Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2023, 01:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http:///dashboard/uploadID.php HTTP/1.1
Resource
win10v2004-20230221-en
General
-
Target
http:///dashboard/uploadID.php HTTP/1.1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133235786237224468" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1420 chrome.exe 1420 chrome.exe 1300 chrome.exe 1300 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe Token: SeShutdownPrivilege 1420 chrome.exe Token: SeCreatePagefilePrivilege 1420 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1344 1420 chrome.exe 85 PID 1420 wrote to memory of 1344 1420 chrome.exe 85 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 2040 1420 chrome.exe 86 PID 1420 wrote to memory of 1992 1420 chrome.exe 87 PID 1420 wrote to memory of 1992 1420 chrome.exe 87 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88 PID 1420 wrote to memory of 2396 1420 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" "http:///dashboard/uploadID.php HTTP/1.1"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3a679758,0x7ffd3a679768,0x7ffd3a6797782⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:22⤵PID:2040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:82⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:82⤵PID:2396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:12⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:12⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4508 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:12⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3296 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:12⤵PID:3608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:82⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5172 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:82⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3996 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:82⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4560 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:12⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1668 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:12⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2852 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:12⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1848,i,81009076726411134,5853837121169317706,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4412
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53e2e626f31b0ef520895a894530bf143
SHA128ce4dbc85522dcf392d4122f926eb5dce3e2545
SHA256374d27a29ff34b360e19ce9e6c79f8eef4d52e72b884cf5a99e20c2174d9aeb3
SHA512aef0c5a426792369e77e7f2c19d1074a9a8d6fef37209791e8c76c0a7f78faa9b865f057927c13963cf01e27055f429f0dc7b834bdfedf3af1b7695c913ee463
-
Filesize
6KB
MD589f9139ca41b59ed7f43f2fd9a20d357
SHA1cf86e0f62037f73790990cbd2603cfd559f8596b
SHA256670cc1c73b0552457d12810c993723db536d663e276364e17051538635592009
SHA5126bcbc74541b24c84646736f3058ccb07134089bce15940316a9fe0ea0fb03599dde4e74e6a2015895819978b5516317e15fbec8f4f83216a192492f468ac5113
-
Filesize
6KB
MD575689e8985cd5c9245c1f671eca3130a
SHA14e3fa1429f89b27132b1c81f90e16b9ddc429516
SHA25666f70817659af54e2c05526e824c0fc57db366cd9d901fc952dd3a6859097b2d
SHA512cbb1840be0f1097eedfee75334c696b1bead125edc3990583b28038a7c76fe5d8621898fcd69cdd56961440c139552d9b93a816ba5ce3cf3d9c49f9efc551aa9
-
Filesize
15KB
MD5b0538ccc65019347ea1deced75629185
SHA19caee2b997debdd14e9dd242ad8c0212a60d83fd
SHA2568940bf83ebd64f3d64c4dc927cadddd466fe4c8d1f68f425f8a16027c594d148
SHA51232de0c1276a6df616c54454ab16335b714911f4d072e945d0c21876154b7e83b81b692bbb086d31e13ddb62a9d0cb4d746cfacf8ee7a1f7e9156bbbbc0b33d79
-
Filesize
143KB
MD5690ef7de3379505b1483e7958f8ff5c0
SHA1accd09d2e49a8e62c1c1aefa8e6681a3ecc2dae4
SHA2569405659b0a09a685cd226f686da3c37e342907831bee0d2a0c6407c9225f6baf
SHA51278bef502dcc2512ee22ca5394c36a7c74f69ef1272a885f745c77a68b7e0b064cba327aaa6d9fdd1c6f2656359c2b74a6524a854127e1233bcbd14b793e57aad
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd