Analysis
-
max time kernel
19s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
28-06-2023 21:26
Static task
static1
Behavioral task
behavioral1
Sample
ho.gif
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
ho.gif
Resource
win10v2004-20230621-en
General
-
Target
ho.gif
-
Size
43B
-
MD5
325472601571f31e1bf00674c368d335
-
SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
-
SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
-
SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2040 chrome.exe 2040 chrome.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2040 wrote to memory of 1064 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1064 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1064 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1480 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1496 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1496 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 1496 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe PID 2040 wrote to memory of 980 2040 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\ho.gif1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7449758,0x7fef7449768,0x7fef74497782⤵PID:1064
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1228,i,15426885262394205726,12910763887596532118,131072 /prefetch:22⤵PID:1480
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1228,i,15426885262394205726,12910763887596532118,131072 /prefetch:82⤵PID:1496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1228,i,15426885262394205726,12910763887596532118,131072 /prefetch:82⤵PID:980
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1228,i,15426885262394205726,12910763887596532118,131072 /prefetch:12⤵PID:1320
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2300 --field-trial-handle=1228,i,15426885262394205726,12910763887596532118,131072 /prefetch:12⤵PID:1728
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1164 --field-trial-handle=1228,i,15426885262394205726,12910763887596532118,131072 /prefetch:22⤵PID:668
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:668
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3cc4d794-133c-4052-8008-d1bd20fa00d0.tmpFilesize
4KB
MD582d7266b83cb184132f7f84c1246285b
SHA121ac6c510c11ad6b152e1fe499669116749a8671
SHA2566e1a19ff9ac05034cad961f5c066122223416771007a2226f8010d4c9b2a8174
SHA51274879db0a51da7ab351710a8f5e53448eba966ca11388e01428129d09917d31ef371984fc60a31cd382c4b5f698af3b017b8171c1c56910dfb88f875e9989ee2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD52df8f6db81363dfbdd9bc3055c02800c
SHA1d608cf55fd2c82d1bbffc9a8c4ad208f006ac8e6
SHA2562c241621a25933258468c5543654f0493e47d1f83ca741ecf26d8781e73b4346
SHA5122aec122e0383ab79f9ea7499dd4cbcc1a90ad3900635a569ab02e5bae5e7c9f0bb58887ebee068ad04660fcad9aef15308035faac29f5d0ebf0666489594bcc1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD5f608f12c9d1b02261e808a317d8e8aa5
SHA1f8f6980c3186c8facd464e7f38ce99194c6c0272
SHA256a8ddfd44a95e8659f761118782069e7337686ad66dd5e37511ec4375bd1eef65
SHA512a2aae6fda372e953f45f3eaf3b7b33ab46a5d92d7ddf100ef3206e79cb5514a901875715d06f2092fb20aa5e70ba869bd15301f384dddb0e2ade14eac7ffc7be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmpFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
\??\pipe\crashpad_2040_TDZRPFBISQIXVSIOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e