9d0e13b30050899624473e710d44cb372a881a38d2802cc6c0ea2e2f54580689

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Google Chrome.exe
Size

492KB
MD5

d3ebb8649264196a80f589dcf0c97f9b
SHA1

4bbeef7c604629c5cce710ff78dd1c032dc67fc5
SHA256

9d0e13b30050899624473e710d44cb372a881a38d2802cc6c0ea2e2f54580689
SHA512

fcb8dd306b96ff2cd6c13cd9dcd70330efd2d2cab63548b1089fa207b0249603b8f45f5f2c50755db2a7d877774a7497c2303fc9ab5150529fcf6a24e7f1f9b6
SSDEEP

12288:2CQjgAtAHM+vetZxF5EWry8AJGy0khGPyJm:25ZWs+OZVEWry8AFtGPZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	Google Chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133611602854079059"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe
Token: SeShutdownPrivilege	888	chrome.exe
Token: SeCreatePagefilePrivilege	888	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 888	4660	Google Chrome.exe	82
PID 4660 wrote to memory of 888	4660	Google Chrome.exe	82
PID 888 wrote to memory of 3624	888	chrome.exe	84
PID 888 wrote to memory of 3624	888	chrome.exe	84
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 4712	888	chrome.exe	85
PID 888 wrote to memory of 2068	888	chrome.exe	86
PID 888 wrote to memory of 2068	888	chrome.exe	86
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87
PID 888 wrote to memory of 780	888	chrome.exe	87

C:\Users\Admin\AppData\Local\Temp\Google Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Google Chrome.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd93fdab58,0x7ffd93fdab68,0x7ffd93fdab78
    3⤵
    PID:3624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:2
    3⤵
    PID:4712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:8
    3⤵
    PID:2068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:8
    3⤵
    PID:780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4328 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:1
    3⤵
    PID:3664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:8
    3⤵
    PID:3448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:8
    3⤵
    PID:1120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4208 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:8
    3⤵
    PID:4408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4860 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:8
    3⤵
    PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:8
    3⤵
    PID:396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 --field-trial-handle=1936,i,2558371364689876193,14377568021837195955,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3444

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
f533d8d4f54d8336730c153d75456308

SHA1
1f3f7cd37b7c7c56eb1d4ff0c4fc54b2eac901bf

SHA256
915d28dc0a647b2893851a45604bad9c4137b65b6cac2791a19d1e28e54d8dbc

SHA512
588890c648a6b09b882820ad6ee29bf6c74a30e38689361f6ad73e9d9c4942d0db4b9e7fb2125f1da4388622216bf77ca2b5ee7551099678f9a0c2099251f597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
352B

MD5
e2dd5bfe0d9134dcb29e9629a1e2151d

SHA1
fbde155dbc0233b9039f95f3661c02ed1d9ffa20

SHA256
4876b965f4cfd9631d2ce4d3daa10d6f095bba840ee62b9aeaad5b7d68fde96d

SHA512
b46edc3c0e89b139657168025d86ac6e8b9c99e08668e214ca4e1b76e433864b80afab2b03f99400f2c20d21652e783929ced9a53eea1b7c6969ea161071086a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6d78a01f555c179192f953589fbed8ba

SHA1
670dabc6c811583101e2caac34a1a9729b770ab2

SHA256
b5ddd2baeff47df1cf88bb41322cf9e0c121a17119a8668fe28451e69fb888a2

SHA512
a18011559bb1a855217b22de69e7617064f81c4e1e3de7ae1baf56eb80bf2cdaaec31979d520a6714fa5df926b4848e406833f96d63d8ba788b893fc15b4f67f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
fdf48320486ffebdeeb40d0b0427f4b7

SHA1
cc3e20f331e8db7299e8b86c9aff6a0cd7051001

SHA256
1cd4027cd0bea7ecc2bbf1441a2be83b0404d4f08ec8a9b83a59e86946d4ee78

SHA512
385c15fa7cad9db90cf7be319a8133d53553c984cf7da8106ba60c2af2fb0db519a47441a143cf6c6f4aab60170f26030f11e4a0b16b7278ab66d985d51d7c84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
260KB

MD5
1bc39fab86752f5ad1ee41cd158cc255

SHA1
b7d4b68907dd87010143086364aba257aca4905c

SHA256
6230eb8b28466a2baaf116d862f3968860bac6ad49f1fd1d2a636dfc440cbbcd

SHA512
da65eff5a36e3fa57e1a650b81d2954b6350c9ad34f741e91107a6bea4d2209cdcbf4a3b02171bba9828555047ee76e28ec55fd387aa092e65b0535f016712b4

Download Submit