Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-05-2024 15:46
Static task
static1
Behavioral task
behavioral1
Sample
mqdefault_6s.webp
Resource
win11-20240508-en
General
-
Target
mqdefault_6s.webp
-
Size
138KB
-
MD5
d108d64e0648d509dd999bfdfffb6350
-
SHA1
f7ae4f62db6871ae87e29216ac442b3947868d61
-
SHA256
91363d9493995917f3e97be296f85e3167bc4dce34bf9b11b048034b9edf6ffa
-
SHA512
1e5f63636fb4a0ba17e35a611a342b91034260622ae3e3e8d9e7d33e0a1cab6fc9995f2cd8afdc0b0df04c2452c322fb27aed43851abcb9650b07b4c6e24fa3a
-
SSDEEP
3072:mJbqmfwajigagJOWeNytTCkPmjuvdC1uojzq4tit:mtPwaegJJOzNqHmalCoonqoa
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607800356501996" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4548 chrome.exe 4548 chrome.exe 4652 chrome.exe 4652 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4548 chrome.exe 4548 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe Token: SeShutdownPrivilege 4548 chrome.exe Token: SeCreatePagefilePrivilege 4548 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe 4548 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exechrome.exedescription pid process target process PID 2704 wrote to memory of 4548 2704 cmd.exe chrome.exe PID 2704 wrote to memory of 4548 2704 cmd.exe chrome.exe PID 4548 wrote to memory of 2316 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2316 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 2068 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 3880 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 3880 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe PID 4548 wrote to memory of 4072 4548 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mqdefault_6s.webp1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\mqdefault_6s.webp2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffef7c1ab58,0x7ffef7c1ab68,0x7ffef7c1ab783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1504 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4404 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level3⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff665f6ae48,0x7ff665f6ae58,0x7ff665f6ae684⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1828,i,2262604740399629352,6381954320896826077,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5271d72b8717891ec7e3dbb65e6c349d6
SHA1cd7c4ec9156f90e8888af3bd3c3f15d8c015042d
SHA2562dabec2b54fcce76c0a1249685d6ae622a8320b3f67edc45d4ebe9bcee191190
SHA51267b9b42da6eb43a3fb6fe7d40e5ce673516d7ba0ac7814e4d1c089f31af2144cb27e7d97d3dab3d475698a2a04670ed9fcdf8108d315ae04427a1638fdb0d54b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD51c497b0192f233658eca1bb81da3fb30
SHA1999c4c58a9eeb3ff10c5858c63d99aff485d6f8a
SHA25685c0f0709dffe267f48a133b62515aba7f9954059f09ef581d415f889677bc4e
SHA512c4f782d9448b18f4b9a5f68c025be4e5d291efa49c3434226aa3f2e271e08170f89f2d103c2eeb3cf1170b743c90bbc2c3c4e9c01f2c0069519859a4913aa3ff
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD57f010316798667d2b23b3be72acc351b
SHA19d8889fba8241e2b79509891e96179f4f8611851
SHA2560e976bfc58ae8f7d8e33ee23bcd0e770569560d914bbf328d67f403e8693bbc3
SHA51299c269d82d0942094b552067f008cf14a16855fe7475fa94d3203de4ba63668f0717332b45e3250abb96965dd936d243635c8ad9cd472d401ab706e5456aa4b1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
259KB
MD5b7599274d47fd1324917f59655cc3813
SHA13e4734e30af04249bf99e3f3464908af8184820a
SHA256782b44b7bb62b55178c6297b1a0378ac74ea2b62cd0586501500adac1684a5c5
SHA51200cf1dc60a47deda1da1f7c86737bfd43357d781c4545c62aa9fc2c9ec45e96ea54b48c4560b53d988302d74e2da39229895fecf34ae5cf64916c0fe803fe5a2
-
\??\pipe\crashpad_4548_BHZYPIFRZEKSVYQBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e