hxxp://ftp[.]gmtaihe[.]com/profile/2022/08/03/e4cade2f-4c25-4c46-9471-9cacdbcd2bde[.]jpg

Analysis

max time kernel
300s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2023 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ftp.gmtaihe.com/profile/2022/08/03/e4cade2f-4c25-4c46-9471-9cacdbcd2bde.jpg

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133368382096182898"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
3300	chrome.exe
3300	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1320	552	chrome.exe	84
PID 552 wrote to memory of 1320	552	chrome.exe	84
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 4984	552	chrome.exe	86
PID 552 wrote to memory of 2244	552	chrome.exe	88
PID 552 wrote to memory of 2244	552	chrome.exe	88
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87
PID 552 wrote to memory of 4088	552	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ftp.gmtaihe.com/profile/2022/08/03/e4cade2f-4c25-4c46-9471-9cacdbcd2bde.jpg
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7db69758,0x7ffa7db69768,0x7ffa7db69778
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2872 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4600 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:8
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3988 --field-trial-handle=1904,i,10350491603666763616,1481681487595206312,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c27095ea0b29b045e8a30f0de671dc34

SHA1
0e6f775d5715346df597e9fd4b11cf9860ad38c8

SHA256
eaf19ff30c5fc7a77ccdaf54fe39c10b198702ff7ff08b5032675e7558b31432

SHA512
948f121d0b88cc78b4a95603881b2486776675cd4b1039fa43faa59a3f7f8f71af7d23952c5a348f8d54c187a8672c2005456591d81e1da2bf8c39613e08f32e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a0124b9a4f8aae1fdeffab833372f7bb

SHA1
8bd5489b3866719de14f1af5e339527d5091e0af

SHA256
00ffcc5de0128e5d4b726f3db9817fd104fb9babc62fec293f3e64968dbc3b33

SHA512
f204b07aa8dc680d87cd0ba2005af58068695485505abc6e2b25368d0da7007de99bf82869a190ef9d386607763e9362d2e1440a9b7196f8fbdc7e524f5e09e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
320bbda34e9a0a545cd389a83c7e8e4d

SHA1
9bd01553f846ccde985323a13b4b7273821c55e1

SHA256
ee53cb58bdd7c0b1ab1391b618911d203456817e4cb373c7e5f5ebf2f51bc62b

SHA512
0e635a365ab3c7f08e1d233840690b92c6d7e036dc9b1f146bfddf3cbadb58819d1a6d2a5f061732fb57e19a08876a32b00398e65ea5d9f7010d2f1b6539a011

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
867765d7c3947f41ca34204e63300d45

SHA1
10ecc77fc8919000979fd8b3021c19b4455ef71d

SHA256
d89c8efd9c02e9668228ca95b7ad3549e12d4bb8c50b6e267f87c8c47ed20018

SHA512
a0694a85608b8355b5cd31318535396c69130dfe8693d86a2118e4c6e6d76ef9fab3711285b94f52e274a65225e04f35007203cfbac65bc9565bcd0f901896d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
fb1fc2a02c91e1c5234144cff2b360b1

SHA1
5a5a3bf8054b8782c0a0e98c42565a9e57487a3a

SHA256
424037007c948a07f7dae262e15ea79cc7f475a7225578168d4695c2bcf079ed

SHA512
9084af0cfdba0e595588bfe16b35f594178111b9ca2438fe8a873228783d421785b130ae9957c1cbeb29b31a3813c3059d726dfbcae6441d7859dcfc449b0bf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
967e926b55f2dae4d468b16ff618201c

SHA1
b67324ec1765ad6c8109d795783b09105c90717a

SHA256
74c326813632c4a2f875c7ae04bff930d8d6fca6edb69a8945f32c6fa89bdcf5

SHA512
d7ac14dcb45ac7b8d04a7b210240d2f74353a685a43128e358d2145f7cad1c46646f047eb7f6076c1131fe731de9e3bd5d44e5d3cc801139da5e57f0bc42ae69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit