Analysis
-
max time kernel
300s -
max time network
244s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-03-2024 05:21
Static task
static1
Behavioral task
behavioral1
Sample
open.gif
Resource
win7-20240221-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
open.gif
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
open.gif
-
Size
43B
-
MD5
325472601571f31e1bf00674c368d335
-
SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
-
SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
-
SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133540033119201082" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4584 chrome.exe 4584 chrome.exe 1568 chrome.exe 1568 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4584 chrome.exe 4584 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe Token: SeShutdownPrivilege 4584 chrome.exe Token: SeCreatePagefilePrivilege 4584 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe 4584 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 4144 4584 chrome.exe 91 PID 4584 wrote to memory of 4144 4584 chrome.exe 91 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 972 4584 chrome.exe 93 PID 4584 wrote to memory of 3608 4584 chrome.exe 94 PID 4584 wrote to memory of 3608 4584 chrome.exe 94 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95 PID 4584 wrote to memory of 1672 4584 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\open.gif1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7d609758,0x7ffd7d609768,0x7ffd7d6097782⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,175131843936395358,17901941852905099549,131072 /prefetch:22⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1868,i,175131843936395358,17901941852905099549,131072 /prefetch:82⤵PID:3608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1868,i,175131843936395358,17901941852905099549,131072 /prefetch:82⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1868,i,175131843936395358,17901941852905099549,131072 /prefetch:12⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1868,i,175131843936395358,17901941852905099549,131072 /prefetch:12⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1868,i,175131843936395358,17901941852905099549,131072 /prefetch:82⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1868,i,175131843936395358,17901941852905099549,131072 /prefetch:82⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4144 --field-trial-handle=1868,i,175131843936395358,17901941852905099549,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD59fce6a918285c46081267bbea9a25bb4
SHA14ca2092416ff330f2b6c7bf7cf280734e78fb2d2
SHA256dbcd168fa2c0964b4f7f06c8991fdde9ba9bc55cec455e6cd7fbdb638d059f7b
SHA5129b7348bbdddf998efe4462edcfd5c58730bc149f7a57ad84290c89d4408d585a6fff100ee8c2c56e84699ec18c04d683b71e53106cf1b2e02fbd9fcc9854c0b4
-
Filesize
6KB
MD52221668de62e1963a28c60eb464b4ba1
SHA1d28ca02b24bece0683ebfa3a1e0a50d4510a39b1
SHA256032c13658ecdc6eb3d0b064eb4f5fd4b437625e80a191c9c25d0d4304952bb6e
SHA5123d72340b679ea02a0bcc73f36d886f245f4a61a3e6dfc7c334dd5cd50604869b480a602e7fa552b8694f4156c2206745bd6ac8a8efffa087b11d53e8d9d6994d
-
Filesize
128KB
MD5a734f7df6d88d76ec9da64cfa369f6b3
SHA1a16ee2d89b1d70c11a7b0e5b6f00db0367afb079
SHA25639447614c7ba71cd0b0e4ab24cf3072ada91c663eddb8b6eec953406111cbd80
SHA512dd53b2c94c87d9eccf55e455348b6ad7acaa224bd09d79abfd2621535ec5ccaeb72ee2aa6ad00c965aa33a37bc51f62cb71259946ce9ce597fa76f46d6247891
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd