Analysis
-
max time kernel
29s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19-07-2024 15:05
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE [PAID] ref-I3O02.html
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
INVOICE [PAID] ref-I3O02.html
-
Size
3KB
-
MD5
34b1b7e29640ef93fe211233ff352638
-
SHA1
1a14573e03156b1df52b2d757f837f4319998a08
-
SHA256
ece7a9880b2cc093c4ce041477c894db4538839e1e0bff29ec3b2bdf51cd9096
-
SHA512
bea966742d836ab3101abc07ec8d9655a77dbbfa813a0b6b2c7a0daf478d80fcd8983855ace9c070f1e36fe351f803f7108e21fd08534ba7303c7522f13dc677
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133658751656608924" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4252 chrome.exe 4252 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe Token: SeShutdownPrivilege 4252 chrome.exe Token: SeCreatePagefilePrivilege 4252 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe 4252 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4252 wrote to memory of 3660 4252 chrome.exe 75 PID 4252 wrote to memory of 3660 4252 chrome.exe 75 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2992 4252 chrome.exe 77 PID 4252 wrote to memory of 2116 4252 chrome.exe 78 PID 4252 wrote to memory of 2116 4252 chrome.exe 78 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79 PID 4252 wrote to memory of 348 4252 chrome.exe 79
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\INVOICE [PAID] ref-I3O02.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff84ea69758,0x7ff84ea69768,0x7ff84ea697782⤵PID:3660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1720,i,16234849878976126040,9143845724060183779,131072 /prefetch:22⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1720,i,16234849878976126040,9143845724060183779,131072 /prefetch:82⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1720,i,16234849878976126040,9143845724060183779,131072 /prefetch:82⤵PID:348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1720,i,16234849878976126040,9143845724060183779,131072 /prefetch:12⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1720,i,16234849878976126040,9143845724060183779,131072 /prefetch:12⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 --field-trial-handle=1720,i,16234849878976126040,9143845724060183779,131072 /prefetch:82⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4164 --field-trial-handle=1720,i,16234849878976126040,9143845724060183779,131072 /prefetch:82⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4236 --field-trial-handle=1720,i,16234849878976126040,9143845724060183779,131072 /prefetch:12⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f6e7977b-ff44-41ef-9c1d-f7a3d78e64d1.tmp
Filesize5KB
MD575fd1b765ad2b24174b02feead52cd65
SHA18d80ca07ebced1116aed19ac37959ba1bc9c0ede
SHA256024c57dcd79df5a8f0a4495e03a4419fe276434b7b6914fd855ac2f611a34461
SHA512a679bc412635dfe57a1799e1f90819bafa37aa1e455d67170f13515482750b59724a96e74d3c8a22abc74b5638937d96664c75da47d6c3010bec9c64020b998b
-
Filesize
136KB
MD5f393e7bf52848ca3e7572dc980a3afc4
SHA1db7ec06ea780eb1cd9d9b7e5539dbe2040c5ab48
SHA256e105d1115d9510dc856126814cb8ca9b10dcc2b78d82ca5d5d4e2ecc2ae11745
SHA51253547f3f272c24de4d16f7e426f2b9f95df01cfaa9971f1a086f9c5c2edff6b45d58a1bd4536bd4bede7b67e76b54fba5ba769737362f83e0ea698e6795b7b32
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd