Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2024 09:54
Static task
static1
Behavioral task
behavioral1
Sample
open.gif
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
open.gif
-
Size
43B
-
MD5
325472601571f31e1bf00674c368d335
-
SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
-
SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
-
SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133562660981831374" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3316 chrome.exe 3316 chrome.exe 5032 chrome.exe 5032 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3316 chrome.exe 3316 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe Token: SeShutdownPrivilege 3316 chrome.exe Token: SeCreatePagefilePrivilege 3316 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe 3316 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 3564 3316 chrome.exe 85 PID 3316 wrote to memory of 3564 3316 chrome.exe 85 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 2692 3316 chrome.exe 88 PID 3316 wrote to memory of 3924 3316 chrome.exe 89 PID 3316 wrote to memory of 3924 3316 chrome.exe 89 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90 PID 3316 wrote to memory of 1396 3316 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\open.gif1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb191a9758,0x7ffb191a9768,0x7ffb191a97782⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1776,i,8379414381919983292,9363484592836494644,131072 /prefetch:22⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1776,i,8379414381919983292,9363484592836494644,131072 /prefetch:82⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1776,i,8379414381919983292,9363484592836494644,131072 /prefetch:82⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1776,i,8379414381919983292,9363484592836494644,131072 /prefetch:12⤵PID:3888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1776,i,8379414381919983292,9363484592836494644,131072 /prefetch:12⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1776,i,8379414381919983292,9363484592836494644,131072 /prefetch:82⤵PID:3708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1776,i,8379414381919983292,9363484592836494644,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4012 --field-trial-handle=1776,i,8379414381919983292,9363484592836494644,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
678B
MD5a4372929630d935cec2910454d9d4a59
SHA1e05981ba3b54211d5b24cbaf835a2a64450c746a
SHA2563c67cb2e304d2476a35cf95d3598b7287a18329efaf32b3ae3d9e79ff73ada0f
SHA5128cdd11345400d456afd8e42a465fa036f8cd544a73c46de59efea7e6536cf88d2f718c72b9bbd702478c8727b9ec5c71ba7d6f496b7c649991ccdb9799e5edc3
-
Filesize
6KB
MD50011ed8b0189feca80d3ee5880cda47c
SHA178ecce6af6c63144aa1c083643efc38796518cbc
SHA256d8b685a1a037c694de3812c64f8545bd8376a34b187ebd10ce1e4c47b026da05
SHA5125050d3aaad1cb491ec46f6fc3a14349c59b714ea658639dcdeebfa7a2ddd015e962905ac5798c79ae64f116291cc30217e87507e7bcd42046ff3b4cc6e06789b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f564adac-38c7-47b9-859e-c5399f2f9176.tmp
Filesize6KB
MD50878cfa336a429a011c53d339faa5dfe
SHA194410ff518accc8ee0538e5228c143dec87e2500
SHA256f69467869c1c6be970e0217e71f01a7388299739aedc6e52c979f39753466234
SHA5129f113d6b57e3063a23bbea3944c30d3a4e79753ae69df193796d26e61597597367425ad6d7bd7cf71b99c13e9469ab0aef53b822e1c574289263a8164f912612
-
Filesize
253KB
MD51586b296bb6b132aa50d5be9d1c5ddbe
SHA189ce7d474678b98691583b3fb9d93754c6e7e284
SHA256f20bd566e79d813bf025b8dd61dc13eb789a68d0a3f241b892a7c371ad7c146e
SHA512007982a7ac3367ae4148ef99db97c32bf3734672d5eaf1def571fcd47a7ac536672e5c90a884b0887887b5347fc7ec1ad1cf57f6acee4fd9e38c66f06d436038
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd