2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad

Analysis

max time kernel
30s
max time network
25s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
29-05-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eicar_com.zip
Size

184B
MD5

6ce6f415d8475545be5ba114f208b0ff
SHA1

d27265074c9eac2e2122ed69294dbc4d7cce9141
SHA256

2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
SHA512

d9305862fe0bf552718d19db43075d88cffd768974627db60fa1a90a8d45563e035a6449663b8f66aac53791d77f37dbb5035159aa08e69fc473972022f80010

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133614936560033769"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	chrome.exe
2532	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeCreatePagefilePrivilege	2532	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2292	2532	chrome.exe	82
PID 2532 wrote to memory of 2292	2532	chrome.exe	82
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 4904	2532	chrome.exe	83
PID 2532 wrote to memory of 2380	2532	chrome.exe	84
PID 2532 wrote to memory of 2380	2532	chrome.exe	84
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85
PID 2532 wrote to memory of 1152	2532	chrome.exe	85

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\eicar_com.zip
1⤵
PID:464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b56bcc40,0x7ff8b56bcc4c,0x7ff8b56bcc58
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1852,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1960,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3036,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4684,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4796,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4604,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4824,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5124,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5108,i,4627575884132173504,5103232608146362558,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:4040

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
1459d3605ec6f5be452eb1d9488e5fbb

SHA1
60eecb797dfa6ecbc6b6639e7fd132623ce0535f

SHA256
4e163d02f284e792308817d92cc445bac39bd89aca3b1117dc5000cce2b642ec

SHA512
5832d8568f9aa35d12ad67b28b715aa28361cc15d46ba1409556f4ba2236be7b63b5fc1b3dd6a1b151f5d0f339fef921ed72f8856d38334df321f2c594fe96bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
697e061d4f9680bf63e8e4394a692f57

SHA1
5ae020d952de86ef2a1c25665f86d3fa719ec53d

SHA256
c47b1d6461686df03f6c2bf7e0a85c860a9148b6244300c75a68896f9310bc67

SHA512
c3da62b04064c0b2d9250cb6072593138dc2a6064f09f1506bac913daf289d6165fcf275f8a40083c88071b960388695694977f7906ff9afab150b74ecb96d55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7aea1821931e4a3564120c985919643c

SHA1
daf0bbdd1b7a59da71b8fbe9c07b46508ccb68eb

SHA256
9b3b7d128565a994335dde03c619e96b2c59df0c1d3ee20e30a972ac22ced1a7

SHA512
f63d58a64e6fb56401e72b2ad26d94de79764596c60dd9c44df002f4e5f9ce933e87110a3e9e450926c4bfa30efe230e7b8751689d260b3df6c29f6aa824812b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
e4195e0b8037af6a774e88ebbb0470d6

SHA1
df3057f8deb778a95f4cc3c048122aba969ebae1

SHA256
7b12477bdb8149dc12c01b63331f298a0158d2bab1bdfa966668eddb8c17761a

SHA512
08c764ac17b0265d1883806e095ba8089f8508f272eb65b97006b4b0e5e5e552c0922990757f2f4f97098c67db4d66646bb8fa0aaa12ae9087f9984f028bbca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
157KB

MD5
82b6e2c416f9c68ed88f90fc989e7c96

SHA1
4d1897296d8f093fb2964bb8ab9888e7dc3ae2bb

SHA256
d472645126456a35c7e20d7fc36d64c99566bf7630869786b6923c1059085313

SHA512
5b2f2b99d1e8bcfd378c32a753d65e05496e504e6c9b48fb432d2165f794c213338a6882fabad9de090a3e8aace5c9549a1dc49ca837c28527d27061f8c12342

Download Submit