61a1422d91e70bce28ce695075bce73d75ecf574f494e7416f217d4e6238a305

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unconfirmed 267092.zip
Size 42KB
Sample240619-bb74dazhra
SHA256 61a1422d91e70bce28ce695075bce73d75ecf574f494e7416f217d4e6238a305
MD5 cdc757c00733c6d1b88f7d88f01af99e
SHA1 d73b6274a9f2e213f8e979073abca5c6383a83e3
SHA512 26f849233bc4c0d8fe5ba31519170eaf8eb3f6c7c7df533af9a20253e900971153d8317e4030938c4073899c15502af56b1733fc9ae118c8ebd5a5e85542e0ba
SSDEEP 768:SfOtMycGcvoKv2s/cKrhmnfHvOclr/b8gI/KKF6P1WLrTbvKAlW4GTI1qfqbdw7D:Smt5CZPt0DzogItLZKK/5wrxwo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2076	2632	chrome.exe	29
PID 2632 wrote to memory of 2076	2632	chrome.exe	29
PID 2632 wrote to memory of 2076	2632	chrome.exe	29
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 2712	2632	chrome.exe	31
PID 2632 wrote to memory of 496	2632	chrome.exe	32
PID 2632 wrote to memory of 496	2632	chrome.exe	32
PID 2632 wrote to memory of 496	2632	chrome.exe	32
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33
PID 2632 wrote to memory of 2080	2632	chrome.exe	33

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Unconfirmed 267092.zip"
1⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6de9758,0x7fef6de9768,0x7fef6de9778
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:2
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:8
  2⤵
  PID:496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2324 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1324 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1360 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:1
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3192 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3196 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 --field-trial-handle=1244,i,9348482967393209067,14066630460991900464,131072 /prefetch:8
  2⤵
  PID:344

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

36b6affc-ba90-449b-9551-0bdeefb2b189.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\36b6affc-ba90-449b-9551-0bdeefb2b189.tmp
Size 291KB
SHA256 5ecebc894a8e76b6262ebd4d40206f9f1b475f82b6e518b4cd3a2f23bbd0f68f
MD5 5cf26bcc725081d359a2abff6756dc15
SHA1 900395e921df568e2ac9525429c85b9a8ce553d6
SHA512 e79272bed1e73eff0b53b04c86c90c7dc17553b197d1573fc7cc284c5b6552c7a25d3738bab5033a80761e9d7122f594da04f6ca3a8b0340cd34ef7c09c0a568
SSDEEP 6144:SQreIziNnU2qiXBHGV9xGItIuTwpLOvgOWxy0NjZ314qyTEnTRB:SceIOqKwVLeWvgrNVF4LTCTRB
MD5 SHA1 SHA512 SSDEEP

Submit Download

000006.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 140KB
SHA256 594e3602026251e7ded3e72d1eb11a41ece9f7db612075cd2d36a2f54af7731e
MD5 641b4c315b40201f7de53f0bae2357eb
SHA1 6c0d07f76b8f4f75d65bb268e498effba50cd10f
SHA512 dd9d5b38b898754174fc04c1c942bef08749ebba8eee20aec189608a6aa7a5b1f0d018974723ac0f3e1113cf8a6caf9adf01796d1b5a1c0137647d9c07c2e928
SSDEEP 3072:6BgafI7yWKuQ90N9+8vZVyB3GB1n4qyTEQmfef0M8Ru4:6BvgOWxy0NjZ314qyTEnTR5
MD5 SHA1 SHA512 SSDEEP

Submit Download