cb99b89fad15524c911ea5f71972cac7c7cc49946b8d100d1aa998b19f9379fd

Analysis

max time kernel
26s
max time network
55s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot (108).png
Size

82KB
MD5

11b023ece4f19014345ca33e9fbc91f0
SHA1

d87e64c6189d33a5444ff0f527e0a9d5cf0501ae
SHA256

cb99b89fad15524c911ea5f71972cac7c7cc49946b8d100d1aa998b19f9379fd
SHA512

6a4a200535254080815b2917f2299cd15a30de03226671b8eb4a74d89d40ee4d4729c913c266a8586c069f938c95ec492e93c2fe3cb1c51ff4f027723aa95af6
SSDEEP

1536:cJT57QXqObkicHvknCPHMTcKqsqqstAnMxwina7RnIiFQPYhcdeoH8O:ET57zObNwLMTbIBwinadePYm8O

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1256	chrome.exe
1256	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe
Token: SeShutdownPrivilege	1256	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe
1256	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 932	1256	chrome.exe	29
PID 1256 wrote to memory of 932	1256	chrome.exe	29
PID 1256 wrote to memory of 932	1256	chrome.exe	29
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2628	1256	chrome.exe	31
PID 1256 wrote to memory of 2532	1256	chrome.exe	32
PID 1256 wrote to memory of 2532	1256	chrome.exe	32
PID 1256 wrote to memory of 2532	1256	chrome.exe	32
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33
PID 1256 wrote to memory of 2436	1256	chrome.exe	33

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen "C:\Users\Admin\AppData\Local\Temp\Screenshot (108).png"
1⤵
PID:2388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7199758,0x7fef7199768,0x7fef7199778
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:2
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2332 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1440 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1428 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3128 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3080 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:8
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3668 --field-trial-handle=1276,i,8434969618327051088,14826735237751821301,131072 /prefetch:1
  2⤵
  PID:2984

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\05a0332f-0efb-4968-bfc4-73d32b56c942.tmp

Filesize
199KB

MD5
62f641f0b22b80482988d4782f820c29

SHA1
afc29ef48143eea1d79d8f050ab0c4a6248ad918

SHA256
fb26d30b24b02d63970ffc6ddb300fa679c0c54b098edda02a967de896f9813e

SHA512
418ae1ab929abb89312513451465fb05c5a83641f01667c6b9b5387becbb7b5564e449c9a497ca8e751a53ca4de6337018c3317083708954448c131cf84b213e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
a8afa812274165e15687ee1bfb7a9366

SHA1
ab01948e9eb56ae2f1957fe0fcbb4b96d1314ac5

SHA256
e688b8e93502938f48bed263a427e492b480316202a1934373f160118d707e46

SHA512
188252cd77fb9941ca4a1faf3db9f6652ab6c728d2df57a1ea0e5310000109c93e2fec20e756bb981901fb74fd5b04daba6846f7af8d53dc19f4389bbfb02966

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
8f234cb5149c56a5bdbc14acf64705a0

SHA1
34d5c8a29eb078d4d13e18646246097a2db260a6

SHA256
9b3f4312cddcd4fdeb425f18962917437e9da38c4cb497695fc8a5b4d0ac1468

SHA512
41a30f70c3133fa6819bbf01be557ca15960fdc2a0287fbc881553344549a9d7d8c2399ec11eb95b66ad09b157564f35d35e5ae6300532c8136fae9449f2ab2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
3b6bc935146ad81f555060c25a8e270f

SHA1
97072f34b31d299fc88525cbe9d1929bf3432884

SHA256
b0faf3d25ac5b9016e144b0078af8232946cb8c1f25efb29e1405a11485d74b2

SHA512
8deccda36fadd9130084528a20a91ad57441f9b0c3a88c2c8955bd8a825945a33338f5920538eb5671339290e7b45f07113c272c4d6b801001cef08a13aed289

Download Submit