e15e4a8cf87204896518c5f471f6955284a57ad47d56f4a760710600343c4e20

General

Target
statement.html
Size 8KB
Sample260527-n96dnacy2n
SHA256 e15e4a8cf87204896518c5f471f6955284a57ad47d56f4a760710600343c4e20
MD5 5f4345153dff01aaec567e1d9adbf714
SHA1 ad3eb6fc4efbd7f95c9a2d461ba34df73df6c76f
SHA512 a39ec1941450a606357392c6bfd08669a2edfbd8d3330754373fb665d8e3ef7ae92d9341700fccc2134352febc29a91b053a7b48069130ef248ce93ec48725be
SSDEEP 96:Z77JdAgQMQBJz/HoA5PZN0UpUtZewjGwbbbnmxSAbExK2zIselKiX61ytks7bV3/:qReblIhmS
TLSH
T1180240B35395DD3D546A06B2F304AFFCADE2A064373131849C2B958B17F00A59A7BB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243572238086010"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5352	4336	chrome.exe	83
PID 4336 wrote to memory of 4592	4336	chrome.exe	84
PID 4336 wrote to memory of 4652	4336	chrome.exe	85
PID 4336 wrote to memory of 4592	4336	chrome.exe	84
PID 4336 wrote to memory of 4740	4336	chrome.exe	86
PID 4336 wrote to memory of 4740	4336	chrome.exe	86
PID 4336 wrote to memory of 4668	4336	chrome.exe	87
PID 4336 wrote to memory of 4668	4336	chrome.exe	87
PID 4336 wrote to memory of 4676	4336	chrome.exe	88
PID 4336 wrote to memory of 4676	4336	chrome.exe	88
PID 4336 wrote to memory of 5140	4336	chrome.exe	89
PID 4336 wrote to memory of 5140	4336	chrome.exe	89
PID 4336 wrote to memory of 5432	4336	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\statement.html
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb1156c728,0x7ffb1156c734,0x7ffb1156c740
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1784,i,16353624561491633263,8107618137537613549,262144 --field-trial-handle=1964,i,10733018482502028587,7091830749097608662,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,11088448302310419055,11415320949888629489,524288 --field-trial-handle=1964,i,10733018482502028587,7091830749097608662,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,17287754257542137599,4306649616192574707,524288 --field-trial-handle=1964,i,10733018482502028587,7091830749097608662,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,11212228289556147768,17178183449494764659,2097152 --field-trial-handle=1964,i,10733018482502028587,7091830749097608662,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3092,i,8382953259992872226,2183556166888276399,2097152 --field-trial-handle=1964,i,10733018482502028587,7091830749097608662,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,10347362528223571764,13794760882814642071,2097152 --field-trial-handle=1964,i,10733018482502028587,7091830749097608662,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,4123831667819135988,2964793451126581692,524288 --field-trial-handle=1964,i,10733018482502028587,7091830749097608662,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:5432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

2

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b26745435f84b00c9b6701568510e7b7a52116ca0d8ca64b02c4fb7f5ccfbbbf
MD5 f934a1eb12a0690c99e3738858e6a861
SHA1 22f6ff930c31a4f02932f1ab1e2fd6bdd6ff7ad8
SHA512 9ebbd8473a15a57bb0585d159839948d424cca9a2149372900f923ad41e1c24a7b5ab425efee6d8a3388d45b33eccf038433c6c7d016cc9d22cd165f205cf4cb
TLSH
T13BF0F9B6D821DC3718FD1B2930645747EB9013672750995B3B3D820D8FB263B465581C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5a8c466a75187f55ffd72bd25ea79ee139c371e63a87a6e0dbbb75640892367c
MD5 2ae46720d958dd3ae7db9b760a8017e2
SHA1 2ab9355980456762ccf7889375ed0b0f264933f6
SHA512 72c54bc5a1d03121bda4cfb5e5e6a4580d6eed4e0b07239a74138ff3fd0efcbb325272cfc38411e1ded795ced044602cf6e2e7419e70de24857e8e1f00b5e605
SSDEEP 192:XRDciobFvwv7SIp3ep/PRp23k9jHsb+WNnIgPE8eO29XVyIsnAUge:XRDc1vsOIFoXX/xw3Pp2Pe
TLSH
T16842C72EAD24A57BACDBD22AFA257B53D3F6102161D42E84E7FCCA2C15D75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 802e9731416dfdde734a8c32f9b3498a8e31bd2c38f48aa230a91669dda7d98d
MD5 474334982331e518f7838e3a6ac4dd31
SHA1 1973b89cc10dd3526936b57957d19ff668a8cc0a
SHA512 39ef8891d0bd7543d4dbbbc01474f26a7f3bbad22fdf03d701305ec2f04cb21fa591f772d4ae9b084aca0d6fde9bdf11aaee5e34a3049fcca670bc167fbba07d
SSDEEP 384:97j3e7KxkXqKf/pUZNCgVLH2Hfgsl3z7pLuLcSjJ0XOD3a+ErU3klHGu6p2gAR:933e7KxkXqKf/pUZNCgVLH2Hfgs9z7ph
TLSH
T1EA72E8677C4C9A770F94C9CCD826BB4FADB6014A65DDD85883FA982503D6BCB01061F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2e67cb6590ad39a29ebb6bb1e2e528350bc7407439af68e8c6911283807118c6
MD5 576116e0de85200324972e7608499526
SHA1 a3905894f52aa946d246bb4547f99f2e478b06af
SHA512 0ee57f9ad38da932b7946bc9c43ebc983a3ffb5f377b23cea9b1fb4457ff64ac62c3d70ef0d4565e57fc1d298a56a5080fdea8ff9e68fe083570646a10330ae3
SSDEEP 1536:XcwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/Qu+y:Mw3LffUnBKU/F8enCW3iyVEXGey0cB1i
TLSH
T1FDB31231E596FE6BA369562AB50F93181CE249FB44E1B788447C3F19F0C6288EF58C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 577b69f384f694fcf20ab0472dcee20571431ca9009e6e88df31ee4ab889d5aa
MD5 aa96ff0e4f0272b8c83fe69faeba4e37
SHA1 4318812c85d293a7be047f172dc877efa1bfa90c
SHA512 ba94821c9387bc53d44b5314a6d364270560dfb4fefa19d38367b622e20a25b79c1863e43de1a28ee70cba9e0f58612f0e47b827cd6a34c0f3923f10be5bd190
SSDEEP 1536:X2wZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/Qu+y:mw3LffUnBKU/F8enCW3iyVEXGey0cB1i
TLSH
T156C31231F89AFE6B93B9563AB40B93291CD245FF44E1B788447C2F19A0C6288FF95C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads