Resubmissions
24-03-2023 03:50
230324-eea5laca49 124-03-2023 03:42
230324-d9r6xsea61 124-03-2023 03:41
230324-d8x1saca24 1Analysis
-
max time kernel
120s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 03:42
Static task
static1
Behavioral task
behavioral1
Sample
ATT00012002.htm
Resource
win10v2004-20230220-en
General
-
Target
ATT00012002.htm
-
Size
210B
-
MD5
ec648e280ee68a08b16602d335687c33
-
SHA1
424af13b5e65931b6897386f95343e8693b7099f
-
SHA256
bd27523d0e5b852f6a4fa1d7a9163ad361adbfb0b95541c7370d7f4e9b486cf3
-
SHA512
038eb9622dfba3850d31178c1bbdd7e611a4281f53dd0fb39cc80132140df83887e42b617f636a2e07a77af5f3dc22742c4adf3d282a551d83a87545d9fed534
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241065882580271" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4484 chrome.exe 4484 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe Token: SeShutdownPrivilege 4484 chrome.exe Token: SeCreatePagefilePrivilege 4484 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe 4484 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 5004 4484 chrome.exe 86 PID 4484 wrote to memory of 5004 4484 chrome.exe 86 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4304 4484 chrome.exe 87 PID 4484 wrote to memory of 4024 4484 chrome.exe 88 PID 4484 wrote to memory of 4024 4484 chrome.exe 88 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89 PID 4484 wrote to memory of 1960 4484 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\ATT00012002.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91c59758,0x7ffb91c59768,0x7ffb91c597782⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:22⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:82⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1320 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:82⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3220 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:12⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3256 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:12⤵PID:1180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4092 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:12⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4740 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:12⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3208 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:12⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5304 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:82⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:82⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:82⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4028 --field-trial-handle=1800,i,10432979361363104246,4764302599481659156,131072 /prefetch:12⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3048
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD59a5eaab8e807ae5c3b20f0fd3f451b53
SHA162e46227837a4039e195668641621eabe260a8a4
SHA25646402ecfa3dff4aaf817bac54afc07abff60176a7bc2b9c8809c124cf6a41c2b
SHA512b0887a073048839521f9fefda69dced9019e4b3dd7c6282c90991b323282c4774cf8abfaf399b7ac7a72ee12b229c582608d60edf41859d98b5189473f2cbd29
-
Filesize
1KB
MD50c59b246619d21aff6e1536356c58d6e
SHA1f222b6f49c12e3fffd4c85238998af322484a6f9
SHA25687a3085382d60935de3463e420fb6d6b9dc12b8fa19bb0b283ee768b57f67c17
SHA51216a0e13239b8098a93bbbf42de12f5afdeda84ab900454e8079d2d3fed899e88db6591b1d924d3872b7e5eabd907a56ffa300c66f2909a7359d782268bc48f77
-
Filesize
538B
MD5692c3d82929ede4e7dfeeda64652e50e
SHA1bbb70f92e5aa8f80669ddf8969a53086b7a144a7
SHA256bb86936a348f3c5c4f3fb76b8d9ef3f6f5192b1d3bfbed665c8a915c8f1150be
SHA5127d91554cd2f50c9ab395394456dd66f2945ab1fc976d0d2d59eaf03b8357750d965c30dc471e3f087e81ea26341e1d3a8a1778cfc3b4e6c3bcb42df74a25eb6e
-
Filesize
6KB
MD5ffc4fdc61ee50609556eac307644a66c
SHA141c33ac7b33ee24e8b9f1f8b102ef2e8a57c280f
SHA256a02b941cb5ad617bb71cc3cf0c2f05565b96fa64720f86ded9163a8defe09ea2
SHA51282afe06fb168130a18b9e30c560ff7d558db14d18bb3e97696a46258434cdeba29effe8ae9a1468c9264af8eb98c87a808a72aff03c4d6e6cff53d7e4062186e
-
Filesize
6KB
MD5c62b2d741d6ed7dd1bf313e38e1e363c
SHA1b02ab620a5121415f43b96f3ac7088b9d91ad6f9
SHA256e80238666732e9eba7899e6cc05e65be514a73e79a26a3fe26eeb9e2371e6409
SHA5127dfd4036d6f3e96ad850e60d71e42b369d6b5e11c3f3e84717096a3397017c4c4c5ceca654ca8a262d6a30274fa7bb630f8d54142af6a48f1c95c1a6f5ec145a
-
Filesize
15KB
MD545ee5bf8671af51f7bc89c075f8d70fc
SHA1b5a0aee78dbe9529afe805f7e2a94ebbe4d4681f
SHA2561936c30e40b56d84acabb408770d2db8f31bd09c09682a2444dfda0b060d4db6
SHA512a4a345d8832aab9de54bcae3d62fd32f3520cc13e2b1c8065225acd20245ff32ceec8086f384d1d2acc8c1cf2d8efeb36332f50f59a43a9413904d70079343da
-
Filesize
145KB
MD5424f1cf7dad333e3fa03d6c581df9e07
SHA166696122ff7ff60296b98281e5cc3de653b3146e
SHA256de93d91b013e439740296550356ee1be79160ba0fa3340090065243711a771c5
SHA512eb1faf70343f9f54e154ec9a2d22eedd4a6b979911a709553fe8413bacfc87a15914f3a5a6fa127fd8de1991b82693035e84009c000f882c829319afaa592483
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd