chrome[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
chrome.exe
Size 5.3MB
Sample260728-bbvs2sgr91
SHA256 dfb738dd7a296a4fda566597ace96df3bee6301a090553426bed8b9089a688db
MD5 d8102919992ebe8e774e283f5ca4a8fc
SHA1 55e3c0a3f82bb40bd937a34dfa40caae97b1795d
SHA512 434fb8b21feeadcfdca47dcb9f03b998dd339f8f17de38752607ac612852cd811ba3ae4a87f271a29b43475d9dddd20c9b50875034e031fb6fb0fa0099500a57
SSDEEP 49152:OuPeiu9ryjkRDG7iD2dqElWH4ew3UsC2BMIdN9fgAw8axy0vrXYvprg1sC2Q3cjV:Ouu1ywRDIBdZa7btxKpZC
TLSH
T11A467A6196AD469CE07AB038C2976617E7F1BC0C1330DFCB96D08D670E2F6D0B67A619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chrome.exe

File Explorer

chrome.exe

.exe 5.3MB

chrome.exe

IMPHASH 727b30a7ba25ee1ddbcf0043cf41b00d
SHA256 dfb738dd7a296a4fda566597ace96df3bee6301a090553426bed8b9089a688db
MD5 d8102919992ebe8e774e283f5ca4a8fc
SHA1 55e3c0a3f82bb40bd937a34dfa40caae97b1795d
SHA512 434fb8b21feeadcfdca47dcb9f03b998dd339f8f17de38752607ac612852cd811ba3ae4a87f271a29b43475d9dddd20c9b50875034e031fb6fb0fa0099500a57
SSDEEP 49152:OuPeiu9ryjkRDG7iD2dqElWH4ew3UsC2BMIdN9fgAw8axy0vrXYvprg1sC2Q3cjV:Ouu1ywRDIBdZa7btxKpZC
TLSH
T11A467A6196AD469CE07AB038C2976617E7F1BC0C1330DFCB96D08D670E2F6D0B67A619
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4688944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\M\very close#2\build\core\chrome_stage.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

advapi32

DuplicateTokenEx LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf CreateProcessAsUserA PrivilegeCheck SetTokenInformation RegQueryValueExW RegOpenKeyExW RegCloseKey GetTokenInformation OpenProcessToken ConvertSidToStringSidA LookupPrivilegeValueA SetThreadToken

wininet

HttpSendRequestA InternetCloseHandle InternetOpenA InternetSetOptionA HttpOpenRequestA InternetConnectA InternetReadFile

kernel32

SetNamedPipeHandleState WriteFile CreateFileA CloseHandle ExitProcess SetCommTimeouts GetTickCount GetModuleHandleA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW GetModuleHandleW QueryFullProcessImageNameW GetExitCodeProcess GetLastError SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA GetCurrentProcess GetVolumeInformationA LocalFree GetModuleFileNameA GetModuleFileNameW GetCommandLineA GetStartupInfoA K32EnumProcessModulesEx K32GetModuleBaseNameA K32GetModuleInformation VirtualProtectEx ReadProcessMemory FlushInstructionCache Module32NextW WriteProcessMemory WaitForSingleObject VirtualAllocEx CreateRemoteThread VirtualFreeEx GetCurrentThread GetApplicationUserModelId GetSystemDirectoryW SetFileAttributesA GetWindowsDirectoryW CreateDirectoryA GetTempPathW CreateFileW CreateThread GetCurrentProcessId CreateProcessW SetPriorityClass GetExitCodeThread K32GetModuleBaseNameW SleepConditionVariableSRW ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap HeapFree HeapAlloc GetFileSizeEx SetEvent CreateEventW InterlockedPushEntrySList GetCurrentThreadId WakeAllConditionVariable ReadFile AcquireSRWLockExclusive SetThreadPriority LoadLibraryExW InitializeSListHead SetUnhandledExceptionFilter Module32FirstW

user32

GetMessageW ChangeDisplaySettingsExW MonitorFromPoint IsWindowVisible SetWindowLongPtrW FillRect CreateWindowExW GetWindowTextA RegisterClassW EnumWindows FindWindowW EnumDisplaySettingsW InvalidateRect BeginPaint EndPaint SetWindowDisplayAffinity PostMessageW SendInput RegisterClassExW GetWindowThreadProcessId RegisterHotKey MapVirtualKeyW GetWindowRect DestroyWindow SetWindowPos ReleaseDC EnumDisplayMonitors GetForegroundWindow MoveWindow IsChild SetLayeredWindowAttributes TranslateMessage ToUnicode SetWindowLongW PostQuitMessage FindWindowA UpdateWindow OpenClipboard CloseClipboard GetDC SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor UnregisterHotKey GetCursorPos IsWindow DefWindowProcW GetAsyncKeyState GetSystemMetrics UnregisterClassW GetWindowLongPtrW GetKeyboardState ShowWindow DispatchMessageW GetMonitorInfoW PeekMessageW MessageBoxA EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture

gdi32

DeleteObject CreateRectRgn GetPixel GetStockObject

shell32

SHCreateDirectoryExW ShellExecuteA SHGetFolderPathW

ole32

CoCreateFreeThreadedMarshaler CoInitializeEx CoCreateInstance

msvcp140

?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z __crtLCMapStringW ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Xtime_get_ticks _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency ?uncaught_exceptions@std@@YAHXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_id _Query_perf_counter _Thrd_join ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ _Wcscoll _Lock_shared_ptr_spin_lock ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z _Unlock_shared_ptr_spin_lock ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ

winhttp

WinHttpCloseHandle WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpQueryDataAvailable

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

dwmapi

DwmUpdateThumbnailProperties DwmFlush DwmSetWindowAttribute DwmExtendFrameIntoClientArea DwmIsCompositionEnabled DwmRegisterThumbnail DwmUnregisterThumbnail DwmEnableBlurBehindWindow DwmGetColorizationColor

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

crypt32

CryptUnprotectData CryptProtectData

winmm

timeEndPeriod timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr longjmp memcpy memmove memset memchr memcmp __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException strstr strchr wcsrchr __std_exception_destroy __RTtypeid __std_type_info_compare __std_exception_copy __std_terminate

api-ms-win-crt-string-l1-1-0

strncmp strcmp strncpy iswspace toupper _wcsnicmp _wcsicmp isalnum towlower isdigit isxdigit _stricmp _strnicmp strlen tolower strncpy_s strtok_s wcslen

api-ms-win-crt-heap-l1-1-0

malloc free realloc _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

strtof strtoul strtod strtoll strtol atof strtoull wcstol

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback abort _invalid_parameter_noinfo _seh_filter_exe _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit _configure_narrow_argv _cexit _initialize_narrow_environment _get_initial_narrow_environment __p___argv __p___argc _beginthreadex _initterm _exit terminate _initterm_e _errno exit _wassert _c_exit

api-ms-win-crt-math-l1-1-0

logf pow fmodf floorf expf lroundf cosf acosf __setusermatherr powf roundf sqrtf sinf ldexp _dsign ceilf log log1pf

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-stdio-l1-1-0

ftell setvbuf __stdio_common_vfprintf fgetc __acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf _wfopen fgetpos fsetpos _set_fmode ungetc _get_stream_buffer_pointers fwrite fflush __p__commode _fseeki64 __stdio_common_vsprintf_s fread __stdio_common_vswprintf_s fputc fclose fseek

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo