Resubmissions
10-01-2023 20:41
230110-zgh87she82 1009-01-2023 13:23
230109-qmzcyahg5z 830-12-2022 04:52
221230-fhnqjafa36 729-12-2022 23:57
221229-3z3x4shg5y 829-12-2022 09:56
221229-lyp67afh7x 429-12-2022 09:28
221229-lfpspsfh5s 1029-12-2022 04:18
221229-exfssscc88 129-12-2022 04:12
221229-esw9zsfd3z 818-12-2022 12:11
221218-pcmqqabh42 804-12-2022 12:48
221204-p157zaec6t 10Analysis
-
max time kernel
129s -
max time network
71s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
29-12-2022 09:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://google.com
Resource
win10-20220812-en
General
-
Target
https://google.com
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
Processes:
control.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings control.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
chrome.exechrome.exetaskmgr.exepid process 4060 chrome.exe 4060 chrome.exe 2728 chrome.exe 2728 chrome.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe -
Suspicious behavior: LoadsDriver 64 IoCs
Processes:
pid process 636 1804 1920 2188 2184 1268 2648 2832 2828 2456 2660 2024 2652 2644 2640 2392 2412 2424 2388 3780 3800 3784 3788 3664 4728 4988 4468 3564 3872 2296 4860 4276 3540 340 4524 1840 4140 3332 4260 2888 3724 3372 2260 1964 2208 5064 3728 5056 4880 2504 4136 3392 4368 4756 4100 4844 3520 3632 3752 4840 3484 4788 3388 940 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 2728 chrome.exe 2728 chrome.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
taskmgr.execontrol.exedescription pid process Token: SeDebugPrivilege 3888 taskmgr.exe Token: SeSystemProfilePrivilege 3888 taskmgr.exe Token: SeCreateGlobalPrivilege 3888 taskmgr.exe Token: 33 3888 taskmgr.exe Token: SeIncBasePriorityPrivilege 3888 taskmgr.exe Token: SeShutdownPrivilege 4652 control.exe Token: SeCreatePagefilePrivilege 4652 control.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
Processes:
chrome.exetaskmgr.exepid process 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
Processes:
chrome.exetaskmgr.exepid process 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 2728 chrome.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe 3888 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2728 wrote to memory of 2756 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 2756 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4088 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4060 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4060 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe PID 2728 wrote to memory of 4836 2728 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0x88,0xd8,0x7ffbb00b4f50,0x7ffbb00b4f60,0x7ffbb00b4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1512,9125386298933732504,3161520184834630195,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1868 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1512,9125386298933732504,3161520184834630195,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1524 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1512,9125386298933732504,3161520184834630195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9125386298933732504,3161520184834630195,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9125386298933732504,3161520184834630195,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2824 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9125386298933732504,3161520184834630195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4056 /prefetch:82⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\net.exenet user /add test test2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /add test test3⤵
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" SYSTEM1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\crashpad_2728_UTARVFXDIABDCDZEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/208-154-0x0000000000000000-mapping.dmp
-
memory/304-155-0x0000000000000000-mapping.dmp
-
memory/3164-135-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-117-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-120-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-121-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-122-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-123-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-124-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-125-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-136-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-128-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-129-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-130-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-131-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-132-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-133-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-134-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-127-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-118-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-126-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-119-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-143-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-139-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-140-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-141-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-142-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-138-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-145-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-144-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-146-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-147-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-148-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-149-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-150-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-151-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-152-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-153-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-137-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB
-
memory/3164-116-0x0000000077100000-0x000000007728E000-memory.dmpFilesize
1.6MB