Analysis
-
max time kernel
54s -
max time network
19s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
21-07-2023 08:26
Static task
static1
Behavioral task
behavioral1
Sample
open.gif
Resource
win10-20230703-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
open.gif
-
Size
43B
-
MD5
07fff40b5dd495aca2ac4e1c3fbc60aa
-
SHA1
e8ac224ba9ee97e87670ed6f3a2f0128b7af9fe4
-
SHA256
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
-
SHA512
49b8daf1f5ba868bc8c6b224c787a75025ca36513ef8633d1d8f34e48ee0b578f466fcc104a7bed553404ddc5f9faff3fef5f894b31cd57f32245e550fad656a
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133344016144798169" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3996 wrote to memory of 1464 3996 chrome.exe 33 PID 3996 wrote to memory of 1464 3996 chrome.exe 33 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 4568 3996 chrome.exe 76 PID 3996 wrote to memory of 1076 3996 chrome.exe 72 PID 3996 wrote to memory of 1076 3996 chrome.exe 72 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75 PID 3996 wrote to memory of 4560 3996 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\open.gif1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff9e7a9758,0x7fff9e7a9768,0x7fff9e7a97782⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1816,i,14573746270707897510,6465065992966074875,131072 /prefetch:82⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1816,i,14573746270707897510,6465065992966074875,131072 /prefetch:12⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1816,i,14573746270707897510,6465065992966074875,131072 /prefetch:12⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1816,i,14573746270707897510,6465065992966074875,131072 /prefetch:82⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1816,i,14573746270707897510,6465065992966074875,131072 /prefetch:22⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 --field-trial-handle=1816,i,14573746270707897510,6465065992966074875,131072 /prefetch:82⤵PID:2672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4276 --field-trial-handle=1816,i,14573746270707897510,6465065992966074875,131072 /prefetch:82⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52464e35508ede0d39fdded59dc693321
SHA131639c732baaed716a5dc21f16c289b254f313a7
SHA25624cdc6674c779a8d17f152019dd36a63dde06e2d65805ea43ad227603aebd005
SHA512a0e0e6384b67b2dcd704a5b87a0a75b86f5bdc0d29e5fd1c6f0301332c9a0ed6ae294bd5dff146c5fc0bca1378dc948d1751d0bdc1d397dadd417e05451d47c0
-
Filesize
5KB
MD55696ba50a2855e93335c3538f7f05774
SHA1c57a171697e15c5eb7105ca6a0ba1eccc9eca573
SHA2563ea7355cdf5c6e47b70e9b9eb34fab39bcda69ef34de5ff10cdf0b82ecb30ff4
SHA5124d152bdbf729feb27ca485368ae69d934cdf0a174ee0871a026c5525d745d9389d5ff8731ced4abdeb3862731892c7e347e96f1735f5dfc87b22e9154af3e6f6
-
Filesize
87KB
MD53fe9ad966f775c6bfd322dd08b0c11af
SHA189d145174bd7af20c548755cf2b77f5666444378
SHA256c04ef45e09bdc5555a8d7e6c59d892bbe6e3774cede1afcb7199f1abb7a3bd6f
SHA51260ede3ec8ab33e58c614247be938b105cd5862a8e16cc0530c13adef7196bcfcf52cb50337bc4cb8369fb8ba3713cb1fa4e918871736f0880740df65cd3741ad
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd