dd41afc41c146949f54aa04e6b5cdceaa3b6526919dde5516d0926cb231749e

SHA512
5855b163d337cf45c1742911affea4b37468744c7f91c7e63264bc88180ae996f14e216c7ca9754ac71743cad6769ca7b678c13922d534179bb9b55d52c9a751

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
175KB

MD5
a6b4ac00ddbddb46d1b9a2c3bfc88eaf

SHA1
7e5e5088a972fd07c31f043eb3ca6f86318a825a

SHA256
7326bf41f7cc9d98b0378c2d83548312ca08c575804e4c2cc6747ff0fe135f6e

SHA512
56175f33940a083a2ee5f66b5a3f2bd2ef441ab6e60e862661d3cb9fc383586ec8047d04c9339330097f6798ffccf2dbc4bb4d13ab69de999b8ea21acb6e3f59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
24935f53f56c91c56cb503e552594857

SHA1
a0802747a6449fc22ec851fb6dc1a9cd4934c536

SHA256
8185a9f8cd1869a659f3c831948760fb8efac8c2a64050033402ee2e09750b6d

SHA512
77def66c95ce6b3d924d7f32c391f659526ae58c0393e82bebbd15dee8c433f7f44cfb1a5eb4461edbccdca4f6e692f4e41eec4a87640fac69c9f811c221c3c1

Download Submit