Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
22-03-2024 21:53
Static task
static1
Behavioral task
behavioral1
Sample
s.gif
Resource
win10-20240221-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
s.gif
-
Size
43B
-
MD5
fc94fb0c3ed8a8f909dbc7630a0987ff
-
SHA1
56d45f8a17f5078a20af9962c992ca4678450765
-
SHA256
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
-
SHA512
c87bf81fd70cf6434ca3a6c05ad6e9bd3f1d96f77dddad8d45ee043b126b2cb07a5cf23b4137b9d8462cd8a9adf2b463ab6de2b38c93db72d2d511ca60e3b57e
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133556180136379349" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe 1428 chrome.exe 1428 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe Token: SeShutdownPrivilege 2860 chrome.exe Token: SeCreatePagefilePrivilege 2860 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe 2860 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2188 2860 chrome.exe 74 PID 2860 wrote to memory of 2188 2860 chrome.exe 74 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3868 2860 chrome.exe 76 PID 2860 wrote to memory of 3884 2860 chrome.exe 77 PID 2860 wrote to memory of 3884 2860 chrome.exe 77 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78 PID 2860 wrote to memory of 4896 2860 chrome.exe 78
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\s.gif1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc378e9758,0x7ffc378e9768,0x7ffc378e97782⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1848,i,1277251266777879382,1290017241157049432,131072 /prefetch:22⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1848,i,1277251266777879382,1290017241157049432,131072 /prefetch:82⤵PID:3884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2012 --field-trial-handle=1848,i,1277251266777879382,1290017241157049432,131072 /prefetch:82⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1848,i,1277251266777879382,1290017241157049432,131072 /prefetch:12⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1848,i,1277251266777879382,1290017241157049432,131072 /prefetch:12⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1848,i,1277251266777879382,1290017241157049432,131072 /prefetch:82⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 --field-trial-handle=1848,i,1277251266777879382,1290017241157049432,131072 /prefetch:82⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=932 --field-trial-handle=1848,i,1277251266777879382,1290017241157049432,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
678B
MD5a49c2b038eca72ed0e7764acc4ffdd3a
SHA1e1a5757119adc278d37f545fe62a453858edc7da
SHA256078f384217252cefb1f889c19e1c165911685dabd4908b2a5db63a513c915145
SHA512f5e652b3b2aa8f569f7a0c4bb3e59528b10f81157daafcf10213fe4de587d460042d593f3f90b77f1c92b37dbbc5c6b0e801a692cc1a81422d9340fc08b06eb5
-
Filesize
6KB
MD5c056273208b533aec33f29fc061fd3f3
SHA1d114d6017a1fefd112564088704823ba43169872
SHA25601f4dec510620b595f49c7f6e8e7e2fc8652e2f602ad0177441101ac97dd1cda
SHA5121d3b5f0b687447e17177faf878e96ecc8c5f12222b7dfa42b59b8e26db1ee2d17b9eafdbb2a8a68f8c113160becba13dc056fd45f0d8a4ed610a88c1a2999b21
-
Filesize
6KB
MD50c69c11b3812cdbd06f7ffed0e37bdbe
SHA1a3cf5bc1ea29bb3d663cedf9e9425952c5de6f23
SHA2561d03175b1812f71232d26dd37dbee07f65a0d707aefc58f6d1bbffb0264a9f72
SHA512541fcdfead186c802bb88aa9115cde1a68bbfce28d06e5f3e34dd3276cc4a90a966db00284b732d2d958d9e1e197c48423931b24e3e7504f10482a023fa7252e
-
Filesize
130KB
MD514db7413a4a6f6b26ebf4c0be6d59eab
SHA10fa9f6675a324a9049d1a0ad5afecc1ec6a62bac
SHA256a33a9f247195baf3fb54bfed6a978e988024675edf9ca1700413689f55514bb9
SHA5125e464648dae374b9f9d54a2bbab887b0bea942b4953a1742c3b8028b4aa312ea203d25d69007672dbd298eca73e290f46267696e81a7fc10221f400ae25c45de
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd