4a31ba1560c3df6cb52251885fc2c2e386fba92ebdcc2c988eabd34f9416bf56

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pack.png
Size

41KB
MD5

d20f55dc9d79e55dc30660977d070af6
SHA1

e9e72a4e5ff4eafcbc71bdc1f0446b0e1765f510
SHA256

4a31ba1560c3df6cb52251885fc2c2e386fba92ebdcc2c988eabd34f9416bf56
SHA512

bf97a93bd8822d3051e8be59df8effeab87d16040ead49816257002f10e0cbf7d88cc61ca1936c46ee8e96b90b78e28bbf8a24a25bf972377d1ea183db3abaae
SSDEEP

768:5AmkSqG3kJzIWUGBAP9v8A1Ouudb4m9c2apTb6oT8sU1:6mkIeMWUGqPuA1qdcoc21oAZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2368	rundll32.exe
2368	rundll32.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2684	2108	chrome.exe	32
PID 2108 wrote to memory of 2684	2108	chrome.exe	32
PID 2108 wrote to memory of 2684	2108	chrome.exe	32
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2232	2108	chrome.exe	34
PID 2108 wrote to memory of 2636	2108	chrome.exe	35
PID 2108 wrote to memory of 2636	2108	chrome.exe	35
PID 2108 wrote to memory of 2636	2108	chrome.exe	35
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36
PID 2108 wrote to memory of 2628	2108	chrome.exe	36

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\pack.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d09758,0x7fef6d09768,0x7fef6d09778
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1432,i,1798267931863358876,6750020520934522904,131072 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1376 --field-trial-handle=1432,i,1798267931863358876,6750020520934522904,131072 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1432,i,1798267931863358876,6750020520934522904,131072 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1432,i,1798267931863358876,6750020520934522904,131072 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1432,i,1798267931863358876,6750020520934522904,131072 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1124 --field-trial-handle=1432,i,1798267931863358876,6750020520934522904,131072 /prefetch:2
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1504 --field-trial-handle=1432,i,1798267931863358876,6750020520934522904,131072 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 --field-trial-handle=1432,i,1798267931863358876,6750020520934522904,131072 /prefetch:8
  2⤵
  PID:1944

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
633B

MD5
fe43ac319995a185e01f9a63ff52df2a

SHA1
925c579887d6d43fb80ec7a38e870f399a2839c2

SHA256
2ba257eeb3fbfdc64166bc24f77e04fcbbad3f0f032c14f72d9305c5bc737205

SHA512
d8c022a7d01b6d7df4fc5cde25a0db0bf98f1c19d606fc855b3fdf21e7c46a12f286312a75418fbebaf07352977dbde540718c5b39da59f8f04a09abaeb9ced1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
128889b0a1c7150dbe141cbb8bc50cfb

SHA1
d3764820fa27a91761684df5bb300a8b349810e1

SHA256
0423f4e20832670104444d6214ef23794e33f70d711cf5354478e95701bc3a5d

SHA512
853e79f580733be99383601625956faffe1750d8bfc145f8f98c05492d58e47ee71041dca179affa46be1bffe21879e0235bc466096ff27243f7f03003462985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
28f1acb7c4b9c6b43ebeba34e851872b

SHA1
1d13702069be62ac4664596a05285e6c7ef9c84d

SHA256
49a6f06a0011f36fb47f12e2147d223a9e78a0fbcb59e4e7d5e0dc75f831c15e

SHA512
b521dc7fad51b92246c0490e296d981c762fcb4d12bccb18de90a90c1f6871c5ad0926bedabea4354c794186d223bb519d9ba69190fd8f402ba7363a924a7332

Download Submit
memory/2368-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download