Analysis
-
max time kernel
45s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:07
Static task
static1
Behavioral task
behavioral1
Sample
email-plain-1.txt
Resource
win7-20231215-en
General
-
Target
email-plain-1.txt
-
Size
380B
-
MD5
e0ccf410435819d674fde2780a14069b
-
SHA1
c08c884cc285a0dbc44be6d864be57f086ec9386
-
SHA256
a7f86189cab52aef63ec509876d3b0632efc1688116b4df839fef4fb658360ee
-
SHA512
c8e1e5570d2c0890ead674a90c7fa32dcce7a35f9db3778aa5a07c4d08caa33967cc0b6649717d3991ad24bd31be04616f567477da77c9477a11e709ecfce74d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2380 chrome.exe 2380 chrome.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe Token: SeShutdownPrivilege 2380 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2380 wrote to memory of 2356 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2356 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2356 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2652 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2596 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2596 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2596 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 2656 2380 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\email-plain-1.txt1⤵PID:1628
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6b89758,0x7fef6b89768,0x7fef6b897782⤵PID:2356
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:22⤵PID:2652
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1444 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:82⤵PID:2596
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:82⤵PID:2656
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:12⤵PID:2988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:12⤵PID:2636
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:22⤵PID:1976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1380 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:22⤵PID:2312
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2148 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:12⤵PID:1644
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:82⤵PID:1092
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3416 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:82⤵PID:708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3712 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:82⤵PID:1040
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3612 --field-trial-handle=1376,i,11416227511344624883,13624002925848402416,131072 /prefetch:12⤵PID:2024
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
363B
MD50b45a7973c786cc59b013e7926857cc4
SHA1884d0307c1205766d61a20e5e17ee0cc34fe0dfb
SHA25688e424ea094fbdd388c7b6e833bd94eb57e75c651d056209aaf5e6b327259aaa
SHA512618af7b6d97c1f644d72802e6085022eec25d122f889682ddb85b0273d5f446179d6e740d8f0957fcef5ae4d438d58210f59ffb2412aa51aa06ed84e5815a3ac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD5ba6f0b87b2c016313f05fa70a6ea7a79
SHA17f18cee1e04575c38d9f0eb232a610ad217f65fd
SHA2564c6db3b730bc141a5c9e0f489aa020828df360ceff6b0d0da91c5f756280e1cd
SHA512535e3a11fbbb9f3b440e62a99a6f787a47582c0bc5c178bdb756f43ee3f02e81de506ecfe05a413833369f8655f9c5b6fa263062f0ad873e6a76bbdc5a887a43
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD500ec1d26084a6dd468f9901c3d19635b
SHA1d5faf3487705a8aba6fd2b3309fb736fda47635f
SHA256830ca6e3fd7600d010522b00f661fea256648ded2fe72b98687578516d4077e9
SHA5120d37fd5aad43af5d63a90405d9c7ea9948f3c8a2a6783823541beeef9cc7d3debcf45853c43660b39c071a3700cddb0bc02d719aa400e587b67d385f63430455
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Temp\CabDDF2.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarDE24.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06