Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30-08-2023 15:18
Static task
static1
Behavioral task
behavioral1
Sample
open.gif
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
open.gif
-
Size
43B
-
MD5
325472601571f31e1bf00674c368d335
-
SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
-
SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
-
SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133378823084228463" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2284 chrome.exe 2284 chrome.exe 4048 chrome.exe 4048 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2284 chrome.exe 2284 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe Token: SeShutdownPrivilege 2284 chrome.exe Token: SeCreatePagefilePrivilege 2284 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe 2284 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 4696 2284 chrome.exe 38 PID 2284 wrote to memory of 4696 2284 chrome.exe 38 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 4228 2284 chrome.exe 83 PID 2284 wrote to memory of 1616 2284 chrome.exe 85 PID 2284 wrote to memory of 1616 2284 chrome.exe 85 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84 PID 2284 wrote to memory of 2132 2284 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\open.gif1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb44299758,0x7ffb44299768,0x7ffb442997782⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1872,i,8446008056652455216,12786870651390990739,131072 /prefetch:22⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1872,i,8446008056652455216,12786870651390990739,131072 /prefetch:82⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1872,i,8446008056652455216,12786870651390990739,131072 /prefetch:82⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1872,i,8446008056652455216,12786870651390990739,131072 /prefetch:12⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1872,i,8446008056652455216,12786870651390990739,131072 /prefetch:12⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1872,i,8446008056652455216,12786870651390990739,131072 /prefetch:82⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1872,i,8446008056652455216,12786870651390990739,131072 /prefetch:82⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 --field-trial-handle=1872,i,8446008056652455216,12786870651390990739,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD50f5d2db97babaddb60db0770de2b8da8
SHA1c15af5205b612701f56c02fa29fe31ded75bd41e
SHA256b871aa42eca24550666776a729b8e925e3c6c8017ca369ccfc4878285a7d3f6f
SHA51249716d9fdcc4910321aee8a2df99518e004c755a46009095b3f598f14dc89a62263c2dae572e6a4c9477361d98acc59de1b0c93709968c4609a7dd59a3734954
-
Filesize
6KB
MD5f1750a286fd3deb5991fba6d43f774ca
SHA100b880478df7bc2d194b534bee2c61a7903170eb
SHA25605de182e782f2f666919a7260ba00a8a19cbe8fe3736d4b9abe369cb7a1f5b1d
SHA51212866771e52c110d3909326ee48f6f9926930a8fe40c948fed203000d94195700b75ef798f0a02a9aa683e9c70f48a20d1e78cb8dac20a2d9d3ae2d655c5e267
-
Filesize
6KB
MD5f77b1f8ae7315bd9e86f3c3a6d6335da
SHA1b0f8be401131ecb5276e956476e461853934aa1c
SHA256bcbd542ee26d58fc1e9f126bf6736daf5efcc73472b05a50a2f2582949f465aa
SHA5124bd7dce0623c260170c2c9958ca7394369b4167d68470d4a1d9df04a75cff70761344234855e992076227d814e778715026d30ad5eea85382c7f9d6093271008
-
Filesize
87KB
MD5507c4b2ae4f9179dca3b49eb4b14dee6
SHA1f60e49c31c96baa579b2e5211d355aa4facb3f03
SHA25605a4ac4962aeccb88809fba8c8d51c0fa4e8b8c0b48491077210fa33503969c0
SHA512234f50045157eafce591e8d42ab8f9b212324e86a92db522c19d4ffecfff76f40fb1724b824b9f06b19e3da1f4b365791fe9bc2acda8636894b1355500deb28d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd