Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
01/03/2024, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
gift=7260687445
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
gift=7260687445
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target gift=7260687445
- Size 15B
- Sample240301-ven98aab8s
- SHA256 19c6472b091707c76d91d6369280d6b9047a384a8fd2b160c28505fa3ad27089
- MD5 3d8930264db75eebfdfd47dab83ba640
- SHA1 e3c89df6c1f8bbf026d24808470f121f1489e9b9
- SHA512 6a73b665ab4e7f3dae0df147e4daf33b8a8fa80b99724c33e3b81f44aaeee01da003b2cd3ca175e44df2fbce60af7a827bdf508ebbd9f7da1bf36a17a097d372
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133537857805780737" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5052 chrome.exe 5052 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe Token: SeShutdownPrivilege 5052 chrome.exe Token: SeCreatePagefilePrivilege 5052 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe 5052 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4888 5052 chrome.exe 97 PID 5052 wrote to memory of 4888 5052 chrome.exe 97 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 4244 5052 chrome.exe 98 PID 5052 wrote to memory of 960 5052 chrome.exe 99 PID 5052 wrote to memory of 960 5052 chrome.exe 99 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100 PID 5052 wrote to memory of 2492 5052 chrome.exe 100
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\gift=72606874451⤵PID:224
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb43989758,0x7ffb43989768,0x7ffb439897782⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:22⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:82⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2292 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:82⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:12⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:12⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4628 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:12⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:82⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5220 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:82⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 --field-trial-handle=1916,i,3195452690531642122,11929314735861521633,131072 /prefetch:82⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4072
-
C:\Windows\system32\sethc.exesethc.exe 2111⤵PID:1028
-
C:\Windows\system32\EaseOfAccessDialog.exe"C:\Windows\system32\EaseOfAccessDialog.exe" 2112⤵PID:3660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 371B
- SHA256 4af0d50fa54e639af29eede8e684f53cfccf582bf5983f495619814cff586faa
- MD5 64cfbd890cece702b0ee5c0096abc91c
- SHA1 de7ec231a826d69e9b40440cd932b558686e99b5
- SHA512 bf2bd4f1b15955f073793564965207bd16a474ed28ee7797eebdda8ed3c686c26e06742320dae675fe5e3555a7e790b4d2037fef3b9a1681da6a2ed8b36a2ff7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 d4e84f3866ec9a9e9e039735bf7b2d2c55bf54f044eb50c8c901dda30c9024ab
- MD5 6365c2aa8223f18933b9234277018e1c
- SHA1 53299559793c1ea02ab98eb48cb5f71c654cee26
- SHA512 82820f3e2fc2d487648f97c406d8f85398e550333e284b34240869e506cb64335dd2d8e7c395adacf4cc802c6e1aacd06b8dd3fbfa985846d425f0bf14bab1e4
- SSDEEP 96:y8WC0XKGE/EtKInT38iZRy7Di+6MsmdeFOuthjVhYtjEsXt0/cg2Vup:y1C0nE/wx8syy+FCotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 ace76f3819ed68abd752767c28f69085bf3b98bee2e68585bc80bd8155f17893
- MD5 295affaad901e157b4ef565e2a3a4346
- SHA1 8c180586ca2fb667317bac9086323449c952166c
- SHA512 ca25a545e5f54c45c78c577a71c6bd113d7dcc587412f84d7b65a81d36350c74b88ce26ea9494efe043bfdbceca345a019ff78c583d70bae3730ae04da00aac0
- SSDEEP 96:y8WC0XKGE/EtKInT38iZRy7Di+6MsmdeiIOuthjVhYtjEsXt0/cg2Vup:y1C0nE/wx8syy+FDmotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 7a9bea6606d86ec2d5e3c8d11b354fe9499d4f6c64a0cfa2260cb5e68ee1caee
- MD5 f42b0c14ee0e65d66c65f0fd0f58fca3
- SHA1 c9a713f790b5860f340b7ba95fa6c88f3e8ee73b
- SHA512 a91fa09d22e11b8266f35428bc55f02bb42b91872e170ad760fbe0fcfae17bc88efbda6224fb3bcdd75e88276f49cd07407487c698224b944b5737a794a570ba
- SSDEEP 384:ugLPLevX71kXqKf/pUZNCgVLH2Hfk2rUUVHGWOD+fM1:5LPLQ71kXqKf/pUZNCgVLH2HftrU0GWu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 254KB
- SHA256 6a12ada19a2693f477cc2d4ecb806efb9b40d8d6644ecb302db9a99486bd13ee
- MD5 aef5d872964118b30152eae1528f48bd
- SHA1 05e27f9d71d1ce29d52001d5d05fc328ebc01992
- SHA512 09dbbe8c87af7fe4bab8bcfa5dc199e4faf9dd530d520028803519ff408b1d1cd14b3fe769893c807c6c553aa96ded94867def57bd370e4fe8bbb76c63634e42
- SSDEEP 6144:OLqSrNZJGjm9epulr3gGtLIASNdvXCNpbMHtCMpSG:gqSjIa9epUgGeASNdpHtXD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512