Analysis
-
max time kernel
20s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 15:48
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ufl-csm.symplicity.com/track/58a314137b3345316d24110b073f264d/2814963248/realurl=https:/*vinaxlcftaut.com/?&qrc=a2VsbGV5LmJyaWdnc0Bzb2RleG8uY29t
Resource
win10v2004-20230220-en
General
-
Target
https://ufl-csm.symplicity.com/track/58a314137b3345316d24110b073f264d/2814963248/realurl=https:/*vinaxlcftaut.com/?&qrc=a2VsbGV5LmJyaWdnc0Bzb2RleG8uY29t
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239773398714232" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 1344 chrome.exe 1344 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe Token: SeShutdownPrivilege 1344 chrome.exe Token: SeCreatePagefilePrivilege 1344 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe 1344 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1344 wrote to memory of 2204 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2204 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 4988 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 3592 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 3592 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe PID 1344 wrote to memory of 2704 1344 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://ufl-csm.symplicity.com/track/58a314137b3345316d24110b073f264d/2814963248/realurl=https:/*vinaxlcftaut.com/?&qrc=a2VsbGV5LmJyaWdnc0Bzb2RleG8uY29t1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1d839758,0x7ffd1d839768,0x7ffd1d8397782⤵PID:2204
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:22⤵PID:4988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:82⤵PID:3592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1308 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:82⤵PID:2704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3220 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:12⤵PID:1964
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:12⤵PID:3808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:12⤵PID:1876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4540 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:12⤵PID:756
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3264 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:82⤵PID:3764
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:82⤵PID:1296
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:82⤵PID:3004
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4592 --field-trial-handle=1828,i,10930734121303082337,4365250835037870450,131072 /prefetch:12⤵PID:2100
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1412
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
538B
MD59ec17ed89fb9a58cda429a0d077775ad
SHA1d023167fa082758669ee8ed62680e4c45edec256
SHA256ce31433578b9e89132ef5f203fd7491306d729035114c9195c16c75af55b1b09
SHA512d4afa6ef249968055af9b1166a328290a4fd0b7383dc0b55bb9327e0492d9898a4b77182af76720169d6eae6cc49b77ee4f1484d92e610067730bdc2cd18ed40
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD580ae8edb66c236a13809cecbad06c287
SHA180fb5a44d9624366c48bc17a5bc86a93a5f12cb7
SHA25667ad999825aa5c99217615a379bd152bef6dd54926e4ce27cc0dd2a8d9019257
SHA5128b1c7609021d16b165977d25bace3fdabe4d44cffca5b6ecef9b6e57e6be1a8999314b0916560a16107e2bdd5174609a5485942e60f7b6e0205ff2c83f586165
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD55b7fd0a0e47380c56a01ce65f5c7e974
SHA1d21fc439911cce267735051446414f17dfafcbcd
SHA256cad5e239826ef9b25391089d453a89ae32d3595207d45c75e7d3235557a7b60e
SHA512273e83152e352c0b515fd746a46020c9b2b58fda6d46a651e63a25ce83bfbb678ef7c2c77f108226d513b1d5041132374197b871ae86471c777b52e4f08aee0b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD53ad17c685fc3f8f8ced72a70cce48cd4
SHA10542e9704a4bfe26d9674c197999b4cc02f497fc
SHA256dd77166a8a33c50293e807dc182204b9429c827ee215cd0b18be910f212abdc4
SHA5122374d86221b600001d91443173c687f6f664a2d1227c73579911a67d0ac3f6acb0cf875a633e984bb76e8ef2dfff09eafc669245547e7ee9991e039072e05f08
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_1344_KUFPYTLUBMCPEAQRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e