cb2b84f1c58d852a461217d48fa5aeece81e96cad702970e3c2e9895ae2ff100

Analysis

max time kernel
3s
max time network
8s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

temp-index
Size

2KB
MD5

da6add866f05f9edd49e68ad69c3bdba
SHA1

6d85ebd17a087ed3111a6a0e39b521f02c0a21b8
SHA256

cb2b84f1c58d852a461217d48fa5aeece81e96cad702970e3c2e9895ae2ff100
SHA512

b9802a2e63e804d3a92b8a770d85b34ff10c4dacf21a8befbed73bc5a35ae55b3a958496478c2d238077c4b65fc4af68f1de0d2b2ce86c3fc34eced0c33695da

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2308	1896	chrome.exe	30
PID 1896 wrote to memory of 2308	1896	chrome.exe	30
PID 1896 wrote to memory of 2308	1896	chrome.exe	30
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2572	1896	chrome.exe	32
PID 1896 wrote to memory of 2548	1896	chrome.exe	33
PID 1896 wrote to memory of 2548	1896	chrome.exe	33
PID 1896 wrote to memory of 2548	1896	chrome.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\temp-index
1⤵
PID:2072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d09758,0x7fef6d09768,0x7fef6d09778
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1304,i,10239867544393608549,5307229362602630556,131072 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1304,i,10239867544393608549,5307229362602630556,131072 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1536 --field-trial-handle=1304,i,10239867544393608549,5307229362602630556,131072 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1532 --field-trial-handle=1304,i,10239867544393608549,5307229362602630556,131072 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2112 --field-trial-handle=1304,i,10239867544393608549,5307229362602630556,131072 /prefetch:1
  2⤵
  PID:2940

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit