Overview
overview
8Static
static
1sample.html
windows7-x64
1sample.html
windows10-2004-x64
1sample.html
android-9-x86
1sample.html
android-10-x64
1sample.html
android-11-x64
1sample.html
macos-10.15-amd64
8sample.html
ubuntu-18.04-amd64
sample.html
debian-9-armhf
sample.html
debian-9-mips
sample.html
debian-9-mipsel
Analysis
-
max time kernel
24s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 16:58
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
sample.html
Resource
android-x86-arm-20240611.1-en
android-9-x86
Behavioral task
behavioral4
Sample
sample.html
Resource
android-x64-20240611.1-en
android-10-x64
Behavioral task
behavioral5
Sample
sample.html
Resource
android-x64-arm64-20240611.1-en
android-11-x64
Behavioral task
behavioral6
Sample
sample.html
Resource
macos-20240611-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
sample.html
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
sample.html
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral9
Sample
sample.html
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral10
Sample
sample.html
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
General
-
Target
sample.html
-
Size
19KB
-
MD5
7030b1e40adabfa91ee52c81c65257cc
-
SHA1
1920af0169c52de492edb199db45430148c2eed4
-
SHA256
d87360c3a4286dab91df70eca55e4b4f6520069fc5f1595272fcdd3f37f5af3e
-
SHA512
68ef5523ec85925bcbb5ecac16a1eba9f17463014a11745fb8ef351486f2a7a9db4fced14b4989d1e9d07707c88470a394c6477af0ebf69771dd25a10b0cd5e4
-
SSDEEP
384:I/kFspY1ocy454lbGaNsvhpNe9su3K2fa2hOwV0b0QfcNxCqcR1:I/kR1ocy4iEa+JpNasd2hOwSb0GYxQR1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 1676 2264 chrome.exe 28 PID 2264 wrote to memory of 1676 2264 chrome.exe 28 PID 2264 wrote to memory of 1676 2264 chrome.exe 28 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2696 2264 chrome.exe 30 PID 2264 wrote to memory of 2080 2264 chrome.exe 31 PID 2264 wrote to memory of 2080 2264 chrome.exe 31 PID 2264 wrote to memory of 2080 2264 chrome.exe 31 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32 PID 2264 wrote to memory of 2520 2264 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef65d9758,0x7fef65d9768,0x7fef65d97782⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1184,i,10586298297205448065,4025110727905994179,131072 /prefetch:22⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1184,i,10586298297205448065,4025110727905994179,131072 /prefetch:82⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1532 --field-trial-handle=1184,i,10586298297205448065,4025110727905994179,131072 /prefetch:82⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1184,i,10586298297205448065,4025110727905994179,131072 /prefetch:12⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2224 --field-trial-handle=1184,i,10586298297205448065,4025110727905994179,131072 /prefetch:12⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1388 --field-trial-handle=1184,i,10586298297205448065,4025110727905994179,131072 /prefetch:22⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2968 --field-trial-handle=1184,i,10586298297205448065,4025110727905994179,131072 /prefetch:82⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1640 --field-trial-handle=1184,i,10586298297205448065,4025110727905994179,131072 /prefetch:12⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD565dae2d4efa10e90d15af7fbb071087c
SHA1c40d616e6e9cdf14535364f2a5e347e2b081b20b
SHA256071f1c6a963652d4a6fc95e2b1b65df522fc4d7edc4ea7ebdf7abff56a428dbd
SHA5127f858bdf512f872afd298c35efc2ae4b8a4f997aa58a0745aa5e89151aa424306b1bcca52becfa45f6f87179b605a4343581049d6ca621e5c183c53c80268a89
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
5KB
MD570e93003fd8854ec45f7ad3a10a3c192
SHA10345d4cf3a2762f75c9767431d82a9c8e0ab0f06
SHA256562bc901cd8bde18fe5172e35835e8f35bf4d70fecb93da6b7825b9119763589
SHA5120e1c681962d8108b63abb9d97a48591dd5013133d3644d56046661e8de74aaf8d7d348a81754d995543b5b458f6d8f56a700a0e80cca6e28ef690f0965c0badc
-
Filesize
5KB
MD5ce0ddea8aeba2b63953cf079c2464bdd
SHA15df22c8d6290bd26482efc486b1a87d581844b27
SHA25653b9621cba2a2be677f3f191d9641246863e7169a9bde159924786687045d662
SHA512ea4bd3a01665b4708fc4f838176548c7fbc68216a3612296262daead4565fcc864a89bfdb9f84414bcc04f366ab5002cf9dea818765b39489e5a0f1cdbf71dc8
-
Filesize
5KB
MD5ecfe37ce8f53b966c9983891c562f03a
SHA1c7524eb4d9d5221a733285958e95038d1b96663b
SHA256a484901f7dacf8533757b9b67515f4134b40d3562883fde798698670c0d08982
SHA512fc9084de5c27c0e645ab5511059b43a1fab5e4fc9429d9726739086ac4fba2f6383f328a5aa4ad467ff3b0a39dab917820660683d604f7b79b44d27e38b2283a
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
3KB
MD53b1424c0d0c467552fe568244547d2ee
SHA165a6e6be517a0f49c6010355d3aa338ee3d75119
SHA2566e9642ba4a8eb69526d745ab5d833c1d942bb656acb5b8dfad2ac881d22c49d2
SHA5121591becb0347e541bad982c4fc179c738d02e38a17f13b447a8d71ce6035e19ce0aa1c2f0abcae29c702b1034f2dc50ac519e8653b1bc5fd8b4234a005bb772b
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58