Analysis
-
max time kernel
1792s -
max time network
1802s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 19:28
Behavioral task
behavioral1
Sample
chromewebhelper.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
1800 seconds
Behavioral task
behavioral2
Sample
chromewebhelper.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
tool.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
1800 seconds
General
-
Target
chromewebhelper.exe
-
Size
797KB
-
MD5
e3b8b6e5e354fe993459d9eb0bd1ee3c
-
SHA1
cc2c9c7020fc79e1f46974a13e6ca3f14aaaa6d5
-
SHA256
5499a64317fd7fa44767bd4c10ad4803115b00b4ea36bde635b130742d432de7
-
SHA512
43ca2a53aaac526f1ad143d19f4f3f1bd09f5d7ba91ecbb08b72a38e2e64f920e7bd0ce2240af97e13ab66b6e7f189279fc02c037d48886cace5840159b292e5
-
SSDEEP
12288:kZrULMF1bEdXSD0v9qvVvm/G3FBCBLyPYe6qFz80COFuw5nMtpnHYhaa:kYMrbGXSw9q1m+qLyP1r80CO/5nMXnC
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe 1716 chromewebhelper.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1716 chromewebhelper.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3136 taskmgr.exe Token: SeSystemProfilePrivilege 3136 taskmgr.exe Token: SeCreateGlobalPrivilege 3136 taskmgr.exe Token: 33 3136 taskmgr.exe Token: SeIncBasePriorityPrivilege 3136 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe 3136 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2204 1716 chromewebhelper.exe 96 PID 1716 wrote to memory of 2204 1716 chromewebhelper.exe 96 PID 2204 wrote to memory of 4772 2204 cmd.exe 98 PID 2204 wrote to memory of 4772 2204 cmd.exe 98 PID 2204 wrote to memory of 412 2204 cmd.exe 99 PID 2204 wrote to memory of 412 2204 cmd.exe 99 PID 2204 wrote to memory of 2816 2204 cmd.exe 100 PID 2204 wrote to memory of 2816 2204 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\chromewebhelper.exe"C:\Users\Admin\AppData\Local\Temp\chromewebhelper.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\chromewebhelper.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\chromewebhelper.exe" MD53⤵PID:4772
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:412
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2816
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3136
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:3088
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:1136
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:3604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD57fd9cd05f23d42fb6deda65bd1977ac9
SHA1df25a2c9e1e9fa05805da69ff41337b9f59755fb
SHA256ca6c469655d4d0d7ce5beb447dab43048a377a6042c4800b322257567ac135d9
SHA5126ae8addf0c55058803305f937593ba02202c99639a572be0cacbfde598019cf8db7067e0392bd66c43cf7d8780e454ec5e08d68bcfd491b60a450ffc280c81b8
-
Filesize
441B
MD555b0d9bfa7a495b65309b336c1745003
SHA1e0b8c26a8048cb4b98c5123850a50fa588296035
SHA256447f8465aa51ac848341390e3ffdb6f691ddc307719e78734517105190754823
SHA512d2ff574cbef783a9bce1e0c05b3489d4957db48bd0867787cd40c2c89dfe15b4838554f9a05651894faad2488bc265604621e15ae1f304eb2f4b2997b2432ba4
-
Filesize
1.2MB
MD5a4426e6c815ee0e47ba36c1b59cfc719
SHA16444c7e0442c9bc665e68d2f8ac3be2e9c0d5cde
SHA256fb14185282a6c7497b5ad494396c85851118dd3169ad3ef25b289f7566249336
SHA51235cc2de20b6c3a8f9197cbbd83e4eb8d06478bc49a2b471a1bdde41f022063bbcf194fde3f2e9a316394660ae9c58e427db14915114f69dae6128ed25d66925b
-
Filesize
1.1MB
MD55c8f2b3cb7efaa2f9e2ebbb8adb000d9
SHA16a55448ebe20f2e95f5ec3ed54764fb6711d209f
SHA2563a33f5bcc132091b06d393a398d7812eec7ef69c4ef4e1c0d9905b9168644da0
SHA512704cd1d92bffcb18ba47072ee0148228395c94d772a175dd0da07c72799b036251bafe775bc49fbaf9143ea73d3a0b55193c8f37d04272a6f63d3aa0d5da092f