Analysis
-
max time kernel
1201s -
max time network
1088s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2023, 03:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://click.smartsheet.com/f/app/qxlsCRIAhF6I5wvqxuUhqA~~/AARF7wA~/RgRl7X-6P0UOY29udGFpbmVyLWxpbmtEW2h0dHBzOi8vYXBwLnNtYXJ0c2hlZXQuY29tL2IvYXBwcm92YWxyZXF1ZXN0P3V4PW9rYnJXWW92ZUE3d2l2SUw4bWxRVEt2eUZxQjVLQ2RvQ0JiMjQyTVRCWDBXA3NwY0IKZAq6-gpkAcR_oVIaYXNobGV5aG93ZWxsQHFhbnRhcy5jb20uYXVYBAAAAAA~
Resource
win10v2004-20230221-en
General
-
Target
https://click.smartsheet.com/f/app/qxlsCRIAhF6I5wvqxuUhqA~~/AARF7wA~/RgRl7X-6P0UOY29udGFpbmVyLWxpbmtEW2h0dHBzOi8vYXBwLnNtYXJ0c2hlZXQuY29tL2IvYXBwcm92YWxyZXF1ZXN0P3V4PW9rYnJXWW92ZUE3d2l2SUw4bWxRVEt2eUZxQjVLQ2RvQ0JiMjQyTVRCWDBXA3NwY0IKZAq6-gpkAcR_oVIaYXNobGV5aG93ZWxsQHFhbnRhcy5jb20uYXVYBAAAAAA~
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133229836847892154" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4656 chrome.exe 4656 chrome.exe 3852 chrome.exe 3852 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4656 chrome.exe 4656 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe Token: SeShutdownPrivilege 4656 chrome.exe Token: SeCreatePagefilePrivilege 4656 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe 4656 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 2072 4656 chrome.exe 85 PID 4656 wrote to memory of 2072 4656 chrome.exe 85 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 3540 4656 chrome.exe 86 PID 4656 wrote to memory of 2116 4656 chrome.exe 87 PID 4656 wrote to memory of 2116 4656 chrome.exe 87 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88 PID 4656 wrote to memory of 3160 4656 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://click.smartsheet.com/f/app/qxlsCRIAhF6I5wvqxuUhqA~~/AARF7wA~/RgRl7X-6P0UOY29udGFpbmVyLWxpbmtEW2h0dHBzOi8vYXBwLnNtYXJ0c2hlZXQuY29tL2IvYXBwcm92YWxyZXF1ZXN0P3V4PW9rYnJXWW92ZUE3d2l2SUw4bWxRVEt2eUZxQjVLQ2RvQ0JiMjQyTVRCWDBXA3NwY0IKZAq6-gpkAcR_oVIaYXNobGV5aG93ZWxsQHFhbnRhcy5jb20uYXVYBAAAAAA~1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff817a99758,0x7ff817a99768,0x7ff817a997782⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:22⤵PID:3540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:82⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:82⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:12⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:12⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:82⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5336 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:82⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1876,i,2196831977488314730,3992299203164043711,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3852
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:968
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD5a04f4a8e7267add5e1cdebbbd2896d1b
SHA1669c0218c6e50e050e8a4072277691bc4d84b58f
SHA2565d2235e39a33499fe8b813021b3fbb7e29f894656d4f86b165cc6fa375480f82
SHA5126af861db6a0c582c14087c21be816863e10698c23a2597e540ee734d7c7e62dcfd6c9cd2c14c21c3556f6f8c8b5d928b4dd3f96a8f85f8e2b180114030fd9dcd
-
Filesize
1KB
MD50f78844851936790ca1afbdb9375b5df
SHA187d9dbe87123e4a3635474f505dccd9141425509
SHA2564cc1ccd036c07eb9391d88630fc248fbd03cddf6b8e7a960e682f5e150b4bb14
SHA51294cc66f7141cfe97f416fcca2f571a604ce7015cf420c7e1904d34d41aaced1fd5550539e71d81882873525822c2774f527905e145c28809fef535746e4e21c3
-
Filesize
705B
MD53e51b9eaed5f5e0dec84119b85bbceca
SHA1c011928271bee4012b8fe4476ade30247d510fac
SHA256294f6126ba8b4a9eeda0879a59d5ccbd134f4454f2038c000f032bdca52f9de8
SHA512b831d007c2f41bd5890c6e0cbd01a7fe0d298ede5417b5a139d18db297d01cc6bc5c74dfb0367535385c542f36e2c3ed157f1ca4ba58681d46f669014f47fde1
-
Filesize
6KB
MD5d17bb8fb5c47390e0b24cef6e134d4ac
SHA1f05cf9fac5b8afe1fea9cae2f0493db25f39a889
SHA256d206049969e1fdce86444831668487765a22c11c14a0428699879f1f10987d40
SHA51294eee075513994b12afd9b1cddd8a44112d37c577c45be48031ec2a9b439f19a820faecc45fd1477959759c5a564815bce997d305061d4a95c4b2dfa66a61a07
-
Filesize
6KB
MD566113c072fd3c24cf97a75a0f8323e96
SHA16dfa0eb5ba657a3749a929c61d4bcdff92522581
SHA2560503be83dbf28312d94a82d75d81f1f88c9fe7986d192085ffe75733aeba608a
SHA512c99e8944a3b91ecd0b07510f2b4b731916247c0e5d624480facde32b48ce03d5da27b856f9fd26d09c16e91bcbd1ba7348bf14f989766a02e27f860d43b910cb
-
Filesize
15KB
MD567021b527b3b6152c97b9672b28dd839
SHA1cd050730bf7c96ab9fe3cbcbc2e74865864a1043
SHA2565097229dfd62fbb4f0dae13cb3649803587196a7bea005a56eea20614717afaf
SHA5125e6ba607733a0a8b40e24b4a1618e85fe63c93591f9981a675d9e43a6f702bbe02377f84d6a588bbf51dee036b974d0e93255316ed8b9316aae6c32665a3727d
-
Filesize
143KB
MD5ee61738ecd8b0d1e311232263e2dfe90
SHA1800b23547eb133b565a60fbb64cbcb1d6ae3fad7
SHA256c357b0c91e01bb4618fbb043e3055b33ca27e7f8816aa9dc152d780651ef85eb
SHA51285ee18623067a81e59652e2bce2d0667d86715af018f69b6b16562e2bcd17a8679dd7458d54bde9336d84f650ccc52738230b34e65326dffd74e63f1c3a5c040
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd