2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eicar_com.zip
Size

184B
MD5

6ce6f415d8475545be5ba114f208b0ff
SHA1

d27265074c9eac2e2122ed69294dbc4d7cce9141
SHA256

2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
SHA512

d9305862fe0bf552718d19db43075d88cffd768974627db60fa1a90a8d45563e035a6449663b8f66aac53791d77f37dbb5035159aa08e69fc473972022f80010

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133631711626977915"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4084	chrome.exe
4084	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3384	4084	chrome.exe	100
PID 4084 wrote to memory of 3384	4084	chrome.exe	100
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1552	4084	chrome.exe	101
PID 4084 wrote to memory of 1776	4084	chrome.exe	102
PID 4084 wrote to memory of 1776	4084	chrome.exe	102
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103
PID 4084 wrote to memory of 2996	4084	chrome.exe	103

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\eicar_com.zip
1⤵
PID:3384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb8152ab58,0x7ffb8152ab68,0x7ffb8152ab78
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2320 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4344 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4944 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4936 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3508 --field-trial-handle=1972,i,17188865119502991141,14657758642131193076,131072 /prefetch:1
  2⤵
  PID:3264

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d9627bce84e49cf8e7c6b76acbc2d438

SHA1
c96f84fe21854bf73ab087bd4e24e79ab99f736b

SHA256
38976663c22e02ea67f74bf4c8822cb3619b51f609e1dbb6ecdb81d4bdaae1d6

SHA512
9ddd49d9625808ea309c7f86a6fd33e511f479520873a58f44dbad6461ee6e50a2bd3b39f8fa8dadd4f20793f26383651fe3406b9a63bb8b27c7ed719fd0f70a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
11018dc7ef71d8d3c1a06c9f9f050555

SHA1
750b2e6e56b66784a6c371ce57a1073f16d2d297

SHA256
f944eb876a86d99c970cb087d5e4af3aecf96ca080918846decf15689d5abcc2

SHA512
b9c9ed51cd989d55e8046c6369ae53931366e3c9f4faeca38088cfe63e792b8c1a7ee2213e9c5444bca773cd0324c5cf9bc079e404964895213c5f07a027dbcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
a81a9d3b135f530be59006c8a9e169b5

SHA1
324a8253977394490116efc3cd14832ab46d8767

SHA256
780520c7fea33557981ccad63f94405044978dafda960cf62031df504ddaa46c

SHA512
f555476c2d3e92e65785dda0f03753d0fe6d58caad7c707960a53aeb1905ed8359c5a62e6fe0aee56212fbea814997af85227c2725b3b6f6a058019bfdfa7027

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
743c74588d61b0fc3ebd9ac6e1543bd7

SHA1
136a1a833333545d7cadb177b30219af3677c898

SHA256
12c985772b050257b3d5df85914494968fe7dfd35a8ee9199f38684acc691655

SHA512
2e53788fd6d7e02c3abc61075ae9da86a6746be0f9c7900b82650612fc99db50f59fe6208f9fa454e50941b114f3eaf53ca7fcb40412a88cc1ff6aa59cdade85

Download Submit