Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
Google Chrome.lnk
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Google Chrome.lnk
Resource
win10v2004-20230915-en
General
-
Target
Google Chrome.lnk
-
Size
2KB
-
MD5
bf01d93113778bda94e738ba93c56bd8
-
SHA1
396cca8c1b3c06aa0d6c797305333c5a959362d9
-
SHA256
c0e23f3050d2d177ee12205d6be8e87db9c5d9e8aa2919e01b4e6503d8e7ed14
-
SHA512
6b05dec21e89bd544931d2284a302b9f2ff8ce7d1e62b0af46a66bd78f1b752d2296530f5ce01457cad3640a88229cb1ae0904c924fa5f56ba02ccb4830183ea
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133418376009866607" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2628 chrome.exe 2628 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3248 wrote to memory of 2628 3248 cmd.exe 84 PID 3248 wrote to memory of 2628 3248 cmd.exe 84 PID 2628 wrote to memory of 1028 2628 chrome.exe 86 PID 2628 wrote to memory of 1028 2628 chrome.exe 86 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1564 2628 chrome.exe 88 PID 2628 wrote to memory of 1996 2628 chrome.exe 89 PID 2628 wrote to memory of 1996 2628 chrome.exe 89 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90 PID 2628 wrote to memory of 4996 2628 chrome.exe 90
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Google Chrome.lnk"1⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc215c9758,0x7ffc215c9768,0x7ffc215c97783⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:23⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:83⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:83⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3220 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:13⤵PID:496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:13⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4708 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:13⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:83⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:83⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5232 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:83⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:83⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:83⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2936 --field-trial-handle=1896,i,1311349442904659548,13956972008340504346,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4768
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5dc815fd47d9437c5455d57c768649c54
SHA130585ca0e45ac2597b89c8df3f4544abffb492e8
SHA2569a6dc7ae0d95813fa83d419b54f296c4195c59b9ad8cc41c5605b5202588e952
SHA512daa72bf91f1fdbfeaa5ae78e03a4442645c91afccb7626e9e455aaf3606e47578d9e8342626a018adfdf032092be56cc7bc9f267c72606f1c9cce4eb074babcf
-
Filesize
371B
MD5a981a3d2fb55d65a18230200104a860c
SHA17a193939f347dba2d6402dbc3ec5f18bdbf65dbd
SHA2569ee7753d6dd3df37202371f3ba4bc9ff5b84833db11db254e21ec1b1dad725c5
SHA512f12bb077d54dbfb6e38a3edda56e7f6148a36978b9c5736a3258f8b4de01cd5c2f19da54d82e7aaca01c55e256722126ff1a59743db7a4cd1f691cf200fa43ae
-
Filesize
6KB
MD507b965226864a59225521475cdaf645b
SHA1c2f06d825825ad3acbf0881c995b86a1d28ac2b7
SHA25654d0964a95d9fd2b9ad1d536854ba9d9532c5a9a611cab31e5062fb771dba449
SHA512c504c684a1a1482e54f232a9d7bdb5fe4ce10055ed2c50009344a9e8016605aa122383f5a2e707f29b67da4445062bb9cbeac56fe5586cc13c01f3fbf8e9d062
-
Filesize
6KB
MD548cb1e2180a23c199e7cccc9c465dacb
SHA1b34c79d31cfd97925e6b24d42aae17d0d7a86c55
SHA25670bb88caa4465676665bef5912ee4504cd34f5b44bb5bf254218c319732bab4b
SHA512e65e3881ae80fd38b76f68f52326e08c3ae68842a89eff5c10e100d82fe5911129491267a904fb56342d30cccfa3f96543814b115703ebcb26254c21ca1fe864
-
Filesize
15KB
MD5eaca9ed27cdb0f9610eeb40b6f863743
SHA129b799a58fba1163f75b1c5fc8a2caffe7da3fca
SHA2561287a6dbb28d917d09edf073ab38b122210caaa45e5cc2c6273863f4dc54ce36
SHA512497344b42712a211ebf15c529dbae08e259af79cf8c77f9cb069a429e4303b096bb9722f0df8336fad45f186b4f1eef16cd540776a86ef340bbf62670b62863e
-
Filesize
203KB
MD5223f01a70585efb5522a3bc258ccd09a
SHA1ef3dca2b9e5201072bf554beea24335bd09afa28
SHA256f8c46bee2cba5b37c8d9f2612975bd8f4a4da7f91cec1a1702d616a62eadf8ff
SHA512c7db8057061da8a5a76ffa464872952fee0c82741e9fc03e12d25e917270d94db798f4e5e9f4db9002af1f1db2b63b140e20abcf7e7683a2b082ba71324cefbd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd