Analysis
-
max time kernel
89s -
max time network
81s -
platform
windows10-1703_x64 -
resource
win10-20240404-de -
resource tags
arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows -
submitted
28-05-2024 13:53
Static task
static1
Behavioral task
behavioral1
Sample
ho.gif
Resource
win10-20240404-de
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
ho.gif
-
Size
43B
-
MD5
325472601571f31e1bf00674c368d335
-
SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
-
SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
-
SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613780770371055" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3944 wrote to memory of 4832 3944 chrome.exe 73 PID 3944 wrote to memory of 4832 3944 chrome.exe 73 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 796 3944 chrome.exe 75 PID 3944 wrote to memory of 2840 3944 chrome.exe 76 PID 3944 wrote to memory of 2840 3944 chrome.exe 76 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77 PID 3944 wrote to memory of 1044 3944 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ho.gif1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff11889758,0x7fff11889768,0x7fff118897782⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=272 --field-trial-handle=1892,i,8950825746046064129,2807591529957005299,131072 /prefetch:22⤵PID:796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1892,i,8950825746046064129,2807591529957005299,131072 /prefetch:82⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1892,i,8950825746046064129,2807591529957005299,131072 /prefetch:82⤵PID:1044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1892,i,8950825746046064129,2807591529957005299,131072 /prefetch:12⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1892,i,8950825746046064129,2807591529957005299,131072 /prefetch:12⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4148 --field-trial-handle=1892,i,8950825746046064129,2807591529957005299,131072 /prefetch:82⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 --field-trial-handle=1892,i,8950825746046064129,2807591529957005299,131072 /prefetch:82⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5fb083d397f7c715a7ac3084bb75089b0
SHA1f6e06ded452b2b71c56a0b259b1a74d014d27a4b
SHA2560bf2438bcbadace957cd7d6668008832ff40e994797a0afeebe8749cbb2c3b35
SHA512b28661f571a0d6fa4287f38fd8ae10637a9247b49a3786f6fb0cebb87c3be068834deaea7e94af59b053a6d71c7d8fc8baab680553bdbfae718c02a352f93e49
-
Filesize
5KB
MD5edc1b666517d727126be047bfe1c977d
SHA1aca281ac71a1f8ac7010339382255f4aea0fe0dd
SHA2562f15d5156dd5968931858e48f1318a5306fa3eeb44e815a4361f1f54cd7fb3a5
SHA512b7af43e77de0d082d416ce561a8e30762687692015723ecddc1e36e1e6f2c416e041d30db963b7dccd04893bd783d47bf4dd373e30d2cb5e2e8cf5a9d81ed666
-
Filesize
5KB
MD55de83b0dbb1f18cf9c3b9ef7c9c554d7
SHA1c00e540866f4f532051cd8aec0061edc4be70923
SHA2569a63969e94880913d049fd88f2a537e114c16db66333f5342cc5ba9573788f31
SHA512f209c656d2a70815cf556a06a633f135398213391981680b3d30c1f92cf13af36656fb82622a62711501d158a6c78786f65ec43947acdeb3a80c1dfe8ebc1bdd
-
Filesize
136KB
MD5f8a1db3f11a4982d6676512cdfdaf0a3
SHA1f7bf9f96ab9969d2305f33ac942cc0db274056ab
SHA25689fce9afbc1a409842e956c609deb21286485bc43a7add5fe974048d9d1b60fd
SHA512b6902b9f25811207739e26f7694fdc53f8852aa43a894ce455bc274c9507fb77f2520eea82f5152afce7a135e423054feb985624a575b397847ecf4d448675b0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd