hxxps://google[.]com

Analysis

max time kernel
1799s
max time network
1684s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2308	2264	chrome.exe	28
PID 2264 wrote to memory of 2308	2264	chrome.exe	28
PID 2264 wrote to memory of 2308	2264	chrome.exe	28
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2724	2264	chrome.exe	30
PID 2264 wrote to memory of 2604	2264	chrome.exe	31
PID 2264 wrote to memory of 2604	2264	chrome.exe	31
PID 2264 wrote to memory of 2604	2264	chrome.exe	31
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32
PID 2264 wrote to memory of 2892	2264	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67e9758,0x7fef67e9768,0x7fef67e9778
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1244,i,11300602219030926425,4632606525540457737,131072 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1244,i,11300602219030926425,4632606525540457737,131072 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1244,i,11300602219030926425,4632606525540457737,131072 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2160 --field-trial-handle=1244,i,11300602219030926425,4632606525540457737,131072 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1900 --field-trial-handle=1244,i,11300602219030926425,4632606525540457737,131072 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1480 --field-trial-handle=1244,i,11300602219030926425,4632606525540457737,131072 /prefetch:2
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3188 --field-trial-handle=1244,i,11300602219030926425,4632606525540457737,131072 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 --field-trial-handle=1244,i,11300602219030926425,4632606525540457737,131072 /prefetch:8
  2⤵
  PID:900

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
225KB

MD5
8ad0a029c389d5fb20b2952677d4ce97

SHA1
d9e8e2c266d6582c5e0b61d5688373bfa648068a

SHA256
3e27c85773326eba673d918c7ef57804ae4905916eed094a8ef17f00e11ac793

SHA512
0f21dc547d68b8fc15d064fa5ae20fbe24a1f082c8626b469b2560de6a0081babaa212d4f0f41a1f2c60834e2cb00aad7304ab0a6e03da2d271e286ebfc9d4e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4438782906e114b26017e2005afb48e5

SHA1
da8e8e892e38062b5285008cc627ed6627e9e752

SHA256
c6d6094bbaae29496f06c93a4c59ddc9a8da80c2ab71cdade1e1d7a7fad76f4a

SHA512
21cb7b2fa8567b58b33523aca99502d43e2bd2c1a8f84f7904f037cf11c3beb80d69bdf2ff4e614dc47103d3372c50bfe53e7165dac3921b78cd408bcfd5f965

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e812015b6122f28a7cee4aa60442a7f5

SHA1
e38779a5ff8191a9805978848aa7ca31fd7a0ec4

SHA256
e4c5c42797cba21c97f28c8d79f50ffc6592f79561eca4c0f0519bf20e133b68

SHA512
c457777877dbdf6524a10b64e497758f5e967dd8289e39efc0f0c6624fc1b7d3fafe3d026dcfd1eb0da01903037e71c6f1d2eeaab7d587f9123e6eebcc9787fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
341383906535185b302d9f10aaa94061

SHA1
24d2f7fbb92600adcf48586c328f50b0eff99b1e

SHA256
aedc20d3f4675e6d48e757376b7b9d895992a34b294eccae5176995de0cf2333

SHA512
d6c37454240080a11f811bba85ce62b41aa1556cfccf82e3bfd505ed1c38a54cb761003a804d6f521b692088be811e30cc70316218bea6e0d7d6ee6e6ae783bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
33731161237bf74ea54ed2f6f66fd74b

SHA1
80dbfd2233849d2e243e8149729af902f2ad9fd3

SHA256
10b44794e393a5f06f7c9aad19b56f96fef4aff81e8f7ebcf63bf3f7d2fdc454

SHA512
0285c8b8500852fd93068dd14310558f8301150b96137d1e1864f07c24baf7b9084b701d06939b5f9be5e7880121ebc3cf9eda6cc99d66ae3742650635564d4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit