Analysis
-
max time kernel
159s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 13:55
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ipfs-io.translate.goog/ipfs/bafkreifzqupc4z5a2jetopzxjfw3y6p4qm5lvkbn4c6bfvfwactjy4sjri/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#[email protected]
Resource
win10v2004-20230220-en
General
-
Target
https://ipfs-io.translate.goog/ipfs/bafkreifzqupc4z5a2jetopzxjfw3y6p4qm5lvkbn4c6bfvfwactjy4sjri/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#[email protected]
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3808 4748 WerFault.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133240569601256129" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 852 chrome.exe 852 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 852 chrome.exe 852 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe Token: SeShutdownPrivilege 852 chrome.exe Token: SeCreatePagefilePrivilege 852 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe 852 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 852 wrote to memory of 552 852 chrome.exe chrome.exe PID 852 wrote to memory of 552 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4496 852 chrome.exe chrome.exe PID 852 wrote to memory of 4364 852 chrome.exe chrome.exe PID 852 wrote to memory of 4364 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe PID 852 wrote to memory of 4116 852 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://ipfs-io.translate.goog/ipfs/bafkreifzqupc4z5a2jetopzxjfw3y6p4qm5lvkbn4c6bfvfwactjy4sjri/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fffd9d49758,0x7fffd9d49768,0x7fffd9d497782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4868 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2860 --field-trial-handle=1812,i,5698207268867267092,14180532061368319052,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 4748 -ip 47481⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4748 -s 16721⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5d9209a8003f1c985d61404af21e4c64c
SHA1d68b661c09f89f7ddceea96c31a3a303e1dcd1f6
SHA256815ff35a8a6d8e4bf4e442d16e9a8dbf91a21f1ad8ef0e7c209d8b61cceb910e
SHA512ae6e02fef08babf0b8bb72b20c73189669119b2144bdd8534f9551afd33097bed9e6d1161b1c668072b31cb65ebdeee1c0efb61507c888d21ac1ff0afb970f46
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
539B
MD5b5295dddb0c5eca7d85e12066bc82e6d
SHA1c4ea3d4a9f9c40817c7045343bb0c5b81a86043f
SHA256e3221cada7cffc006630ea2d99970b3265e04ebddc72e74227248ce608726b6d
SHA512cbfdd8846d1ea7d25fb8023ceb9ae749a658c2ec371363a7c6cf669927c6e7b6cc81abb860ae4768623cd99749a38c13df56b7c736f8eb17cf6fa14ba1eb8d34
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD586a54d9514cf72ed2e404c7ba29cd99f
SHA19c3854a3c1c4e62cbffff2787b9d5984f6760d2f
SHA2567b2d0057eaf3e8882be1a720b63f15eaf8b8c7bfe067b02f2c23388210cc9be0
SHA512e7fbc1b0d9b1a559ef7301d26bcf1db896c64f6b9bd1853519a7a5b01bd48d4287dfa6b61a04e76376069327f6f44c45da74d74b77b7f0b88c1dd83b3038baea
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD55752bc92daf7512a563d5ba1f308a60e
SHA1b205c92eb69d78a355f1abcb45dad945e4e1fd62
SHA25677ed72e36402988102531b8b1f5a484eb785838601ca00555809e61e0e791224
SHA512a83c3aa9c89f55d4d957bd2ed9ce067afe6a3282b986a874a397f90ec23244f247e1d8936d9dd2705601772c2a8ede9cdfc6adadec534ba3cbf38278d057c836
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
145KB
MD5f1a3ceddc255b51c4b264b2289c1f727
SHA1728634ed2335209c543e3c4dc18211bdc3844d89
SHA256e1d6c5026c7d8e6abbd057f6cd2f3ab3dc39e6a3510cfe2beda250c138a917df
SHA51230c3e6b423fbc3c0f50d636aa112c6bf71b55323a84b948738c390b5c9234c249bd8e886549796088cbb08ff1ad6f28eb3b565dddc7a68b4598ced0e3069668c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_852_SRIWGSRSSENBFBJDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e