Analysis
-
max time kernel
68s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2023, 12:25
Static task
static1
Behavioral task
behavioral1
Sample
PayApp#215945195107913881670122616603661753152352985949308209533738971339861978176282846098264089331.html
Resource
win7-20230703-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
PayApp#215945195107913881670122616603661753152352985949308209533738971339861978176282846098264089331.html
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
PayApp#215945195107913881670122616603661753152352985949308209533738971339861978176282846098264089331.html
-
Size
2KB
-
MD5
2c9de05b297299c8669b0923a29f9f3f
-
SHA1
a94f819af7c3cc55368dbd8db7ad11e542046886
-
SHA256
90d8dff773585b532233f3e9cd82041376bad8842a55a2b4a1148ad9628fc252
-
SHA512
2e57dfc91816874a5180c0ddd76daee75eef655c283288677f32c68a42447f9d2229966bf03c2b4d6aaaa092889c53c1177daf06ef00362bacc79ee1c1b7b9d0
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 2428 4468 chrome.exe 79 PID 4468 wrote to memory of 2428 4468 chrome.exe 79 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 3900 4468 chrome.exe 81 PID 4468 wrote to memory of 4496 4468 chrome.exe 82 PID 4468 wrote to memory of 4496 4468 chrome.exe 82 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83 PID 4468 wrote to memory of 4636 4468 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\PayApp#215945195107913881670122616603661753152352985949308209533738971339861978176282846098264089331.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0f909758,0x7fff0f909768,0x7fff0f9097782⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1808,i,12214570192260404458,3102511100080506189,131072 /prefetch:22⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1808,i,12214570192260404458,3102511100080506189,131072 /prefetch:82⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1808,i,12214570192260404458,3102511100080506189,131072 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1808,i,12214570192260404458,3102511100080506189,131072 /prefetch:12⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1808,i,12214570192260404458,3102511100080506189,131072 /prefetch:12⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1808,i,12214570192260404458,3102511100080506189,131072 /prefetch:82⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1808,i,12214570192260404458,3102511100080506189,131072 /prefetch:82⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5cae3ec1df1076bb42c846723dad2be64
SHA13d1cffdbcadd93bb08901afa1c953e6447455c53
SHA256804583d3d261177a2bf890663ab61c1c6708b0aa3c0a257e689f9804fd8194c6
SHA512a69662d86d1c60ac6872bb3532a307df64a3333556f78934a2813417d98ffc40695b6c886c0600cf135a0efac5a85af870834ad6095c2ab8b262c0df29208f3f
-
Filesize
5KB
MD58d21da0cbc2f67b0bf4e68f01e873272
SHA10df9b1b744c21086d93d7f8e183417b848dc5965
SHA25658610e39e355e8c6314d31f51df34a26dfba7266ef5d75dd081bce52c6b03646
SHA512f3c4271adb94c9095bdcc333e129df364fbba4dcafa28185d1757b6a9114c8f91d995e3593632379dd84d99fcf55a2a541a51c4336f0984f6cf869e751d94bb0
-
Filesize
171KB
MD59f41bee5e40838a64d674ea9a58a7cd5
SHA1845b170f9e9c675b871543dc073fe6bd9fda5109
SHA2562ff700a483a3a0c6826c036d26ca6f8dc12ef7e4b526b74ab6bed282e4358165
SHA512791e84be74c7e4ec4672da229928e9f7a6644153554f1e0ab5342e38e3d4fcd9b7606c34edb71f1bdbf21dc6e148746cac47f8e28efce0e2b9642d3a4711a99e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd