208bddce6ec6b45c9b3646ea871ee06bfd58829fc136b8f6d8d1dcf97b61061f

Analysis

max time kernel
173s
max time network
151s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

happy-phone.webp
Size

7KB
MD5

0fa1c29debfbc61992b788f8c3a60567
SHA1

22a00553f2ca86f6a501128c08fbd77d516ea480
SHA256

208bddce6ec6b45c9b3646ea871ee06bfd58829fc136b8f6d8d1dcf97b61061f
SHA512

b543f7e9157437d98d1624d2f5ae962b9bf8b9b21b390125c9b3ae92a19d08135e6fce15c5380bba98b7b041a51982f613b901804ccdbe9f150e4c5ce4788b5f
SSDEEP

96:lNk4RnwHQvHuO5zMZ7J1EC9tf5iOoesbFoFPq8UtGi4Mp4Xu+fqpLu92j4:lNk4RMsHukMZT75iBbFoFFUt6buyvQj4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2852	2244	cmd.exe	31
PID 2244 wrote to memory of 2852	2244	cmd.exe	31
PID 2244 wrote to memory of 2852	2244	cmd.exe	31
PID 2852 wrote to memory of 2836	2852	chrome.exe	32
PID 2852 wrote to memory of 2836	2852	chrome.exe	32
PID 2852 wrote to memory of 2836	2852	chrome.exe	32
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 2656	2852	chrome.exe	34
PID 2852 wrote to memory of 1036	2852	chrome.exe	35
PID 2852 wrote to memory of 1036	2852	chrome.exe	35
PID 2852 wrote to memory of 1036	2852	chrome.exe	35
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36
PID 2852 wrote to memory of 408	2852	chrome.exe	36

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\happy-phone.webp
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\happy-phone.webp
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7aa9758,0x7fef7aa9768,0x7fef7aa9778
    3⤵
    PID:2836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:2
    3⤵
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:8
    3⤵
    PID:1036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:8
    3⤵
    PID:408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:1
    3⤵
    PID:2292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3204 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:2
    3⤵
    PID:2188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:8
    3⤵
    PID:792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:8
    3⤵
    PID:1224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 --field-trial-handle=1396,i,4657346258031560433,14204479136033440137,131072 /prefetch:8
    3⤵
    PID:2072

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3c33ceb9-d4b7-45f2-b05a-4e0003470129.tmp

Filesize
320KB

MD5
1d7e916af42939f11bb2ee34866ed7c9

SHA1
397d5897626a0b64e88e93a8c6bb015bf01c59ae

SHA256
b11457e4b0ff4551de66178edac62af1fc9a46f3a5160613260c0c6604f58936

SHA512
9de405f7e8c455552be98d19779785233ae4b6b0b2fc6bda5d5603858c337631b0cda5504e9eb8c500ecce198d5617eacc60180c23afafe95641ed5c1955d86b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0669ed7732d3c93ce17b5fb32e15917a

SHA1
61c1430909b46e00107d74c24aa3d7d1be45b951

SHA256
35a27359ab000b05d521f754269f7939fc81ea794a0ffe18aa4d6262fa6e2380

SHA512
603f55c13ebfd04734d66dc132c78cf38e4dcc46ab66ba946b0bac8cf84a29b90c1ccfe66fee15ce82026818d94f12bf14da161f4be8a87e11d83171dfa189e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e1c36b998ceebf2a42cdadfea3fde78c

SHA1
a981b3249749804ea068840559d830a9fa5adb4b

SHA256
0ee71835e6aa52b8c2b1d832ed91dcba15c96cc7bf6d375f13a19810e68ad538

SHA512
781bdd1ea758f4195f9f472d6e335136294534087d121ab40bc8b6ff57077050aa40b808e0bbb788da0ba1b57fc4b403c6be6af2cda460a8b586335144b742dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
162KB

MD5
3edffe170d5035581a5f84c221088bb9

SHA1
c25b111dae1667b2dfa16dd9aa912dab2bbddb2c

SHA256
0c0354d8147b57892b7fc1baef078cc0dbec802f63822d861a88725ecc3230f8

SHA512
f70074b0a908a9627ce9030936f44eaea3f7b29df3c54be8fc597321f0f0f7b07d8309a1f18190a8a86d8532b88d8b6491de4b4d1efb817ea3f22026be04225a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
336KB

MD5
440f5a4b9997489765edb1b514fd0730

SHA1
2acd618092bfd8cd22689a3d3d899733c3529818

SHA256
ad87e79c965ae086ad2819aa6f23215a49f935c7bb8786a9dcfce6d47b2ed3e3

SHA512
d76dd9f6571aad3bb83ce18e3ddd8380bf9fd10dba5d91bef7e1c6b16dcee76f04f544b959ded836e59c824af2c7cb2e94aec2dc994a2ef02115b5c98b714578

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit