Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2023 11:00
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://joannewoods.com/nnma/amc/kzxhap%2F%2F%2F%[email protected]/8dqtae%2F%2F%2F%[email protected]
Resource
win10v2004-20230220-en
General
-
Target
https://joannewoods.com/nnma/amc/kzxhap%2F%2F%2F%[email protected]/8dqtae%2F%2F%2F%[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133237008278423598" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4588 chrome.exe 4588 chrome.exe 3672 chrome.exe 3672 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4588 chrome.exe 4588 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4588 wrote to memory of 220 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 220 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3796 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 4900 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 4900 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe PID 4588 wrote to memory of 3736 4588 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://joannewoods.com/nnma/amc/kzxhap%2F%2F%2F%[email protected]/8dqtae%2F%2F%2F%[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe327d9758,0x7ffe327d9768,0x7ffe327d97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3152 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4976 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3672 --field-trial-handle=1816,i,7903507413594976863,3480778696790250864,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD585bf4e5e041f945d8b566b94eeef6af7
SHA16ca12e05473dbfc27d85a21809cd829e4c9c1f83
SHA2563cb2c79974bb84be79a8ef3a2e1b7dc2a26dff21ba55f836ec3c1bb4f2bb164b
SHA51295230a763d965127440075ad13dfaf042102500a365ea49763dc1f6476279e882bfa3d58847dcbc2b1fcae3a9758b194f13ebf89f06e2015de17e59fbe18b86a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5960127e5b90924b2feffb8c4a6028ae8
SHA1c94bac361c23f6f8101d8475ed12f74e95193c15
SHA256fc285b2256da5853733277ea8247e66e59e210a7d8225d9f557f923807789844
SHA51228b62c373d3205e4bf036bfec4b1891e9e1599e3792d433338bab313911e0ebddbda0e79d8d87ea8bb13a8d57b700be6fa09d96d904a81c23c330bb2e1b0942e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5c4e27544df3b822b7cc13208e3a0262f
SHA1751e0a1615e93cfdbb30e8e116db527e49a3b038
SHA25682b391b8a354cbfeec156e6521894f8f50bafbc627490c341a590477ba4c15dd
SHA512a2f2dcc3b63f388b553c01b2ea2b7da9a802244876116437f312c7931a5e131687b94156e928d60f3112af500388c104c3769e5e6c1a35c48d577a244bd232d8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
143KB
MD52b8d2fb5ae4042ae25cc0ff565879c99
SHA1fcc9bab9750cd69b3558c1b22b54a226d7358903
SHA2563836ae6a644bf11bd38006cbad2b7bc4e31df5fdb635b8e547910ff45bfe507c
SHA512cdc0828dfba1c5aac6458ecdca408305d61986c17683a8c9bff6dbfb6d7e17ac4c889b477a621cf54ff2b033f6dc2b4fe92d11025373c15c1a6788ed91c13718
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4588_HIMCFHQRDEUSUHBAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e