hxxp://google[.]com

Analysis

max time kernel
900s
max time network
843s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe
Token: SeShutdownPrivilege	2976	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe
2976	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2988	2976	chrome.exe	28
PID 2976 wrote to memory of 2988	2976	chrome.exe	28
PID 2976 wrote to memory of 2988	2976	chrome.exe	28
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2460	2976	chrome.exe	30
PID 2976 wrote to memory of 2576	2976	chrome.exe	31
PID 2976 wrote to memory of 2576	2976	chrome.exe	31
PID 2976 wrote to memory of 2576	2976	chrome.exe	31
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32
PID 2976 wrote to memory of 2436	2976	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6819758,0x7fef6819768,0x7fef6819778
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1284,i,11134650768780088647,14565192484461686332,131072 /prefetch:2
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1140 --field-trial-handle=1284,i,11134650768780088647,14565192484461686332,131072 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1284,i,11134650768780088647,14565192484461686332,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2100 --field-trial-handle=1284,i,11134650768780088647,14565192484461686332,131072 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2108 --field-trial-handle=1284,i,11134650768780088647,14565192484461686332,131072 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1380 --field-trial-handle=1284,i,11134650768780088647,14565192484461686332,131072 /prefetch:2
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3228 --field-trial-handle=1284,i,11134650768780088647,14565192484461686332,131072 /prefetch:1
  2⤵
  PID:2408

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1208

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\45430cd2-e251-4dab-b057-304e055dc54b.tmp

Filesize
256KB

MD5
4fbdfa4cca67a0cd22ce957ae5cf00b2

SHA1
416b53c9f086eb1601492d519eea66ec27fd4eb7

SHA256
5bdda3326a0ea455fb86fff4e8da9d42b2078e9cfeae2438f6c7f3384939787d

SHA512
f590a129585d56b8bc32d18530c103837d222f3daf4b203f74366ec0daa73e9adfd2371899b39bed62d4765423dde42eaf828de8499ca9003f2439aa4698e13a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt

Filesize
363KB

MD5
ff05d7808fe0cdbae4da7730eff17268

SHA1
786bd4cb13201628d0825eb48d4553635d7bd0d6

SHA256
a9efb30ec6d2790cdf37bbe334812acffd546704c4d61b377217143efe8cb317

SHA512
d538501756de553de8d0bf467d65f4a74c3b44d7ef2e5dd44b468b7f136f59ec8258ceeb5597d30280830b698af879280500f77f7fc449e54c44c970a556b889

Download Submit
C:\vcredist2010_x64.log.html

Filesize
86KB

MD5
439a2d79f362ea2b3dbb209bebdb0e40

SHA1
a9832aa8dea4f0bddd8d1fc548a3a487941e4e87

SHA256
ee707b718a22ac13c9e5b3f2c10b65dbf13c078c6dfebf3361a6267b329d106f

SHA512
72f1b1f362a940b6fe95ead58482d42317cee025f554bf76182c235e83e80667eb0df101d73f2ca44499aeb5b6bdb36571781bf7e2b1e5e3ac181e6a3254c3f1

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

Filesize
379KB

MD5
e3b7cb5b64e24f94e39f7c57622fd70d

SHA1
7453ca86cc5da124379c4f7430672e9d09e704d1

SHA256
d436c63c6d5d8415dfaf3372de267f7b11583326c9f551511316fcec66d4ed8e

SHA512
7d542a8c43b7dacd1ef3208f300f3bac46ebbe66e481ab56ba1d8800643785dd72a962a2ba767a46d72b02ff6749d9e111fa5cf4fc61e5d6c8565aacae7d0783

Download Submit
C:\vcredist2010_x86.log.html

Filesize
82KB

MD5
154f5932952802b8d12db1cdf3fa14ae

SHA1
32da6a7cacd00acbe79e417269e7d75e4e561bfb

SHA256
6f137c2b2a95d4a9752399a98c110e68156932e32011924612ea74c09e542bc4

SHA512
9430279dad74edc465b2462631e149b3228f7c15524fcd36cf858a4728d205dc9f9b79f8ee246637d522e3dbd4de08d473c438df3e0beaa7a99e15c91945d7e1

Download Submit
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log

Filesize
165KB

MD5
d49b1272abcc3d5e2cb45e7858539f0b

SHA1
9875d7ccc68da3b7984e241d8a3ac824a66f62ce

SHA256
d5f52d48dba38f0a7b48139a400b6e9e77e9f3d02567caa75fe857fe159877de

SHA512
5199152fb8aa73fb34fd2298066b1a2be2cc7f264378f0b5ea41129b76ad3ab382d7418e947b07f529bbe156d0b7664affc0262a84490a2c82913959eb0cf360

Download Submit