Analysis
-
max time kernel
20s -
max time network
18s -
platform
windows10-1703_x64 -
resource
win10-20230220-es -
resource tags
arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
21-03-2023 07:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://prephe.ro/Bdsn
Resource
win10-20230220-es
General
-
Target
http://prephe.ro/Bdsn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238605355542304" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4244 chrome.exe 4244 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe Token: SeShutdownPrivilege 4244 chrome.exe Token: SeCreatePagefilePrivilege 4244 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe 4244 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4244 wrote to memory of 4400 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4400 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3152 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3900 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 3900 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe PID 4244 wrote to memory of 4364 4244 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://prephe.ro/Bdsn1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd5fbb9758,0x7ffd5fbb9768,0x7ffd5fbb97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1712 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2752 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2744 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4440 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3804 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3156 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5312 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5276 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 --field-trial-handle=1780,i,12447528805931900610,15406877287995181974,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
538B
MD5879f823756a6ebadbf71befe0e9b0281
SHA1f32ecd7f778873f5944864f33d839f780963016d
SHA256e210ef47adeb307aad8485134aa68b33633b7140dfcc827b168c4c1e2332a67e
SHA512ceafceae10bd3b8255eeae4f1c01b845b72290e9df6e65e7c7e87567dd37fedfb1dabc32ff1b6ef70fa362518b22329cd06701fbab84ba5663e51137a509efb0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5e574ce32d8f53aa1c0df4cd236fd7454
SHA188c8db922096f345a77267823906b8029fc615bf
SHA2560975de7d5a24471220d5bef2c5f820ce141789013334ebd5fde8ebd4f20e8dd1
SHA512c196989c7874cea7b6daf2da862cf55c305115978c0449de3ffab6d8b255a7206f899f55860e525c90f76e6db4afe7fcba75b3332087cdd99d63e5c8a1203530
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD55e77d9b84113797e36f16454a9dfdda7
SHA1468944fadc8f754f700f82fe77ed582b9ac504e8
SHA2565bdfbf148b0ef2cb239bed53d1c3f6b99de541e25c127da390879c2f1fdf9005
SHA5129b2c2ee5a061c7228dbfd4163ecc9e000dce072d4591ce7c4afe12c75e422bde423accf2d3ca6559ad365a8aa5cb578b728a43b2aa4ccd9a9bf68d2cf882b03f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4244_ISQBXTARCBNGWWDAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e