d6350a1f20c252f8f4eae028dc1853d9df18fcb1e05024903d17cc83ecbc644f

Analysis

max time kernel
65s
max time network
146s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

image_2024-03-29_142007030.png
Size

94KB
MD5

c27a3f81eb46a72f79c55c575d10325a
SHA1

aa83f7476b2cedc042ebfb29989424428bdd796a
SHA256

d6350a1f20c252f8f4eae028dc1853d9df18fcb1e05024903d17cc83ecbc644f
SHA512

00145bb5d1c48c41bcc56fe7e9acef4b22a32bf6ee8a8e627bcb50337ae7756bf10b2363b0b4820ab92ced7b952bcd9ea40931142927d291bc1b07ad37bffb71
SSDEEP

1536:rinleNjZNDjqjSsHWsRwubW00hDHXJrLc1Itqbg7cLuZXRP4IDg7pJ4Uf7CBHpWP:ri0jZNDGjSsHW5iot3dbHDmEdBJAehw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2536	chrome.exe
2536	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1288	rundll32.exe
1288	rundll32.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2592	2536	chrome.exe	29
PID 2536 wrote to memory of 2592	2536	chrome.exe	29
PID 2536 wrote to memory of 2592	2536	chrome.exe	29
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2616	2536	chrome.exe	31
PID 2536 wrote to memory of 2476	2536	chrome.exe	32
PID 2536 wrote to memory of 2476	2536	chrome.exe	32
PID 2536 wrote to memory of 2476	2536	chrome.exe	32
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33
PID 2536 wrote to memory of 2496	2536	chrome.exe	33

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image_2024-03-29_142007030.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6759758,0x7fef6759768,0x7fef6759778
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1560 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2144 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2152 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1156 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3328 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:1
  2⤵
  PID:600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3700 --field-trial-handle=1376,i,12858422669980248557,16730276933548366049,131072 /prefetch:1
  2⤵
  PID:1828

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
697B

MD5
252aefd3a9fc0c61931f78417d8aae26

SHA1
66ceff6fd64b582b9a10529de0e07a860af5b933

SHA256
d22d60d98bffcf36623e2992d026501da09d2af011d538f6e68af682a6c21b07

SHA512
4026ff65944300136a837d35fd325ae24f5324e9c1067f8f2c5620454cbc2fcdb89649bfdaad3a283a5915a43c0387ad3f57520085377e05e32eed4570ba6364

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
5b66ae30e6001942b3aedc7f28fe1b92

SHA1
dd0bc48ea1f87192810c25ea7b5d877688701d56

SHA256
ad253d99484699e651e1b017b341da90ec3a61684fa4f66c652309a813a330c9

SHA512
cab42a7beb62a643b9c832885fc9e9b01cae314ff116c49188fd9c0a871166f7f5bb6b0e0672a1d2f611ef186730d4476ca34fd9ef5b117166a0fbb97a2da334

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e2c5a3d5bef1d2f8e48a0b24cc9bcb2e

SHA1
2617fe67472b5c1041d3db3358360e6c90b8f528

SHA256
7ecb43350b60806275ef2dbce1a6ef5ec07766773686a0dae4013f83b1ff070d

SHA512
ef85452ee9f76f324aad3b464f179579bf13408b8a3081dc3c2a6d5683bbb03d8b58c35be4a3e8b47e26f4fe95a7320cb0ade8fbfdf3c0f8d83f428c4255cf4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e2a50bac90716c48f3adc926ea4bf7fa

SHA1
ccbb0f2c84aace47ad542ff86527d9845d50ff2e

SHA256
c7312a5489a3bb3c48bc53e3f0271eb03699bdc646d213331da23b7112cacbeb

SHA512
e13157df1e01fa7a0a55812ea282952f591da27d19a529af219bf490ccbd1371b5194ab133f8467aa8c5df588ce523909a1d5ef5d50c2ae468919af76ede55d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
memory/1288-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download