Analysis
-
max time kernel
29s -
max time network
27s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03/03/2023, 12:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://kaverin.gitlab.io
Resource
win10-20230220-en
General
-
Target
http://kaverin.gitlab.io
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133223229285475092" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4092 chrome.exe 4092 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe Token: SeShutdownPrivilege 4092 chrome.exe Token: SeCreatePagefilePrivilege 4092 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe 4092 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4092 wrote to memory of 5028 4092 chrome.exe 66 PID 4092 wrote to memory of 5028 4092 chrome.exe 66 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 2012 4092 chrome.exe 68 PID 4092 wrote to memory of 4912 4092 chrome.exe 69 PID 4092 wrote to memory of 4912 4092 chrome.exe 69 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70 PID 4092 wrote to memory of 1076 4092 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://kaverin.gitlab.io1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ff8c3a59758,0x7ff8c3a59768,0x7ff8c3a597782⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:22⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:82⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:82⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2720 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:12⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2728 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:12⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1484 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:12⤵PID:788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4220 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3628 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:82⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1740,i,2849543800750530100,17477551932596925268,131072 /prefetch:82⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3788
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d66a9abfe21a90271bd02a1009a4ad08
SHA1ebb3b1f08ef5e68bf53f336259588d8e4b7cc97b
SHA25615146a1bc6a89b20d4db2952fb1d703406108ba179697737ee83ecfd381b0dbb
SHA5126491f9f091179f47980a5b6dc233c1a529a8a6add7606d31b6cdddedfa18c4dce867cecc43dd64a1eba73beff6dcd4033ff8949473216a3b2e9a90287fcad307
-
Filesize
5KB
MD5313ed890425de5f68a35b96a84e25a1f
SHA10abb3c02e496de8535de41bbdfc546604d31276e
SHA256562736280fbff69474c089da7944f088df15eec19ff595a67c2995944a28cebf
SHA51246e4e8f178cb9a24dd7a07427dfb8653ca9c86e057888bf3b01b6e88e7c6cba9e02773865d811be811f991c345b1e5d77aa8d12634d19fd7bf094c5b29785def
-
Filesize
142KB
MD59fa94676c08b31b485ee060f3a79faf1
SHA11fcfc682d1aa203a13f20728d896529df270decf
SHA256d18ea58d00485a0a095efb65999d0573ba3b3b7780c55bdef659ff87a72691dc
SHA51246f6235e474952915fe59d9da6a4e8842c26cdc1c2c868bb2740aa9f5e9786fda160f401ba22c915dd65235398b63b593a7562f8ffd5a896a02a458067bdd9a0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd