Analysis
-
max time kernel
95s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 12:42
Static task
static1
Behavioral task
behavioral1
Sample
index.gif
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
index.gif
-
Size
43B
-
MD5
fc94fb0c3ed8a8f909dbc7630a0987ff
-
SHA1
56d45f8a17f5078a20af9962c992ca4678450765
-
SHA256
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
-
SHA512
c87bf81fd70cf6434ca3a6c05ad6e9bd3f1d96f77dddad8d45ee043b126b2cb07a5cf23b4137b9d8462cd8a9adf2b463ab6de2b38c93db72d2d511ca60e3b57e
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A8C33DB0-16A6-11EF-A084-7E85BBD6B187} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133606825772686513" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeCreatePagefilePrivilege 2264 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2996 iexplore.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2996 iexplore.exe 2996 iexplore.exe 4640 IEXPLORE.EXE 4640 IEXPLORE.EXE 4640 IEXPLORE.EXE 4640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2884 2264 chrome.exe 83 PID 2264 wrote to memory of 2884 2264 chrome.exe 83 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 3560 2264 chrome.exe 84 PID 2264 wrote to memory of 1072 2264 chrome.exe 85 PID 2264 wrote to memory of 1072 2264 chrome.exe 85 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86 PID 2264 wrote to memory of 2296 2264 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.gif1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9499ab58,0x7ffa9499ab68,0x7ffa9499ab782⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1912,i,3939617746546341289,6234504071814669334,131072 /prefetch:22⤵PID:3560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1912,i,3939617746546341289,6234504071814669334,131072 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1912,i,3939617746546341289,6234504071814669334,131072 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1912,i,3939617746546341289,6234504071814669334,131072 /prefetch:12⤵PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1912,i,3939617746546341289,6234504071814669334,131072 /prefetch:12⤵PID:1508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1912,i,3939617746546341289,6234504071814669334,131072 /prefetch:82⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1912,i,3939617746546341289,6234504071814669334,131072 /prefetch:82⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4888
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3500
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5726ae1e676019950065492e22b1fd5da
SHA1b1f6688fbb43ad7d368ff1eefd6cabf78238f388
SHA25652c8eb70bdbf638f4ad47cbb030292eeae95c9afa434fb1bf8203b23118e3a9c
SHA51250e3468465047562c8bbf78a353ac9085cbdfbc79fea4963d6c60b8b7ab1e13ec3a1c552c7fbe34b76de1e3c0d931938ce50baf9fd931295dcdc1fb40774f450
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5bf33b8267b69d62ee49c5e15e8fb3add
SHA1dd517b5b8c16ccd39e42908c5e8d3fa14a5a0db2
SHA256c1e6d942447ec27cf6ed580748f81072977fee01cc26ca65711a1787704c61e1
SHA5120cd81909c6a5a49f696598ceff745b1924d8768d1d114cbc438afab1200d5fadc817eb4badad9daede7e488ec1fc404c8ec62ee21d5ecc135567fc60dbcf700a
-
Filesize
129KB
MD5930ae80199d7ab0f35f558b560574690
SHA155560e442fa04d9faa3e53d66686444fa36951df
SHA2569a4d2800d920c328c84d2e9de5a817fa076e29be6e4563f039817b1c5b1b6960
SHA5121fdce9f694ea3b34d90092ae8525d943657c92bed6f4e1e421bdc891719aae5a6c63f584f067514580f987b82836c5ee792f58f88f7de5391a8627bfb18e312b