Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 04:19
Static task
static1
Behavioral task
behavioral1
Sample
Jazmin Naismith invoice 63540.htm
Resource
win7-20231025-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Jazmin Naismith invoice 63540.htm
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Jazmin Naismith invoice 63540.htm
-
Size
10KB
-
MD5
5566e92131fad676e5bd98dfa5ad77c1
-
SHA1
40ef19fa8f8f42e84f5c8e3a6620900e6b8cfa56
-
SHA256
91bcdde300e9676ac7b798aaf71a9a490588ab7d702cfc519adea094535598dc
-
SHA512
792c2fda54733b2386498c397b0e093bed9cfd174b13fcebc75c9cba0da25399e598d624e822572b1352b95ba9a8087cf7f990128ed0cd2e0df8b83b4c142902
-
SSDEEP
192:4L9gbDz5eLgh3I2RSb3QVs/Sqag21AtnjsggHo:W5
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133433724113722891" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1788 chrome.exe 1788 chrome.exe 3896 chrome.exe 3896 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1788 chrome.exe 1788 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe Token: SeShutdownPrivilege 1788 chrome.exe Token: SeCreatePagefilePrivilege 1788 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe 1788 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2252 1788 chrome.exe 84 PID 1788 wrote to memory of 2252 1788 chrome.exe 84 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 3816 1788 chrome.exe 86 PID 1788 wrote to memory of 1256 1788 chrome.exe 87 PID 1788 wrote to memory of 1256 1788 chrome.exe 87 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88 PID 1788 wrote to memory of 1440 1788 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Jazmin Naismith invoice 63540.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe154e9758,0x7ffe154e9768,0x7ffe154e97782⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1864,i,11551662643302111168,2466985728718032145,131072 /prefetch:22⤵PID:3816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1864,i,11551662643302111168,2466985728718032145,131072 /prefetch:82⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1864,i,11551662643302111168,2466985728718032145,131072 /prefetch:82⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1864,i,11551662643302111168,2466985728718032145,131072 /prefetch:12⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1864,i,11551662643302111168,2466985728718032145,131072 /prefetch:12⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 --field-trial-handle=1864,i,11551662643302111168,2466985728718032145,131072 /prefetch:82⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1864,i,11551662643302111168,2466985728718032145,131072 /prefetch:82⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=748 --field-trial-handle=1864,i,11551662643302111168,2466985728718032145,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3896
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5ce1653e6eae071baa1f6339a936707f0
SHA1f55be2cc6c59b27eacb9263a40d8b66073a2a76c
SHA256b2bfa81b4c2963010b3322690f5f93766fc7088fc78a3565c5f6e4b3ea270cae
SHA512540b62086f685a0b3976e488865cb9b727bcded163b6e1a56bf1f7bc5e8ffc428ae9ceabffd797831704500b1d14c95488a0077244ce44fd191540edb8063273
-
Filesize
5KB
MD5a0922002fc54c7ae3aef90e92e21afc7
SHA1bcaae0dcea649a648e36c95e6e0e9f50239f9a7b
SHA256fda214e45a7a2861235c4157d10a4e0ad597522d3b1d4d30dc971e19c8801af1
SHA512d725087b5c8d790a903788b0f731bfdc46dbf20ffbff4a0d0dec9e0e78dbf8f367ab8863cbae34b198cc13b574c4480f7da89cf4d937348f8834595919ffaa3f
-
Filesize
5KB
MD583dabc2d7a4459ebd632df2cd7d41e71
SHA115a33183e057f8744d597da423685c5f1229c5f6
SHA2560bec5f96f7965f28828ffbafea63253325b35da65785881e676ce5e7420571bc
SHA5120f1ec8615bf89235000d8fd7bc224283d212c25074a12878b62e9eccce604f21f5032c33cde077a304396dadf8e402f5e108ae4922c930aed42343f2ce4a9ea2
-
Filesize
109KB
MD547a01cb452890508913c44ec5b10bdde
SHA18e2267dfb874f608836c0932a44c037002cb99cd
SHA2564a1bca7cb626c75c06d18d3cf98382e001374aed15480c28fd1376c384c72eaa
SHA512b926c53ebf28e4fccab9feca1b2d5f168e4f72011df7ca3243995616df9d231d504a98fbb9b7ea2db65dfbd5598d9526985d95ded34bd0e24cf58d6bec877aad
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd