Overview

overview

10

Static

static

URLScan

urlscan

10

https://aged-rain-41...

windows10_x64

1
General
Target

https://aged-rain-4156.on.fleek.co/

Filesize

N/A

Completed

19-05-2022 15:06

Task

behavioral1

Score
1/10
Malware Config
Signatures 6

Filter: none

Discovery
  • Enumerates system info in registry
    chrome.exe

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductNamechrome.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSchrome.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturerchrome.exe
  • Suspicious behavior: EnumeratesProcesses
    chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

    Reported IOCs

    pidprocess
    1828chrome.exe
    1828chrome.exe
    412chrome.exe
    412chrome.exe
    1616chrome.exe
    1616chrome.exe
    3704chrome.exe
    3704chrome.exe
    4692chrome.exe
    4692chrome.exe
    4512chrome.exe
    4512chrome.exe
    4196chrome.exe
    4196chrome.exe
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    chrome.exe

    Reported IOCs

    pidprocess
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
  • Suspicious use of FindShellTrayWindow
    chrome.exe

    Reported IOCs

    pidprocess
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
  • Suspicious use of SendNotifyMessage
    chrome.exe

    Reported IOCs

    pidprocess
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
    412chrome.exe
  • Suspicious use of WriteProcessMemory
    chrome.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 412 wrote to memory of 1040412chrome.exechrome.exe
    PID 412 wrote to memory of 1040412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1840412chrome.exechrome.exe
    PID 412 wrote to memory of 1828412chrome.exechrome.exe
    PID 412 wrote to memory of 1828412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
    PID 412 wrote to memory of 2744412chrome.exechrome.exe
Processes 23
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://aged-rain-4156.on.fleek.co/
    Enumerates system info in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of WriteProcessMemory
    PID:412
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff6acd4f50,0x7fff6acd4f60,0x7fff6acd4f70
      PID:1040
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1692 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:1828
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 /prefetch:8
      PID:2744
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:2
      PID:1840
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
      PID:4528
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
      PID:4368
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4088 /prefetch:8
      PID:3464
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4964 /prefetch:8
      PID:3632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4412 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:1616
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:3704
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4472 /prefetch:8
      PID:2112
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4408 /prefetch:8
      PID:4032
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:8
      PID:3920
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
      PID:2276
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
      PID:4012
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
      PID:2920
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:4692
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:4512
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:8
      PID:4168
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=776 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:4196
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 /prefetch:8
      PID:4484
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,4583896401151570988,5812958167452481475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
      PID:4324
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads

                        • \??\pipe\crashpad_412_RLNIZEWNIUJHLKDY

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                          Download Submit