Analysis
- max time kernel
34s - max time network
35s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:16
Static task
static1
Behavioral task
behavioral1
Sample
124921.html
Resource
win7-20240508-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
124921.html
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
General
- Target 124921.html
- Size 122KB
- Sample240613-ev1eestfpb
- SHA256 369c1acdfbb6ed8bbf34cd01c7a5114c5a3b28089d0719692c63c6081c30fa3c
- MD5 a106c32388fa59354c776be07e312f23
- SHA1 8466d8cf16374027b961f8ad5d260ed386d861db
- SHA512 519934ad9edf9449f3f352a0c7ad5e5e2e99e829e4fc1cdf90549462c9131d55dadfa85ea6d2db25f9fc3a1d52379f38df77953b452b99b488ac1f6a1a721889
- SSDEEP 1536:XP2lX3UMbY6EiEZtn1rTNTM04nUOxOp1gHKQkyE:f2lXE6EiEZtn19TVld
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627258241518234" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe Token: SeShutdownPrivilege 4712 chrome.exe Token: SeCreatePagefilePrivilege 4712 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe 4712 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 4388 4712 chrome.exe 82 PID 4712 wrote to memory of 4388 4712 chrome.exe 82 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4100 4712 chrome.exe 84 PID 4712 wrote to memory of 4804 4712 chrome.exe 85 PID 4712 wrote to memory of 4804 4712 chrome.exe 85 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86 PID 4712 wrote to memory of 1408 4712 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\124921.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9021ab58,0x7ffe9021ab68,0x7ffe9021ab782⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:22⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:82⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:12⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:12⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:82⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:82⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4940 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:12⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3336 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 --field-trial-handle=1936,i,3746832909359913733,18085607795845651566,131072 /prefetch:82⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 da760f2ae6aa86e95da78fc4a55f39e714a731587b45550e136f08ba1d08344b
- MD5 7b0b924076d829f13a73a84b72905329
- SHA1 39c9452f155556aad92b0064978ed19255110fac
- SHA512 779b8455349fe34e13ef1215c5fb95744f8156249496697b6c69abe3015ec991abb99ae2c1ce6181a38e93349bc08624be97c08e6a1f42675f28eeae10b2b1ac
- SSDEEP 96:ctVOGCpX+Pd6UnKIkJgOo8iZRy7Dx+6MSmueqIOTLJP2MEVhYtjEsXt0/cgVup:crEpuPZaJno8syh+F63PP5tjEsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 1adffee20b332009dd250a6544664dafd79dd02175c8c350a5c0bc6eab3e4218
- MD5 ab40b6ff15fcf7ff339eb8e601779246
- SHA1 d1b644af3874cb6ddd2dd49c0c0dcd9be080f7cf
- SHA512 ead5ace799ed86f3e48de2fcf53ab052c9f57853cbc610024c44da4e21277f57dc643888065308eb5e2ce6400407d46f0aae6ce309bbc3ab5391672b4d8e83b8
- SSDEEP 6144:brI1Qo5yzkpeXjnJFzXsWzQYRPILxZnhLMJjX0EeGzY2rLJ:bEjCkpeXtFb/Q5fnReEFsLLJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 40375f0511abd4dfd4d79f2febbdefedadb0009a8966c2109341ef1ad1bad289
- MD5 7ee53d05369fd5178d137fef0674621c
- SHA1 db5bb7612fe47f87a36a4cc00e9ffc904eb9b664
- SHA512 7e7076004a967b0ca79e8e393dcf920511e173074e8722da51dd4f8c1ac2749b02cdecd11c68e02d8da4d61ebde73ed69b36563daa14b54af3dafb4dd2416b8a
- SSDEEP 6144:brI1Qo5yzkpeXjnJFzXsWzQYRPILxZnhLMJjX0EeGzY2rLJ:bEjCkpeXtFb/Q5fnReEFsLLJ
- MD5 SHA1 SHA512 SSDEEP