b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Resubmissions

28-06-2023 21:26

230628-1ag81aca9w 1

28-06-2023 19:41

230628-yedehabg3t 1

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2023 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ho.gif
Size

43B
MD5

325472601571f31e1bf00674c368d335
SHA1

2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
SHA256

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
SHA512

717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133324549167685446"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
3336	chrome.exe
3336	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4184	1664	chrome.exe	84
PID 1664 wrote to memory of 4184	1664	chrome.exe	84
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 2532	1664	chrome.exe	85
PID 1664 wrote to memory of 4876	1664	chrome.exe	86
PID 1664 wrote to memory of 4876	1664	chrome.exe	86
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87
PID 1664 wrote to memory of 2684	1664	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\ho.gif
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbf169758,0x7ffdbf169768,0x7ffdbf169778
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1824,i,6123410769951663794,18174471047183146778,131072 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1824,i,6123410769951663794,18174471047183146778,131072 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1824,i,6123410769951663794,18174471047183146778,131072 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3140 --field-trial-handle=1824,i,6123410769951663794,18174471047183146778,131072 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1824,i,6123410769951663794,18174471047183146778,131072 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1824,i,6123410769951663794,18174471047183146778,131072 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1824,i,6123410769951663794,18174471047183146778,131072 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3568 --field-trial-handle=1824,i,6123410769951663794,18174471047183146778,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
c933968ef1d38b689fce028962f8af77

SHA1
d679e2651f0fb2a4293e6a9a220b7d3f54a17c83

SHA256
a7166c9d415a45d05a9e48215efe3e7d4d806317a925c8e2a3de4701f3ac1730

SHA512
b2254cb80445e082181029398063381c7421b2d32ce4b42db8a8f63dbeb39982c101edc7f07ff436259a3107b6f3875271e6270954f04ca439f7adbf47d4da61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5debad87951df309e4cf4598ee5d7844

SHA1
bb33e294a8fd8bcd0a026fa3b487a2e0add39bb1

SHA256
8cc8da682235f87aafd4b4a5f241ded040e13dc169ccb5e5b619b9e4a1c98afb

SHA512
94ba133a99fb3afb5e53ea21567d0b9852ee4fcb3f2a4407f970e2d58763cad3806d3346b2b5fa0ac34daa60ada4492f2b6ed3a1ec458632a312f36ab8403117

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
8de07fb95194a61b5e9e932c97915458

SHA1
69e65b1e55bc652868ff265509a80ea860642045

SHA256
fb93432c287966c836265b29321bf647603810f2cb033f185d69a4d14eee96c7

SHA512
cfd4a109edbcba087550277fd05cd05be4c87d085080b41506dd711aeefcf93d36e9a4855eaba53d4c251418f2a767dd22eb570b978d3ea9de26b2b91e19fe42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
174KB

MD5
1ce98c954d0ad741487d67c7e3eaf5f0

SHA1
ba1320753080b478c081c22d3017e82419630bd8

SHA256
0d2433e9e0d99f2b258febf93b01eeef3ab0c098ba197ff2796610d2c6854844

SHA512
92733c2ab5913c9a818fb7dbba94a00a52e2ea1113f22e55ee404e7e680ed01c331a9bdf55bf5ac94a14fe1d1c4172097ab691d8e660a9c2680fe0efc23c7ee2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit