Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2023 15:58
Static task
static1
Behavioral task
behavioral1
Sample
Voicemail Audio Transcription.htm_201.html
Resource
win10v2004-20230220-en
General
-
Target
Voicemail Audio Transcription.htm_201.html
-
Size
819B
-
MD5
05034ff4f175854c0284e2934be5743b
-
SHA1
b0700b807e68cab10e282d37bd0d44c7e19c83db
-
SHA256
ac1addd972c40a87465174431c02de8236344ed2cc106a11cdea61f20503952c
-
SHA512
8bdeaf9b9b7abacfc381cfec08f7fd46eb41e3cab390d5f9efadfe1119770e3d95d5b149ef9b93c189e1c6fe1b792e72d2698afbbb5d2f293ebeefc7ebd9062c
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238015204617046" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1960 chrome.exe 1960 chrome.exe 1468 chrome.exe 1468 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 1960 chrome.exe 1960 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe Token: SeShutdownPrivilege 1960 chrome.exe Token: SeCreatePagefilePrivilege 1960 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe 1960 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1960 wrote to memory of 4596 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4596 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 4756 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 848 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 848 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe PID 1960 wrote to memory of 1304 1960 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" "C:\Users\Admin\AppData\Local\Temp\Voicemail Audio Transcription.htm_201.html"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffade449758,0x7ffade449768,0x7ffade4497782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1816,i,13462982422716362089,1813164782531344367,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1816,i,13462982422716362089,1813164782531344367,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1296 --field-trial-handle=1816,i,13462982422716362089,1813164782531344367,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3252 --field-trial-handle=1816,i,13462982422716362089,1813164782531344367,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3212 --field-trial-handle=1816,i,13462982422716362089,1813164782531344367,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1816,i,13462982422716362089,1813164782531344367,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1816,i,13462982422716362089,1813164782531344367,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1816,i,13462982422716362089,1813164782531344367,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5ddb7052b8cb72854b00e20cbf290b9ad
SHA1504f0e70bda5b2f05bf19ba5f8d1589f6bfbb7e7
SHA25696b44ca89eb945a7f32f1146ac89917e3711b749d00a7801feff0bdd171a735c
SHA512a95ff7c430fed0ef03fa3dc164f5444e9baec2a810a9037b2b08fb416909244423305078480691a780f58dcca64b2a2da6f64aabd1150cdb5d5b1c36e6587671
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
539B
MD5a7884eec133f38ae4ce91e592a4f5278
SHA1d7dc5c2ab461a4cb1f50f33c406e9426f266f546
SHA256c1c46522b53ee6760894e392e99fdedfa97bef04933e65a03637976b2530efa9
SHA5127dc5d5a2fe2817ce5fce1adf063e74f07ffb78bc8479c177d6e73ffbbd6b7f1fff27c294a823bef7efcf09177815e0ea6a167f013c753857b6605a25fd67e7ea
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5ccd0851af77cad0ba156acb3c26e9be9
SHA11cbe93621b26c87460ca570d28aeb7596a3b31ee
SHA25693012974229647f767baa3a9368f8321a075b102eb2275049fdd11f368a8f2e0
SHA5129dbd1bc5a7d87523e5d06faf9ba0d5d1ca3141e3d048a440c0c8eee37acad1aeb54e14f69ed6dab6fd1e4abc822c96c4f0f1c92291f54afa681eca7d514ea1ff
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5496e72c2deff3918891df705051cb793
SHA1a1de076281b0ae5b3aeb1064948b9319bf2f31c3
SHA25645e6a11ddad0ea02f7cc2d404433d44c9f8b91d6d8cf0ccab335ca066f23ecb6
SHA5127b0aa80d98583443cf1d8315fc951294e72e9e5ccfa178b9b526582ca1b178cb20f9e9642ab1c3956db9818e63dd4af2ba7db788b087e2a6ff070c3ca25192cf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5f5d9b477cd4dbc884799b77f3faacba1
SHA11ee0ccb485f56c9c73d32f5332a294afac0ba10c
SHA2566f9daa84976b83518ac99be56d9d122a58e16cf7feb6bf115cc586a8e952e258
SHA512a7f7ac0e6c51bbac93117d476a256877e7a30a11eb8f9bca491552b016cd61d7c2b972fb19ca280416370b6e6e070440232117304ac0b81567b5a4f6a58c16f9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
143KB
MD514ace8512979493dac09a08d4c232efb
SHA1ae2208b0d2f843962420b194eb22c293881fbbe5
SHA256e778b7ad2753f5838d7fe3cd741341648889a294afbdb6f21319189884391a1e
SHA512478dfcc12b7c478ca8c942cc08d99544f0a3162a162cd507077ae0d9fc0063fafea40c48e438c79a2f5cfe284e77cdae46b151a85bc21ccd24dae5afeddb0957
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_1960_EGBTYXXWSIYTYBTZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e