Analysis
-
max time kernel
1030s -
max time network
1563s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win7-20240508-en
windows7-x64
6 signatures
1800 seconds
General
-
Target
.html
-
Size
6KB
-
MD5
1e123a0a0f7bb89fc514d60259f681d2
-
SHA1
54f8c9724f591c11108834b9371ed23a1837cf99
-
SHA256
ead2648f0c356193d5440f4835cc638c8c37f563448d8c731b6291baa2fd08d2
-
SHA512
d61e63512ac826c89dcb3ccf4b351fa787108da3246133c78e528f87b68e03a2fbe9c66112c10b7ce89767d2c6d006a1f8b6ababd58dd2eae0b4aec52996b5d2
-
SSDEEP
96:C+9SKSlgcJcBar/FNQRGhz0vLmerLcaIN986e0wHmaAjlSWHFDyNKRydro0gkb8D:wlLIYUEYTgNCbxJ0
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1792 1924 chrome.exe 28 PID 1924 wrote to memory of 1792 1924 chrome.exe 28 PID 1924 wrote to memory of 1792 1924 chrome.exe 28 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2752 1924 chrome.exe 30 PID 1924 wrote to memory of 2472 1924 chrome.exe 31 PID 1924 wrote to memory of 2472 1924 chrome.exe 31 PID 1924 wrote to memory of 2472 1924 chrome.exe 31 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32 PID 1924 wrote to memory of 2588 1924 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7779758,0x7fef7779768,0x7fef77797782⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1484,i,9046431244886764549,13512640749242091592,131072 /prefetch:22⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1424 --field-trial-handle=1484,i,9046431244886764549,13512640749242091592,131072 /prefetch:82⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1484,i,9046431244886764549,13512640749242091592,131072 /prefetch:82⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1592 --field-trial-handle=1484,i,9046431244886764549,13512640749242091592,131072 /prefetch:12⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1484,i,9046431244886764549,13512640749242091592,131072 /prefetch:12⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2844 --field-trial-handle=1484,i,9046431244886764549,13512640749242091592,131072 /prefetch:22⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=1484,i,9046431244886764549,13512640749242091592,131072 /prefetch:82⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD534d99f0bc15dafb414f0bc8fe58762cc
SHA1ba08108af36d8482933ab19391436f7c1599e5c6
SHA256ed9589ea80d32048811eb26d94b7fa5d7a633a17cb5f934a3e07bf120a8a2d80
SHA512ffa4600e6c0be02a16c0b0744bd0ba3b251d45a1dcdd6db9424ae6d0cc87824c56949c96439eb9ddcb34dd8bbe26b50ef4808da96fcf4ebe09d62507d57a5362
-
Filesize
5KB
MD5fa097fc23e515d0733ce54915e6153cd
SHA12fda8a7b332fb806ef53ab49574a6609cb5b75b0
SHA256094e0afbe6b8ad025ef7f708a4f0a49fce7719cc073d307e3980de827f1da74b
SHA51285d723c2a4e54ec0addbc35b3a9fa9061050325847257f0c2d1d53e9083f102e27cba851e9e22e81eed6cdd80e94b73edb28c43ae097ec50955023b79a24e155
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2