d7a06ef8fdaaafedea3b522b7411bede856bb1d0f18d8b7216c20255947ee517

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe
Size

133KB
MD5

0e525f27ba5a4c4d0ebca64a61174da0
SHA1

c98cb1a9b04c685dafd486c2f51023653f4e763c
SHA256

d7a06ef8fdaaafedea3b522b7411bede856bb1d0f18d8b7216c20255947ee517
SHA512

108bc37bb02e2a347aadb81ada4985f34fe96cf7a8c61885418a6601867289494ce4d986982fbc4752b12ee018cdb24b11d090cf38b6f34e51e72493da46ff81
SSDEEP

3072:j/Mi8bgXxbzsAQmxtM792e3lHV6N6/bSLmW3u5mW3uDn:jUDbmbzsAQmgvlbBb5mbr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528359341340258"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1136	Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe
1136	Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe
1136	Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe
1136	Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe
2044	chrome.exe
2044	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4848	2044	chrome.exe	99
PID 2044 wrote to memory of 4848	2044	chrome.exe	99
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 1208	2044	chrome.exe	100
PID 2044 wrote to memory of 4616	2044	chrome.exe	102
PID 2044 wrote to memory of 4616	2044	chrome.exe	102
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101
PID 2044 wrote to memory of 4464	2044	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe
"C:\Users\Admin\AppData\Local\Temp\Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1136
- C:\Users\Admin\AppData\Local\Temp\Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe
  "C:\Users\Admin\AppData\Local\Temp\Zoom_cm_fo42pnktZ9vvrZo4_mpvO3WLryHB+pXxvx3I-BNrdqHnVvLdMz7q5F@VY+o66Y7VAEWthp6_kb14d362cab0eaf21_.exe" /normal.priviledge
  2⤵
  PID:1336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0x104,0x128,0x7ffa30f19758,0x7ffa30f19768,0x7ffa30f19778
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3268 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3260 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4036 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4912 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4824 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3468 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 --field-trial-handle=1912,i,8429521318397606660,15343134454400567315,131072 /prefetch:8
  2⤵
  PID:4452

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
706B

MD5
e3358ef582b4fed0791d0e96f5a23443

SHA1
9b28e65335a06f95012015c7aa481514558455ce

SHA256
fdc4e5862a37a13c91a7451e17b832cc78af369c1c2d3f377a990f0ceaa1eb8b

SHA512
7111126c17d988e293e1113ace12d4423a4bfa5ff0f3f8a3e4c42e6e3b5d151b55882c31469753cd95c2e86c5b252069d200128430246df5600d503f42cde569

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7d96089e9d15974e63d2bff74cc1f916

SHA1
ee106c6cbb7eb98af1466d43c4aa30a1ad41b12d

SHA256
b22bf095ae25023a1de4f84e76c3655948e34da26f1e5d311282b916e9bf0b56

SHA512
35bbd5570a12f6c92cda0da1a05b8ad10cbf5faccedb194518b2fc4be51791843dbc7bce135dace1d01770a0f40bca61b204d485ba2cd00380674cff4a27a23a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a1ba5c3e32b7421b6a9dd2b4477f357e

SHA1
10fc5d781a42f4253904eac3989fe2c6a2a24767

SHA256
27426a1456fb99aa6c51560fe223df90c21735147e78317a2349678975940ac5

SHA512
8b3e32dfc2b9bda418dbcbee7476f57419f4b64540b74e65ac19f7ceb2a363b12e20858670a8d18378eec01f52bb18177cf07b94aa7f662a056a354ec244f4d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
b7e2e29cffb236f3ab3d04c5ffe884ea

SHA1
45cc90014db47afe69dab9d0b9484d3ced322431

SHA256
9c9aef24606c490ba079db0762c15d6791f190651d0fe0ca1ab3c4425872b35a

SHA512
f0e6dac0937eca419ce6dcf800686188f341c2e701c1b9892fec1ed9d3a721072ffdef82cec9ea32b2d10bbd67b6715daf6ae92499ac5b93575760cd233aa929

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
58a73da82bf49e77f11acb9c35688a23

SHA1
f9160c264c5bc6c474f4814e4999a6af7832288e

SHA256
b8bcdc5e7c339a308957c83c02786442be0bb7be7c4510b6249fdff70fe790d5

SHA512
0b2104d0d50943fa4cc4c4abedf17e98214e667f0ac5cc81d9d6b7c666418d919e8402b97bc528ab48bd7e674f7144629dd7f9359b5066683b8650b89a1a7735

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit