2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d

Resubmissions

19/09/2023, 22:57

230919-2xqdkacd9x 3

25/08/2023, 15:54

230825-tcnp8sde58 4

Analysis

max time kernel
52s
max time network
57s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HorionInjector.exe
Size

147KB
MD5

6b5b6e625de774e5c285712b7c4a0da7
SHA1

317099aef530afbe3a0c5d6a2743d51e04805267
SHA256

2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
SHA512

104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
SSDEEP

3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2804	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1480	chrome.exe
1480	chrome.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	HorionInjector.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2656	HorionInjector.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE
2804	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 824	1480	chrome.exe	34
PID 1480 wrote to memory of 824	1480	chrome.exe	34
PID 1480 wrote to memory of 824	1480	chrome.exe	34
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2812	1480	chrome.exe	36
PID 1480 wrote to memory of 2900	1480	chrome.exe	37
PID 1480 wrote to memory of 2900	1480	chrome.exe	37
PID 1480 wrote to memory of 2900	1480	chrome.exe	37
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38
PID 1480 wrote to memory of 3060	1480	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe
"C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2656

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\JoinUninstall.doc"
1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feec989758,0x7feec989768,0x7feec989778
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1116 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:2
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1556 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:2
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1316 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3608 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 --field-trial-handle=1216,i,4590762726319288426,7307936046801028223,131072 /prefetch:8
  2⤵
  PID:2776

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\994ac7a3-87d4-4e43-9961-05c2fad209ae.tmp

Filesize
180KB

MD5
4d0e25480d2448049708575f6b1cdc7c

SHA1
0945118341b6dac1292e3bc972c07796ea5cc9d1

SHA256
e28532c32673703c5c008d4e1b95994bef1ff375602ec90a0f13c63907db7618

SHA512
54c577ddd43b30f64ea09d1f011390d1b75b2e95aa138d6961206d178edd1f3be55d1cd6b2f8cae4d860e51b366234544a0b9d80cc017cf5919c68f10101c4e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
f2e514c0f27e3f11825cce675dd00fdb

SHA1
153acc6be1f7217bccf5ee03aab91163915b9a0b

SHA256
ef2fac882d28b66728643b1dfb97d619f722fadce724197ca90ba423ae85a77d

SHA512
2997d0e95301b2320c2f17aad9e0e75ba3ba8a8655380ce053db694aeb0de4063e7a02ca7131f250ec5952bd1f8341a6e640899025925eb397985680ed1d9c32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
180KB

MD5
003287fa4326f77f91969ef9eb156c49

SHA1
58fe0e6f7c46534a27c8abb0e9e0c9071ef14b7e

SHA256
3dd84e21d753bfd92a47a6ed0e4a684bddc65739b0436a89b3d29fb13daaa034

SHA512
432d01528dcd2d167dafebb587a7e1058536f96613b7ed8e53fe19d0c484d4269aaf96008ab200df871ae6ad87fd108c226e0994b7e77650e2bc2456b5d58630

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
b9e1c0df4c5bc55a184b34b311be1bbd

SHA1
137a87a47ef2f8cb94709c7b49f734a4d036acc0

SHA256
8dc5efca583747bbbddc56d962af48c1ad5317c75b2df738729134eb48b15fbb

SHA512
9bb3d3dddc3f3abd6947e3bd5ee3ac0347de0f9780319a59607bae992f36d17a6cb25bdb452b87486e14a87d78d82b57bf12b010f35f5e1e5782d0f1f5f727db

Download Submit
memory/2656-0-0x000000013FAF0000-0x000000013FB18000-memory.dmp

Filesize
160KB

Download
memory/2656-10-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2656-24-0x000000001BDC0000-0x000000001BE40000-memory.dmp

Filesize
512KB

Download
memory/2656-1-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2656-2-0x000000001BDC0000-0x000000001BE40000-memory.dmp

Filesize
512KB

Download
memory/2656-4-0x0000000000750000-0x000000000075A000-memory.dmp

Filesize
40KB

Download
memory/2656-3-0x000000001BDC0000-0x000000001BE40000-memory.dmp

Filesize
512KB

Download
memory/2656-39-0x0000000000750000-0x000000000075A000-memory.dmp

Filesize
40KB

Download
memory/2804-38-0x000000007138D000-0x0000000071398000-memory.dmp

Filesize
44KB

Download
memory/2804-5-0x000000002F4E0000-0x000000002F63D000-memory.dmp

Filesize
1.4MB

Download
memory/2804-7-0x000000007138D000-0x0000000071398000-memory.dmp

Filesize
44KB

Download
memory/2804-37-0x000000002F4E0000-0x000000002F63D000-memory.dmp

Filesize
1.4MB

Download
memory/2804-36-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2804-6-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download