Resubmissions
06/03/2024, 19:10
240306-xvh49agf8z106/03/2024, 19:09
240306-xt72zsgf8t106/03/2024, 19:09
240306-xtsbjagf7y306/03/2024, 19:07
240306-xslglagf6v306/03/2024, 19:06
240306-xr9sssgf51406/03/2024, 19:04
240306-xrdqcsgf4w106/03/2024, 19:04
240306-xq39magf4t306/03/2024, 19:04
240306-xqwvjsgf31105/03/2024, 21:33
240305-1ect3sah83705/03/2024, 21:32
240305-1d2rtahh8v3Analysis
- max time kernel
1799s - max time network
1684s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
06/03/2024, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
unnamed (1).webp
Resource
win7-20240221-en
windows7-x64
7 signatures
1800 seconds
General
- Target unnamed (1).webp
- Size 7KB
- Sample240306-xtsbjagf7y
- SHA256 f425fe60d959b2354f3012877931e7308c1e8b34df5cb63d4c50e9f191883509
- MD5 80ad08efe9e002ce033654088b37e8a5
- SHA1 8ca558271c99f9f13634f3343cfdcfeb95b444d3
- SHA512 be975abbf63bfdff42b51c64a24fc1e15245ce54f539f8e17703300803641ae58ba44e5a20c6dd7461610c5c008e83e190230eacbfee8eec82b5b4626d530cc7
- SSDEEP 192:zw7/f+TbCuGltVy28CTB7KFMQy6Kf4+q1oasu+5rWXtj3QVP/NS1g:M7/f+nG/Vy251ay6P1N+ubGig
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe Token: SeShutdownPrivilege 2624 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe 2624 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2624 2096 cmd.exe 29 PID 2096 wrote to memory of 2624 2096 cmd.exe 29 PID 2096 wrote to memory of 2624 2096 cmd.exe 29 PID 2624 wrote to memory of 2656 2624 chrome.exe 30 PID 2624 wrote to memory of 2656 2624 chrome.exe 30 PID 2624 wrote to memory of 2656 2624 chrome.exe 30 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2452 2624 chrome.exe 32 PID 2624 wrote to memory of 2500 2624 chrome.exe 33 PID 2624 wrote to memory of 2500 2624 chrome.exe 33 PID 2624 wrote to memory of 2500 2624 chrome.exe 33 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34 PID 2624 wrote to memory of 1300 2624 chrome.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\unnamed (1).webp"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\unnamed (1).webp2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ad9758,0x7fef6ad9768,0x7fef6ad97783⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1368,i,17346896099770454461,15570578415110746017,131072 /prefetch:23⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1368,i,17346896099770454461,15570578415110746017,131072 /prefetch:83⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1368,i,17346896099770454461,15570578415110746017,131072 /prefetch:83⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1368,i,17346896099770454461,15570578415110746017,131072 /prefetch:13⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1368,i,17346896099770454461,15570578415110746017,131072 /prefetch:13⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1168 --field-trial-handle=1368,i,17346896099770454461,15570578415110746017,131072 /prefetch:23⤵PID:1924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 --field-trial-handle=1368,i,17346896099770454461,15570578415110746017,131072 /prefetch:83⤵PID:580
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
- Size 16B
- SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
- MD5 aefd77f47fb84fae5ea194496b44c67a
- SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
- SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 987B
- SHA256 5a57b56c084a299ad4917604d4a87915bf5d2d36ac3d0b1f89e34513c2aac3dc
- MD5 6d27672b2c1fdeaeea51f605cd513745
- SHA1 a64b139088dfb658f608f86664cb6d183623c45b
- SHA512 3f5f05337bdd09e9355070d436c08d541c6fb8f7e54f1410e0d5bb09961687e60c250dd28776294420eea654a59129fde008cdedbce6b5141d943e27f4e23f7d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 987B
- SHA256 a6e05bdadf7a30653429531055ea6085064368a9825998d7e65b85ac5ff67309
- MD5 5769c1d5b0c29730aeae3a8618af5e8c
- SHA1 e1d2d3d5d084e64bb13d267cc1c509cd96c4dfc0
- SHA512 fc9fbbc6a0ac3062789529c9440b26dd727ea6b59c48cf791b767483ab587b74d44aceca4676e257a46082900afc6388995f49e6997f027adafbb899803f4bbc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 b04dc7343c9b5d1d66c2ea0da2562667b22704da7b6c397fe4c90e4f06950384
- MD5 e1cbe221973df90da4512b5fbcac3ed5
- SHA1 18092c54c8f730535640be6b42f3932af40ad17e
- SHA512 0b921fdde6d17d20c5283d26ee45e3e7487b21c24cb42664fcaf671bf120b9c5e15859e176afc4d268bb11ee8f4188a2f14f32fb3bbc650ac4898fa4544a6193
- SSDEEP 96:pLKkRfKI7AEd8iZRy7Di+6MsmdedmIO0MgrFjVhYtjEsXt0/cg2Vup:NKmfCq8syy+FSm6BZotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 209f7894e4d3655f598cdf9f73e94c75fff788639abb7eeedef05b7164ce9cba
- MD5 977910d4f640bcdeff069df9649feb0e
- SHA1 c2face8422572c25716a412975786de6efa3ab97
- SHA512 bb4e58cc4d792dded63e2633a0a428033d679fb6f52dc5df31b2e3e39fb9d013deed2e40c24ddd5930a4c1a1e64fc86f434528446333ba84c97e9026a41d9194
- SSDEEP 96:pLKkRfKI7AEd8iZRy7Di+6MsmdedoO0MgrFjVhYtjEsXt0/cg2Vup:NKmfCq8syy+FSaBZotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512