Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2023, 20:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://3EA205997177EBF9DE8CA5C8E5B9CB8D
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
30 seconds
General
-
Target
http://3EA205997177EBF9DE8CA5C8E5B9CB8D
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133237352805219501" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3664 chrome.exe 3664 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe Token: SeShutdownPrivilege 3664 chrome.exe Token: SeCreatePagefilePrivilege 3664 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe 3664 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3664 wrote to memory of 632 3664 chrome.exe 86 PID 3664 wrote to memory of 632 3664 chrome.exe 86 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 208 3664 chrome.exe 87 PID 3664 wrote to memory of 4940 3664 chrome.exe 88 PID 3664 wrote to memory of 4940 3664 chrome.exe 88 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89 PID 3664 wrote to memory of 1584 3664 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://3EA205997177EBF9DE8CA5C8E5B9CB8D1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb93139758,0x7ffb93139768,0x7ffb931397782⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:22⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1312 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:82⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:12⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:12⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4376 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:12⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3200 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:12⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:82⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:82⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4984 --field-trial-handle=1808,i,4249764554430057754,2056538561731249901,131072 /prefetch:12⤵PID:3756
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4532
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD53e0669e4c7bd1e9a04a52a34d29bbfa6
SHA105e3dac8ca11406bf26a04d862785b34bd5dcdac
SHA25669ea37290b9bc431a525dbd01e2869aacf6bb1da2d71c2e72089aa489ea78a9a
SHA51292ed65696e2d60b8469504cf3de2b11600df94dc05860efbef6c088bdb9d3c4c0ad7e13f67fcc47e22bd92ef2f70f829080465044504bc9a52453b410b69a601
-
Filesize
143KB
MD5ae1fd78e907dbaa2e01fb2e559a40a1a
SHA12778f0c5240c4a287a328585af8ecfb0b29d7d9f
SHA256418de4e86ae986f9db428258ed20897e8886fdb9c9c065cb5c2e821f7fffc7f2
SHA5120b007f7e133d9ca57aac170a4823851ac5941aa6303d1a59a59d0d7cbf4aa7b8767aa0771681a704c22aacc9bb21baf58819e28e48027f87247844de82f7c545