Analysis
-
max time kernel
300s -
max time network
262s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2023 14:53
Static task
static1
Behavioral task
behavioral1
Sample
adobe-photoshop-2023-0061.html
Resource
win7-20231020-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
adobe-photoshop-2023-0061.html
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
adobe-photoshop-2023-0061.html
-
Size
178KB
-
MD5
4e4e7ec30350710868c61a3c48195122
-
SHA1
e075039351a50e5f3f04b3a713274db798362092
-
SHA256
77b918492a73a8cffabe79be0e137e2588f5f5336c578344abf6073927f9c024
-
SHA512
fdf8ff14bc9553bca2dde5248adb654acf85484d31d8e6adbacdea5a7c8b60ead9851451eb858cc6170553a75fcf52bfadbd7ffd066bfdb7fc77bf12a4d2d25c
-
SSDEEP
1536:DjndTc3TRlqAdou+QwZdDuuH80cQdSXHKcoKUbvjMZpgkBq4nsYNPOct:D2iiUbLMZpgkBq4nsYN2Y
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133423736514378908" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3692 chrome.exe 3692 chrome.exe 3432 chrome.exe 3432 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3692 chrome.exe 3692 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe Token: SeShutdownPrivilege 3692 chrome.exe Token: SeCreatePagefilePrivilege 3692 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe 3692 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 4600 3692 chrome.exe 85 PID 3692 wrote to memory of 4600 3692 chrome.exe 85 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 1452 3692 chrome.exe 89 PID 3692 wrote to memory of 4420 3692 chrome.exe 90 PID 3692 wrote to memory of 4420 3692 chrome.exe 90 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91 PID 3692 wrote to memory of 728 3692 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\adobe-photoshop-2023-0061.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4ef79758,0x7ffc4ef79768,0x7ffc4ef797782⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1868,i,16869520947010042457,7278918608058906987,131072 /prefetch:22⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1868,i,16869520947010042457,7278918608058906987,131072 /prefetch:82⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1868,i,16869520947010042457,7278918608058906987,131072 /prefetch:82⤵PID:728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1868,i,16869520947010042457,7278918608058906987,131072 /prefetch:12⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1868,i,16869520947010042457,7278918608058906987,131072 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1868,i,16869520947010042457,7278918608058906987,131072 /prefetch:82⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1868,i,16869520947010042457,7278918608058906987,131072 /prefetch:82⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2536 --field-trial-handle=1868,i,16869520947010042457,7278918608058906987,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3432
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\052350d5-05d6-4fae-b642-fbcb424ecc09.tmp
Filesize4KB
MD58d876f06c0e5859e4c0d3cebad21a83c
SHA174e476cad5bb823083701b7da86df9f1e432da11
SHA256705bc38f8fa7159aab86c503b5627c9e2c8eb2fc606bf9b6a182afd3bba17a49
SHA512e700b791be9fcf4d92c0100fbb7ea737af98fde1801aad77ef781aeba41d4dfa45e64a0701e77f505989a6d4aafefb242a191bc02dadae7466e2a1ddfffd4c1f
-
Filesize
4KB
MD5158319aed0cc9018704901bfd78e2561
SHA12e77a52b1657d00e6981e4f34cd5ed0454e10550
SHA256bee060e5c03159bdfc6962e29880eb9c0bde6baec316ef1bd1d9b892974a8894
SHA51277550f8b5b1f0d4f5098c510bd70632c0f39a063d0f1754ce0c312ee35c93b421401348a79dfe1a83c6f016ba6c0e8f4a61a382d7625e751e8506582455fcf4b
-
Filesize
4KB
MD5e563955a22e010af0cff85b81bff672e
SHA187bc17d85fca7001835a90f4022a195a9f55f3e7
SHA256cfa2d1e12ac7e5a332784583de45b3346e5ca712c84c85761974c8df91b82a7b
SHA512db2840a27a5b77d6315dd21137019d7ffd00fd3948d5300df815f3573e17f76f200f9e52702f09057acf0bda59e2445639b2919406dec1e5dd2cc28e4b65ca99
-
Filesize
109KB
MD5129a4a626f3b164caf48d0257fdb3b96
SHA11024b0925dea903c798c855d261fab39dad4b206
SHA2561f6246aa9a1e33a493ce6b2e098361f3e9489ae1914516447841cab2fcd1a16b
SHA512fda454520e3ba0a7812c2e6827fc2b6e7647fc5f35977c113344d90dc148fc11840b92458776bb514a4f5803d9961e04dc3ee1f64700479bcd8f8adff93f0513