2b6e65cac1d287f61591f4527307de9d9138525a302f50228d150b46d94bb172

Analysis

max time kernel
117s
max time network
364s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FT310033710272.pdf
Size

2KB
MD5

c48f3ab937154be76402eb06c2ca67ac
SHA1

c37260c2e68d958e08f530c8f6119c4e61adca6d
SHA256

2b6e65cac1d287f61591f4527307de9d9138525a302f50228d150b46d94bb172
SHA512

9fb57bcfbfaf894ddc6e1e9536681ff0edc0fc6d1ae24cc1e8afd0bedec3285b41e42d4c43a2e0abb51c6f669ae5a783ad91e54f770a0b8bce4c6ea4d9bafe10

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
636	chrome.exe
636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe
Token: SeShutdownPrivilege	636	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1764	AcroRd32.exe
1764	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 2856	636	chrome.exe	31
PID 636 wrote to memory of 2856	636	chrome.exe	31
PID 636 wrote to memory of 2856	636	chrome.exe	31
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 576	636	chrome.exe	33
PID 636 wrote to memory of 704	636	chrome.exe	34
PID 636 wrote to memory of 704	636	chrome.exe	34
PID 636 wrote to memory of 704	636	chrome.exe	34
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35
PID 636 wrote to memory of 472	636	chrome.exe	35

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\FT310033710272.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ce9758,0x7fef6ce9768,0x7fef6ce9778
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:2
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:8
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:8
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2352 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2340 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2816 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3216 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3464 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:8
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=1212,i,881799055369489469,1673228790129374998,131072 /prefetch:8
  2⤵
  PID:644

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5438e932-a066-4e32-9b38-757bf8d5f687.tmp

Filesize
198KB

MD5
1e0d2c66b801853ba36d165cd7de7dbe

SHA1
7f8d0d267ef0ee3a9f7dfdda1e1737b96b56fa38

SHA256
058675ac1f4b0026d1bc75f264123e7d5fcc2b195ec7d8e1296913096c7b888b

SHA512
386627f320f6950d0900cac91c5ecb9ed6b3208374984a38bfb9b6c5e356648da40aacee6a162bb539e1f1e256f6a07b9272f1ba7fcd4a76630960cc35995cf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
983B

MD5
5498b017adc76a2b7ceda2db2fcbea4c

SHA1
63c44c10f41d991718e4e1c6c868afcbcfc96e9f

SHA256
777e98a79998cedb3e2b651728b8240b83140d8c5da164b968e7ead6391d843c

SHA512
19f0252797d5c6a0ce1be6245223a0e92715688764e71b157753a9ce3f47523a7120409c5cabb58038ce97c91c003ea44d1c73eff762d9a04e2ca845b9f4c0c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
126bab917c0614a84d0a1f82c776be4a

SHA1
bf1c1f4c1068bbf7e9a9663393dedecb63880686

SHA256
ad45781907d838a1903bd806fedb91fe6d19fff36b39399e6baf9fd996b99696

SHA512
aa4ce62e85a21ba001c7d5bf8ba49725ab1baf52624f163f4ba83538dbf68173f126ed5ac2e47ef558afe2692148d7ade86146c44227c7beec231550eba1c6b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
d8b92a8340ae5af889c88d47d33dcfae

SHA1
2b88dd18a19cdf626e34817be6d70e8229d451ca

SHA256
80586c2f1d942a524ef9916e1216397e4872a9b4e577c4f188fcd3a6973d3472

SHA512
3c7867613c4162bd416671553630fe0e8e45fe4ab413104d2ccb55924dfb8499f631e5d31e58b3c0a380e5dbf5020fcf6575878584b8a55aa2209963086f7802

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
dab23fef7aa1bdce518782cc9f5db98a

SHA1
d566ee5f3e22dd758f7cbcf21440df6ee53b13aa

SHA256
28aeb052e7c6d11d3b73fc0ab661fcda9bb835c48262263de635307217efd6ce

SHA512
26ca29eb0ef727839d392e4d34b943b94e730610e3725fb6a37feeb775efd52fa31c0d9570141c22b9a3e653767a299855ff1caa485d22226860b2faa371ea8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
198KB

MD5
db940f676d1439e85a060cc4cbad75c4

SHA1
e7b647b3cb07c427e8bdec5013d354d3ecf23484

SHA256
ee993fb886411b6460e31f8fb511b9464f9d01d1702448d834ca9034863e4949

SHA512
692f60411cdb2e28e182e1b15922cd9f31ee6bc6d0012e0da2aeab817ce2fe452853f415920a2be2940ca1eba8c057c79568bd8ea054507e872c8282a27a20d5

Download Submit
memory/1764-0-0x0000000003C90000-0x0000000003D06000-memory.dmp

Filesize
472KB

Download