Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2023 15:29
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238035994426083" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4844 chrome.exe 4844 chrome.exe 4172 chrome.exe 4172 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe Token: SeShutdownPrivilege 4844 chrome.exe Token: SeCreatePagefilePrivilege 4844 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe 4844 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4844 wrote to memory of 816 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 816 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 224 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3864 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3864 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe PID 4844 wrote to memory of 3804 4844 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://tawnlfzkel640fc8f766961.andergc.ru1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade629758,0x7ffade629768,0x7ffade6297782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4600 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5352 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1812,i,6087139696296609450,17571955046435962568,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD5100b56c46f2deac718fa6ee3d04965d3
SHA19cda9918a0fbdb62e2f7c1e027b1b192d8495ae0
SHA256b4541e7cbc6ef47a102f1eded5c7100b3e598bc31a992ae444e97c4cbfcb85fa
SHA512006f742c9e02a5ff95508fc56f64a5b10d4bffa903c5bcd3842964f33047ae622713e67e1ac3260d0e35e3942062004284d5649f4c61b3d59a439ce317beff61
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5db599c941b4a6003b735b5d799a4b6c9
SHA1552a4c6cdf27a48983dd2d539fb72a2ea2557b8e
SHA2568dfc71fd9af2f6e5f981cc481342702ee5d68212dd6dca9c0b90f2a07eb09307
SHA5127ce07fb7218e2e6f8eb7a83a594c23522e2fa7b75d3d4df81b7090a00da75eaf0bb982dc536b7be4467d88307127f4b2952c9c5cd577c7e3d5ceec15329e6c3c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5690ace3d20a03c19123c898ba788c72d
SHA1dc4f0e312ec3fa2ec823797e9159b0c0e0caa222
SHA256d3a877a65f5e8c053e0364df107219c34ac5504ed132a683899e53b318cb769b
SHA512d45f06978876c1d5a3c17a33e517a6e253f7248ff7d9102df39407546a7adf7ec3ca45cf0787e004f62fb7292d64fefbae15e211ae9239fc1098bfee0d8508c0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5ae5f4476d0244c52df4d92626ced1491
SHA1c830e3dcc6087e27dd9f305b21f20d7188f293d5
SHA256781dd554bd0a7427c53e7095c77b6c90afbc6ec83daabf1a26c4434d5bae59da
SHA512de320cd3af4e056ffb3d8214c5f7f77cb469d66c2997fa7330b64db337f226ae5171312cca8273cd47578c36fc08f5ee7a4d92136f7e7cbd56b8172d83711fe9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
143KB
MD54d0d2395ef1950dd888062991ffc4adf
SHA159e9987aca1453bb3b24411463182453cb6c8c19
SHA2562d27612626fb8bf9ff3c215b4bd2252dfc62b93f7bb9a782a3a0a6d12c56f1a6
SHA51201466346cd8722490a3e1ad39658c165456f0480277758210d61683d9491259f81725e551d259816f44131cd55f016c4f76a21b30a33cc1fbe76fceb675f8ba4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4844_AEEBWYEVPTIUOSBYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e