Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/03/2023, 18:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.aejohg.com/p/cp/cb3fb6e39c4ccf1d/c
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://www.aejohg.com/p/cp/cb3fb6e39c4ccf1d/c
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238153640981975" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5032 chrome.exe 5032 chrome.exe 1584 chrome.exe 1584 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5032 chrome.exe 5032 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe Token: SeShutdownPrivilege 5032 chrome.exe Token: SeCreatePagefilePrivilege 5032 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe 5032 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 1320 5032 chrome.exe 87 PID 5032 wrote to memory of 1320 5032 chrome.exe 87 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4640 5032 chrome.exe 88 PID 5032 wrote to memory of 4768 5032 chrome.exe 89 PID 5032 wrote to memory of 4768 5032 chrome.exe 89 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90 PID 5032 wrote to memory of 3684 5032 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.aejohg.com/p/cp/cb3fb6e39c4ccf1d/c1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe75fa9758,0x7ffe75fa9768,0x7ffe75fa97782⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:22⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:82⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:82⤵PID:3684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:12⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:12⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:82⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:82⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:82⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3720 --field-trial-handle=1812,i,17004298226657657553,13380263104799078143,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4576
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52980208742c008c1f827f49ff4eedfba
SHA19b8387f3368590c848013f127f1122874900beb8
SHA25663ef94f036cfa8d439934ef6f4ee04ab26a1862fd2de62e3c30d50a30b26fb08
SHA512c65427dac71ea78eb952a9d949e6bc94942ab9719f951187f0e2dbafff5be3dad6d5a9b3f7cbeaebb6cfdeb9695d0e294d07cbc3d75ac379435cda1b7d8da38c
-
Filesize
6KB
MD5a18eab731f51949de0968ce9911b7464
SHA108218920a5d194092f60088c656ba14a05a22518
SHA2560951f531a979991f31e9b6ccdf294b95ec83bd82e6947935ef1de899215486a4
SHA5128652b24e7a0f6e8c2a72de3bc44488eee90a371534271314f9e9b6c693697455b75df2f3ce5f4d5b76308b2578fd127cbc8f04fd4b08ca56aff35badec7b47fb
-
Filesize
15KB
MD565aafebcdbd78ead55cd57639e8d35dc
SHA10d36fb78ce64ca259a5d7366c366aca021507a8c
SHA25650f6fe67d753cde3165d580b42fd7bf987a4ed97cf734fdd7a52c77f11886ca0
SHA5122776e86b7416d7692aaf6c8a8dc1114c34d07b065f768a1d044a8162f20b45dfd64d5fc87c431148280232780ac3099ca26383f2b955b602f13f4f57e4544cae
-
Filesize
143KB
MD5dc3a8b1296142c52ef2c4d3744b8c4c2
SHA179ce3038ce59669e106463edf0904cd9129ffb80
SHA2569f9c6ea515c95d96fcd8e793e3034590f85d996749d2e83b3c4da7c631ea58aa
SHA512d6a5350b9912ae1a54a91757143dc5d704985eefaf6acb70b3d990c0eab41038f8834a07ae31194caf6a99c2843b00da0d704ad53a0b7f1972abce82aa097f46
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd