Analysis
- max time kernel
310s - max time network
302s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
26/03/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
Flash8-en.html
Resource
win7-20231129-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral2
Sample
Flash8-en.html
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
300 seconds
General
- Target Flash8-en.html
- Size 310KB
- Sample240326-2e2c4sea72
- SHA256 a2a021d0b7a33c8dccca1d280717640fe773129ca10ce6e0682befb90b1fd5ff
- MD5 fe290252aa598316192a02c0f0bfd52e
- SHA1 7587a1613140d0a5a6c60a347ecd663f8dfc5375
- SHA512 9bb4ec8e4479fb839a17998b7624d9606d3c8685512da9da34565437371856b2ff6bd9b2673bad6fad0ee9da93b53d6454fdcd80ea9d0edc3b970cdd9486d8a8
- SSDEEP 3072:4izgAkHnjPIQ6KSEX//HiPaW+LN7DxRLlzglK3JN4:7gAkHnjPIQBSEHCPCN7jB3JN4
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133559659548051758" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4972 chrome.exe 4972 chrome.exe 5092 chrome.exe 5092 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe Token: SeShutdownPrivilege 4972 chrome.exe Token: SeCreatePagefilePrivilege 4972 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 1616 4972 chrome.exe 95 PID 4972 wrote to memory of 1616 4972 chrome.exe 95 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 4932 4972 chrome.exe 97 PID 4972 wrote to memory of 3220 4972 chrome.exe 98 PID 4972 wrote to memory of 3220 4972 chrome.exe 98 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99 PID 4972 wrote to memory of 2932 4972 chrome.exe 99
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Flash8-en.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb778c9758,0x7ffb778c9768,0x7ffb778c97782⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:22⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:82⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:82⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:12⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:12⤵PID:2216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=820 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:12⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:82⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:82⤵PID:5348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4716 --field-trial-handle=1884,i,12811565910730475694,4006366506078391133,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5092
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵PID:5836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 06b1737e7e02dd7863e9a4196a247fab2ae61ddaa4cc284bd2e703dc63864f01
- MD5 afddf9aeb27a6c83e0f5c64b492c057f
- SHA1 825d7e86fa47585d57da6f6e5402d026ffb89da3
- SHA512 8bc6f25eab7367f31a13fb537425ad36ac85fac156b6a1950aff109d2a4e36fb92408a892ba6e224b573a0873f07010b22ec0f1b74095da0dff7706d9fc089dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 871B
- SHA256 9226b609d6d783cbbc5579f860e8481c07b175f0864640a73665dafad0be1ea8
- MD5 d5f963cde5337da7fe12bfe8d65e4eca
- SHA1 2bab75cb8c7729ab5faa5b4cd1c87db73ccc831d
- SHA512 16beaeaa2e7faa897cfe624796603613debff25a23fd52ecb38b2a9bfcd128f9f81f2cbd17c5072a55290e8920ec51505ec2283299f9659232acacda62b47e58
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 fb0246f5abf5fda3e6b7861ebe91792933a880013ac7b9a7d7a4f7f25dd15f4e
- MD5 ff690330c75b709b79369dc915dc1f79
- SHA1 13d321fb8d0cfdbed3c4c6651865b824852ff6f2
- SHA512 ae16e8abecd415358266c62862b855ff5624d1206094083944ce9586d4f0c592fdc5152fd45ce309c6231d5aa6ad58999da5d83976843d4dcf1cbd6a6c79e242
- SSDEEP 96:J96pKEpX7BrVxaRKIvbo8iZRy7Di+6MsmdelO5l16McjVhYtjEsXt0/cg2Vup:76UEpzERG8syy+FrlpcotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 81b4f190dd3cfce4889be0b432c5841dc6bc05497ac556b88ac05300444b1584
- MD5 6de7a2d32ea86c647d373b0070aa60ef
- SHA1 d20bd6a02d70cd29fad519de19d2086d888ad845
- SHA512 a53c71ce0c83ec81b8bb4f8d654a7ee816e5ea711575de7fbb84a6e007a332e1608f213e0b28cf3f2c1a5627a0a4ec7b566d7720c758196b643cf3554782e7d9
- SSDEEP 96:J96pKEpX7BrVxaRKIvbo8iZRy7Di+6Msmde0IO5l16McjVhYtjEsXt0/cg2Vup:76UEpzERG8syy+FFXlpcotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 128KB
- SHA256 ce8d48ba96fc7711b5e43e2b5a2abb6c0525ddae1d20cd31865694df9a8cb86f
- MD5 db1f646fcad0f2a3b83eedf2322869d3
- SHA1 a154dc2876b882f629b9e944343be349790a189a
- SHA512 418bf2b8a57012818fd0e83ad9b2190dfe1eda66f23036b5f6aea333e94fc112417a643100e62ba5bb1e2fe899ae6bcaf2ccef7052abc38c124d0a9656ec101d
- SSDEEP 3072:qn4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+ZH:q4ASNdvXCNpbMHtCMpSn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512