7bef645ef38227df5ceec2ea4cf7903f9eb8e3266bc15885a8b03207eaf35aee

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bin64/7z.exe
Size

543KB
MD5

45023802e9c2c3d05b14778437cf0ae6
SHA1

aba36b969f322115bd89a59ccfb96da9e5be9a97
SHA256

547fd2ab23efbb1627b86de321f27da28a738d9352967a48a0fbcd6af6cb79f4
SHA512

1f9e794afffa359905ed20af39e6fa40a9df998ca1d03781609a4953acab241e4960e03efab8b7603a8ab12ef2bcc1d2aa60121e3101d582141ea87569c1d3f8
SSDEEP

12288:lvP+BNSebhEFoUbElY7dx0Gyz1batvexh:AhiFoUbEwdngxh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133603522010077204"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2876	3128	chrome.exe	103
PID 3128 wrote to memory of 2876	3128	chrome.exe	103
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 5048	3128	chrome.exe	104
PID 3128 wrote to memory of 3536	3128	chrome.exe	105
PID 3128 wrote to memory of 3536	3128	chrome.exe	105
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106
PID 3128 wrote to memory of 2328	3128	chrome.exe	106

C:\Users\Admin\AppData\Local\Temp\Bin64\7z.exe
"C:\Users\Admin\AppData\Local\Temp\Bin64\7z.exe"
1⤵
PID:3920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8cea1ab58,0x7ff8cea1ab68,0x7ff8cea1ab78
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:2
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3116 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4300 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1916,i,9441759213434511793,13660856656441601004,131072 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4732
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff79a06ae48,0x7ff79a06ae58,0x7ff79a06ae68
    3⤵
    PID:3832

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
0468d2b3822f0c08206d7aea774b9b08

SHA1
0dbd4a3f1d70f309a7ee063cf1b11cedb621f9e2

SHA256
687b55d81c5430177817f451a61d6aae8c28c535ce63c6c83dbc10c678b9d8b5

SHA512
bea876c05ef8db1a14a34705bdc5f0b5b905fcfc54879ccfc639e50b6e13e7276ffc3d50cab5ff262e9c371723dec1c504785b1a85c5d7b51d0512a7b8820c3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
cff2e1f2ba31f5046369828e332f63a9

SHA1
4ffded8b05760d1a8e967fc08369c1f82365bdcd

SHA256
273d29f49cc44e1cea6892e53fe5c61736e0ec3d6fcc8955f1b54784519b5575

SHA512
153721ac30da9d131fb8f58c8358c21619648c696a07d57b66d466db763233e945ce13553728c89e1034bb33b9f16bb86f27a8932c81a3aae22b38e53284a644

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
86d8310ce4063eedc9260ad96dbd5737

SHA1
3c83edee3a3a3ec2c4cfc4a84a074c3e27d361c8

SHA256
dacec56e464440aa5dff35bd2a529a49faa36544bb1b125707584eaac7ff3609

SHA512
2bab2071e1ca90ae2479c6859987264836e51bbc4bdc5ac8ba3063c8c8d02ab0cd5928c72baac13754acf5bec24c351253e435477f88593aa62ab97fb73a4b77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
7faea646028512ce802db78cbd2a58ba

SHA1
ef8344dc73b691ca6dc532c3241ecbed311345bd

SHA256
df34d03c3ac74d17eb10a493dd879c8d769c98aacccf121abb7bd483632336b8

SHA512
360fe49ff1dfc41254a8ea9c50c505bed94c58ad7bf4a350f6615ad9aeb31691cc8f58c211baedb2b09d01b264471cf439eedec64ccf970062d3015160b144c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
258KB

MD5
4c57e3940e241b5d2efa0fbbb6d3d68a

SHA1
baed67de71cce04fc90f4e643e5d3c403bb73b5e

SHA256
61f04b7fc2ea1ece36e98f584e5cbf33a46cd51e170107627cc7e139005197e0

SHA512
3d3d8213b7592a16719223300bfaa87292aea6736f7b74d1c1ddfab6739420b656588202000ce9e772c634d5fbbd20df855e629a4ef979ea8372fb58d97e5311

Download Submit