Analysis
-
max time kernel
64s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 18:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pagure.io/git/c/05a20c87abd08441c98dfcca0606bc0f8432ab26.patch
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
https://pagure.io/git/c/05a20c87abd08441c98dfcca0606bc0f8432ab26.patch
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238974755681265" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1964 chrome.exe 1964 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1964 chrome.exe 1964 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe Token: SeShutdownPrivilege 1964 chrome.exe Token: SeCreatePagefilePrivilege 1964 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2360 1964 chrome.exe 85 PID 1964 wrote to memory of 2360 1964 chrome.exe 85 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 428 1964 chrome.exe 87 PID 1964 wrote to memory of 212 1964 chrome.exe 88 PID 1964 wrote to memory of 212 1964 chrome.exe 88 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89 PID 1964 wrote to memory of 4424 1964 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://pagure.io/git/c/05a20c87abd08441c98dfcca0606bc0f8432ab26.patch1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2e629758,0x7ffc2e629768,0x7ffc2e6297782⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1756,i,13149037692567594496,813234770655836537,131072 /prefetch:22⤵PID:428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1756,i,13149037692567594496,813234770655836537,131072 /prefetch:82⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1756,i,13149037692567594496,813234770655836537,131072 /prefetch:82⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3188 --field-trial-handle=1756,i,13149037692567594496,813234770655836537,131072 /prefetch:12⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1756,i,13149037692567594496,813234770655836537,131072 /prefetch:12⤵PID:1880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1756,i,13149037692567594496,813234770655836537,131072 /prefetch:82⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1756,i,13149037692567594496,813234770655836537,131072 /prefetch:82⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4012
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD569b5898dd809b9aff816d3da9caeba38
SHA13bb039da2069c286db63733f52af2d11da7bc0c4
SHA256d96072e7bb8351e9fc629790413a954837631ade934bfe6425132c0f2039892a
SHA512c4b0e8fdfc78d0f991c1969de471316223f50b75737eeadea97023eb4ab68f31387b46535816c63a54e7e9002b5a141ddedfeb55cc35d8bc5e4fb3b13bc016cd
-
Filesize
5KB
MD5dc65c8f70193598124a56b662c351c4c
SHA19bf2aaedd1529c3e6a77f1d5dba89f0c8b926ab2
SHA2564e1cd45678255a7cbb20aad1bf776fcc7959c3add89355c85b3dc56c48e60be9
SHA5123a76eb100c11d5e5ebeab06eba000645a94b0ad40379fe86349419b17baefdeb25ea37db6a3705b1782d21dacadcfdb5fe71edbdd697eee92c858c956cc8da29
-
Filesize
5KB
MD5edeaa0ba49737c1182f88916c923dbf2
SHA1bdc3ae0bd50751275375b738581f46fe20bcfdc4
SHA256ba7bece4cf9fff2b36bf4d2799fb85da9c55f38cdad61676dbdedc2a06010d82
SHA5127bbf269904f5508d07ba2d66d4be44155e349c1878777bab82e419c484b82237a47acb21de6fea3f1c30dda8f7e459d97ffa2b13dcf179f0fbc263c3a16f1209
-
Filesize
144KB
MD52c78033fb8a05d56d1da16e074b6f2de
SHA14c6927dcc7298893e1c9780409b93630161c0181
SHA2561fd69939f7d1dbcbd4b653e9c5a9778202eea859bcff274e9a1b121c09e470da
SHA512862375d4bdecc2332e8665907ed67a6142e48c39fa8dd6429979c131c10adb6a5ee812a4a7b62fa0510cf26e074252d735ca3132209952aae7ced17efd412f90
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd