Analysis
-
max time kernel
19s -
max time network
20s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
21-03-2023 22:26
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://api.sparknotifications.walmart.com/api/track?action=click&campaign=bsjy1uwl6v9y9x1&message_id=BQ6NGO3PoZ-1660831276514&trackingid=BvI-3ijv7u&redirect=http://qmirjajg.1eo4aly.lunarsuh.za.com.///?YYY#[email protected]
Resource
win10-20230220-en
General
-
Target
http://api.sparknotifications.walmart.com/api/track?action=click&campaign=bsjy1uwl6v9y9x1&message_id=BQ6NGO3PoZ-1660831276514&trackingid=BvI-3ijv7u&redirect=http://qmirjajg.1eo4aly.lunarsuh.za.com.///?YYY#[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239148005808361" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4140 chrome.exe 4140 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4140 wrote to memory of 3520 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 3520 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4208 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 3884 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 3884 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe PID 4140 wrote to memory of 4624 4140 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://api.sparknotifications.walmart.com/api/track?action=click&campaign=bsjy1uwl6v9y9x1&message_id=BQ6NGO3PoZ-1660831276514&trackingid=BvI-3ijv7u&redirect=http://qmirjajg.1eo4aly.lunarsuh.za.com.///?YYY#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa77349758,0x7ffa77349768,0x7ffa773497782⤵PID:3520
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:82⤵PID:3884
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:22⤵PID:4208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1360 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:82⤵PID:4624
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2756 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:12⤵PID:2544
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2736 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:12⤵PID:2804
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4380 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:12⤵PID:1004
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2992 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:12⤵PID:4936
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:82⤵PID:700
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:82⤵PID:5064
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:82⤵PID:3240
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4820 --field-trial-handle=1776,i,8202781942278367556,8566308222875435506,131072 /prefetch:12⤵PID:4292
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5134b6ff08f21461ba1b74ebedb7a53c0
SHA1e4a89c67f8bcd91a0146d6c8cc7ae3ee4febdb7b
SHA256e2adfb4563435a3f040e6b7da0d07c3630dc96145a6a9307166340b785e1cf2a
SHA512d23068cca1cd992011f8c6a4477baf791ca4a30b84c9a32924d1956cbe24ab3281b1fcea16ca4a11a9bcef90df22bd778353c2a9b99f96f3cfbc208f9135d6dd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
12KB
MD5f1f10d1d4fe86fcd0ab0af70ca96c9e4
SHA166fa6ef5a0911a344030ee311de6bfe49196ebdb
SHA25610d85612fc44db2dda49184ea64fa8b0a044c3ac78472f71f9edf6c7aace0bf8
SHA512bddd74d9b105825d90cd3f42c892d97a307b7947cdd8cdc351e627684bc9bee3a0f1698d575c454dee4a04e3558d67a4cdd284b914cfdbfd7dfa4e623a0baddd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD535252de5ba4cb6b1635c1db77bed51da
SHA1efef541e5c9f3139fa66351b3db7f46eeb6d2485
SHA2568450cd06abd3b655efade4f2b6fff5d8428741582c2bc5091326cfddbd320d32
SHA5123130d8d271a6afa56a6d376498bcc9e69cd66e3e6938e5d329080b327feb9ec6991be03407747494e423d28d28a469922c159395f257ca44c0cc91f6a55bab32
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4140_DXRAFJQHYBPMTAKPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e