Analysis
-
max time kernel
300s -
max time network
285s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 06:59
Static task
static1
Behavioral task
behavioral1
Sample
phish_alert_sp2_2.0.0.0 (5).eml
Resource
win7-20231020-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
phish_alert_sp2_2.0.0.0 (5).eml
Resource
win10v2004-20231127-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral3
Sample
email-html-1.html
Resource
win7-20231023-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral4
Sample
email-html-1.html
Resource
win10v2004-20231127-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
email-html-1.html
-
Size
4KB
-
MD5
b5fb2f4fbdb6c94c3cabfc69d1272e49
-
SHA1
b0fdca56da9ea0bca433c9092aaad86c96dce168
-
SHA256
75b137c04ecaee7b4768331c5e7faa1886b164ec382e00e1e9540ed9507502e5
-
SHA512
b26ab068e4a9715276af093af4f5b5271456a8030a6e94b2db249f7818951a489234ae9f3afc8bfdc47177bfb475f4fad49bd36a1b1eda84eb66a8c22534ac3f
-
SSDEEP
96:VuDUWBB6Aucozs9Rro4vSoLCxiSomiSowiSorpqzSiSomiSogSiSomiSH9iS6ehy:Vdzs9Rr3Vb538bAbzRaUUUM+ehmIImAZ
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133467515973106546" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1108 chrome.exe 1108 chrome.exe 1476 chrome.exe 1476 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1108 chrome.exe 1108 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe Token: SeShutdownPrivilege 1108 chrome.exe Token: SeCreatePagefilePrivilege 1108 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe 1108 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1416 1108 chrome.exe 58 PID 1108 wrote to memory of 1416 1108 chrome.exe 58 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 4604 1108 chrome.exe 90 PID 1108 wrote to memory of 3888 1108 chrome.exe 88 PID 1108 wrote to memory of 3888 1108 chrome.exe 88 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89 PID 1108 wrote to memory of 852 1108 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-1.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebc469758,0x7ffebc469768,0x7ffebc4697782⤵PID:1416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1900,i,10723406639881967532,8714496403571048129,131072 /prefetch:82⤵PID:3888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1688 --field-trial-handle=1900,i,10723406639881967532,8714496403571048129,131072 /prefetch:82⤵PID:852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1900,i,10723406639881967532,8714496403571048129,131072 /prefetch:22⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1900,i,10723406639881967532,8714496403571048129,131072 /prefetch:12⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1900,i,10723406639881967532,8714496403571048129,131072 /prefetch:12⤵PID:492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1900,i,10723406639881967532,8714496403571048129,131072 /prefetch:82⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1900,i,10723406639881967532,8714496403571048129,131072 /prefetch:82⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=884 --field-trial-handle=1900,i,10723406639881967532,8714496403571048129,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51033273dcdf12077008efd78b1e461f0
SHA113c9af4bb698038b1f1886bcbebbb4878ac552d1
SHA256f072c1b62c479643c4edb0e4232c672910d1279c44338142040d9acb65f28a45
SHA51293d220655281a7a82d452aed6afe56e40114512ae259d7a0eb4e559fa9d47f49da48ab8794f0ef89182d6a4a4be36a480015ad6bd5f34e4bb57be39abbfb8fd7
-
Filesize
6KB
MD547e11afb03e9b56971d07e59cb2cbcf6
SHA1968866f711ab69c9672cba4d581fe49f328f8b2c
SHA256096d4a01def7e83c5d8478b27a5e9553002b241f1373b3eb87e7b81a3d151e29
SHA512e3bdec64b449e9bd52beee204f2cc6a8a382947cbeee87a277608eef377d2ab78a3a57b5315c8af982db49a1e9c50448961e3da06160f4cb26f07ed69a4d6e13
-
Filesize
6KB
MD5dc869b758c14c9138f0e2c89eea9a94b
SHA10efd1727d71f8f35f0c77bdb564e8dab53a6dbea
SHA2563a4e1503608c56b13d4ec4ddc590b1194bd67909a1e8e7d3b0753c90a00edb1c
SHA512bc539918748cb6bfee9e147dec5d19b07d4ac7bf519849f03df5d0365e1e6e684da59ce03aa22ff5763db20b9af200e1af1806a6a691135b273edeaedbf124a9
-
Filesize
115KB
MD5177150b734f15ec4fd3a9c5a91fcbd39
SHA1504a5f24bfd8814fe59a088bec21e82545516b15
SHA25698ab63f2227143b2a51d7a091598f7d5fa7dd492c04769dc3a7fc77d87f70225
SHA5120db253de4939cb878383a015407af1f5da91f61b5428c0376f3a6a217ba8494cbdf6b2715fcdfe89697d6c064a1ea8386167fbef376d68a86f52d9a124d545be
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd