Analysis
-
max time kernel
124s -
max time network
363s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 13:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Shopee_free_hihi.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Shopee_free_hihi.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Shopee_free_hihi.exe
-
Size
2.2MB
-
MD5
56ffed3f64959151cd6edffa97566df7
-
SHA1
e9842d6b6068979bbc88247d728984731c6c78d7
-
SHA256
839c97b7e50491903141a4168f677bddb9af70aaa015fa11baad45ff3274966a
-
SHA512
7dbec6477a5969c14a052c363d8e5b4aaed1d3a746ce1e32bf305b20a22053a4124217ea3422c43ccc643735f0d0efb22e6ce6bdac47766cdceac832c2302a01
-
SSDEEP
49152:3LBhwDZE6XgZHUjvneyBWqHwCzEnJppW8u9i/9hnFMvk47MzrXf:3Nhw1eQWq3svWaznFi7Mzbf
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 2112 chrome.exe 2112 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1128 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1128 taskmgr.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 1128 taskmgr.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2140 2112 chrome.exe 40 PID 2112 wrote to memory of 2140 2112 chrome.exe 40 PID 2112 wrote to memory of 2140 2112 chrome.exe 40 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 1672 2112 chrome.exe 42 PID 2112 wrote to memory of 392 2112 chrome.exe 43 PID 2112 wrote to memory of 392 2112 chrome.exe 43 PID 2112 wrote to memory of 392 2112 chrome.exe 43 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44 PID 2112 wrote to memory of 940 2112 chrome.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shopee_free_hihi.exe"C:\Users\Admin\AppData\Local\Temp\Shopee_free_hihi.exe"1⤵PID:1540
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2496
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1128
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4e79758,0x7fef4e79768,0x7fef4e797782⤵PID:2140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1356,i,6224528424250904887,14995759337812702355,131072 /prefetch:22⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1356,i,6224528424250904887,14995759337812702355,131072 /prefetch:82⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1356,i,6224528424250904887,14995759337812702355,131072 /prefetch:82⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2180 --field-trial-handle=1356,i,6224528424250904887,14995759337812702355,131072 /prefetch:12⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2204 --field-trial-handle=1356,i,6224528424250904887,14995759337812702355,131072 /prefetch:12⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1656 --field-trial-handle=1356,i,6224528424250904887,14995759337812702355,131072 /prefetch:22⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1332 --field-trial-handle=1356,i,6224528424250904887,14995759337812702355,131072 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3796 --field-trial-handle=1356,i,6224528424250904887,14995759337812702355,131072 /prefetch:82⤵PID:1360
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5a6c10e70c904a4bd84e73e248a969644
SHA1b75d4fdefababbd86e02a864a6432366ed1be3e2
SHA256446e296dcb49832645c76590ad01a96fcc7bb1d9052e3d6f42d7690b2e83f7fe
SHA512d5b9cf5e6b9c69416ec759e32e1f4442eb8f22bc98ae2b887e7fcf20b79ed50eb9f26f002db9e928f898ff65b9103fa4f08ac056e882f46ebd0cb8197bdb995c
-
Filesize
987B
MD505ba5dad888d9eabcad75050e4f631ad
SHA10ad7fedd3e1d2b7ad088e228778d830f423bc815
SHA2566cd8d765ae8107f5b3fc7159f6193cc63fc7bee46acc251589c083084ddd7f89
SHA51209983dd0e14661904df54c137d4e83dba5838e270110126bff0a1c740299f973ed8e90243286f17920e0f663966ecfd543e9e5428e8a3bc2ac00cba1a30ebe80
-
Filesize
4KB
MD5bab2e2c32eaafd437e14c719c6c58a44
SHA175d4e4671c854b10dd122b1650b224c895ae8d07
SHA2564fd4ecb40bd2e5481253b515329bab7f193a31abf83268e44ab078fd1eea85a2
SHA512c0bfaf9e135b536f892b29703ef6767697584ac47858811f879b2a4a18bbc18f0337e12ea4037b121be995deeef33a32f5339e2b1c84522dc601f8c408745744
-
Filesize
4KB
MD5072dd1c0ec66be2becf94e0d92280722
SHA16422afe0603708ce7d0571ebf367d260d7037f82
SHA2562eacf2b6953eda2097b2aa59a5d742a1d828af0ee8c151f556a45e41f114677f
SHA5123385de1ad44dae91da766675574ff87a3c3f6cfe8badc92d9b4e806930ddc855c1f29778f4c81018bd22dde855ea0acc38446aadb3c2ba3885ed88fadc7a2521
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2