Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 07:29
Static task
static1
Behavioral task
behavioral1
Sample
da0d6762-8f6d-453b-bc5d-ca61119e5633.gif
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
da0d6762-8f6d-453b-bc5d-ca61119e5633.gif
-
Size
35B
-
MD5
c2196de8ba412c60c22ab491af7b1409
-
SHA1
5fbd472222feb8a22cf5b8aa5dc5b8e13af88e2b
-
SHA256
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
-
SHA512
84e24a70b78e9de9c9d0dfeb49f3f4247dbc1c715d8844471ee40669270682e199d48f5fbec62bd984c9c0270534b407c4d2561dd6c05adec3c83c1534f32d5c
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133413965948112393" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4384 chrome.exe 4384 chrome.exe 4208 chrome.exe 4208 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4384 chrome.exe 4384 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe Token: SeShutdownPrivilege 4384 chrome.exe Token: SeCreatePagefilePrivilege 4384 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe 4384 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4384 wrote to memory of 2076 4384 chrome.exe 23 PID 4384 wrote to memory of 2076 4384 chrome.exe 23 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 640 4384 chrome.exe 89 PID 4384 wrote to memory of 4236 4384 chrome.exe 91 PID 4384 wrote to memory of 4236 4384 chrome.exe 91 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90 PID 4384 wrote to memory of 4616 4384 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\da0d6762-8f6d-453b-bc5d-ca61119e5633.gif1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc74cd9758,0x7ffc74cd9768,0x7ffc74cd97782⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1700,i,17850388175470478869,7723320023442214041,131072 /prefetch:22⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1700,i,17850388175470478869,7723320023442214041,131072 /prefetch:82⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1700,i,17850388175470478869,7723320023442214041,131072 /prefetch:82⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1700,i,17850388175470478869,7723320023442214041,131072 /prefetch:12⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1700,i,17850388175470478869,7723320023442214041,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1700,i,17850388175470478869,7723320023442214041,131072 /prefetch:82⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1700,i,17850388175470478869,7723320023442214041,131072 /prefetch:82⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3888 --field-trial-handle=1700,i,17850388175470478869,7723320023442214041,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4208
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD548aa1166cd0dd76b96c4afa62dfb2598
SHA144e772b77aee68bc0d78f29bbfe2bf53f34fd8de
SHA256d202e07d104f0870f8c609c624732be9bef05ccb37e048b38faac88b60a26b34
SHA5129654844f8f1c60c7deb681408c4209395ab5a4e26479205ea9a037240fceb0444f3829ac564fdcc212f247d88362e3395381452e31295fcaea2255f9dd869da7
-
Filesize
6KB
MD5ad2fbff9c3d1220c10f35af8022decfe
SHA1c0c992accb139b1ad1aa493008415a8c4d016357
SHA256e0bc4aa147b493c31f34e8d5d123d5ecc1955b0744b8c0b72d1ef0d77301c7ef
SHA512932674fdc40d63dc9168f0e81c79e60bb70dff17ba4b48a8c254f237d5fd47949514e6d5a993dbe853d6bb165771e1763d6cb84b95dc96aeee07470ac83a542d
-
Filesize
6KB
MD5d93ad68008d3421de73d545f35837055
SHA1bc8598bd6f1ab0962114ed0e1c55ba0de93a88f4
SHA256ecf214249f08828672475c38b6b7fd4c1bf6ed71370c13a1babd6cb8e99f5e63
SHA512a6a4dd22f4b96edfec2e4c858083dcc53e18f6a0ff63f23e8c1fe8220d0163f708a66da7a8f2cce3a1c4cadddded54af48f26f75893fdf979bb9cd58a77bd394
-
Filesize
101KB
MD5ec1207be2f2ce90ab089863b1c31a10f
SHA198f70d9c8c766b2637760a8b892a20fe118aa501
SHA256b20e8ff40e84ac2d0b201d58ecbb326f8051ed5a6bb027b0d438a27c97bf6634
SHA512d08f46958fda8607b233236b9d65672169188c08b04aab16dab17842d16f2129023e3ac1db6935541efe58efc115dabdf742350b4ae78ebbdcfa64fe8a569ce7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd