Resubmissions
14-03-2024 22:37
240314-2js8asbc83 714-03-2024 22:36
240314-2jbcgsbc68 314-03-2024 22:34
240314-2g4agshc6v 714-03-2024 22:29
240314-2ejs3abb53 314-03-2024 22:22
240314-2aenjsba29 7Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20240214-de -
resource tags
arch:x64arch:x86image:win10-20240214-delocale:de-deos:windows10-1703-x64systemwindows -
submitted
14-03-2024 22:37
Static task
static1
Behavioral task
behavioral1
Sample
sscserviceutilitiy_4.30.zip
Resource
win10-20240214-de
Behavioral task
behavioral2
Sample
sscserviceutilitiy_4.30.zip
Resource
win10v2004-20240226-de
Behavioral task
behavioral3
Sample
sscserviceutilitiy_4.30.exe
Resource
win10-20240221-de
Behavioral task
behavioral4
Sample
sscserviceutilitiy_4.30.exe
Resource
win10v2004-20240226-de
General
-
Target
sscserviceutilitiy_4.30.zip
-
Size
936KB
-
MD5
37bb9a60ca4c12ccfebc3525d3471ebe
-
SHA1
893d65250d8304ed0ef86f1f1a16491ee7db4459
-
SHA256
8fc3b1fa5ecb087e05099a67e7b39a8b452830b2e36c50a1c2c5f179c74e5402
-
SHA512
d853ef9e5447c337cab104f3eabd0dbdf71dd70fc94e9e28f97bf6bf14dc1b63878642a831d34764c00df95c2525ebd442ad946142ffba936269f352e3cf9f0d
-
SSDEEP
12288:aEKU/P6S1pHJYWVJixGmTzK0f5lRY68AD75+Vm0UFAXVN8qh7KKncarSFDkV:rHt1lJYQyKAxwVmu3npeFk
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133549294649715580" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4004 chrome.exe 4004 chrome.exe 4164 chrome.exe 4164 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe Token: SeShutdownPrivilege 4004 chrome.exe Token: SeCreatePagefilePrivilege 4004 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe 4004 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 1436 4004 chrome.exe 76 PID 4004 wrote to memory of 1436 4004 chrome.exe 76 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 2996 4004 chrome.exe 78 PID 4004 wrote to memory of 1300 4004 chrome.exe 79 PID 4004 wrote to memory of 1300 4004 chrome.exe 79 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80 PID 4004 wrote to memory of 1484 4004 chrome.exe 80
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\sscserviceutilitiy_4.30.zip1⤵PID:5064
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc2ddc9758,0x7ffc2ddc9768,0x7ffc2ddc97782⤵PID:1436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:22⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:82⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:82⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:12⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:12⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3904 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:12⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:82⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:82⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:82⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,13719187059987947057,3061997916212014717,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1017B
MD59e46600c5c76174cc200501c162abce5
SHA108c8a81781e34b8a7fe060a6ed9097a11fd77ec6
SHA256990f7bdc3c680cea1c1d5c38679c243d14c0e2a0cca9e2eb72270e89bef48ecb
SHA512c3e34ed24b830803d21d818090308288681edec02479a354b40733febf3ae4b7906addc428975f9fa30e95cc846490ed6a36bb2627a6b739c3a2f5fac25a3b86
-
Filesize
369B
MD5fe1e1bef076c92303a6dec09f10b98c2
SHA15973c4ca7dc99e128271d25407c3c943a417bb5c
SHA2569c732428943e3df804ab540df51a96b32da846af683696bad1fe1bc375a9a436
SHA512279eabb516b2a01eebd8e5cee37f7a23b2066929379742722c755fd1535224937f511c8b20602c757b7d4718b77749eae57b6954be64c8d4bca7b1ef97a1dad9
-
Filesize
5KB
MD5f355279572cd0e2807c9632ccde0cca5
SHA1ad877e3959b53a64f6cc9c1e9d4db1c81f6082ab
SHA2565294450bd51adc4b41750f474e4aa2933f6a830b6bc6b5e6f4e3b4cca0f5556d
SHA512fafd23c0217dfa5f8cd391138c3075d320bdd8b18a67a90d03eb53e585060bfe938415bd73828a33d1ca4e10d967bb56e44a3fd439f1002d046b6a2e5f2b8efc
-
Filesize
5KB
MD56a24b9c69f228f7ec8332d129bd09bd3
SHA1f9a79a626e8d4e45e4ea38ac8ed3c940c1370605
SHA256ff61d48ee0b323e3bf07e2bc5b8e08a41e1c1eff6f15484308149f147f79460b
SHA512501cdab170cc651514fd90b3670fe87fc8344a9699c47f5f6aad2d9dd3e018d87265f7c38bdcd2ad72466115b974377885725587bbf8bd74e9f216ad178b87bc
-
Filesize
5KB
MD50ffe0ff6eb39bc17a257a2fcbe456745
SHA1e0705a66096ca729d955e9c292903404e51b4814
SHA2563aead86a857b3bb9d50316a23afc28766fd0ed43ce4a5495e567ead14d415a56
SHA512d0c221d31770cfac2b21b6f1e98ecbf22f3e3640c648c7c5c612646c9ffe14a8661082c6abb30187e6b89e002aa586d9e1240bf0f8761606307ec4db8caf98d3
-
Filesize
12KB
MD53eef37f0a2aa5e83074fb830c423ef9e
SHA1fc5631e0e022e338728f91568507e127171f6707
SHA2560cd1765c66c89259813d93205feabd1ec4c0297caacb3980b2e4dc55a30aa57a
SHA5123d978f4841997f368c14e422ef9c6d1c7ba005091725e725e2b8d5ae13f249318ba105c26f65a0fb95f84f4396ce2e04494f8ea96115d3b7a155892d4cb318d0
-
Filesize
258KB
MD54aa316d3778fc334b54a9272a4103543
SHA1976fb915b36e2dd7cb4c26126d24f005ae7414bd
SHA25658036e13d499af717b9f22facea18933cd5aafec904b5909275a5aa9f77db4e5
SHA512840089d95d3196ad3379df3210a161a317d24d1c2a4fdead60bbefe01beedcc93c1312b286fcef6d08009fec8bce99f611bee17dbeb9c5245e7f862fcbb2065d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd