Resubmissions
24-03-2023 03:50
230324-eea5laca49 124-03-2023 03:42
230324-d9r6xsea61 124-03-2023 03:41
230324-d8x1saca24 1Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 03:50
Static task
static1
Behavioral task
behavioral1
Sample
ATT00012002.htm
Resource
win10v2004-20230220-en
General
-
Target
ATT00012002.htm
-
Size
210B
-
MD5
ec648e280ee68a08b16602d335687c33
-
SHA1
424af13b5e65931b6897386f95343e8693b7099f
-
SHA256
bd27523d0e5b852f6a4fa1d7a9163ad361adbfb0b95541c7370d7f4e9b486cf3
-
SHA512
038eb9622dfba3850d31178c1bbdd7e611a4281f53dd0fb39cc80132140df83887e42b617f636a2e07a77af5f3dc22742c4adf3d282a551d83a87545d9fed534
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241070621379962" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 64 chrome.exe 64 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 64 wrote to memory of 60 64 chrome.exe 83 PID 64 wrote to memory of 60 64 chrome.exe 83 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 4072 64 chrome.exe 85 PID 64 wrote to memory of 2688 64 chrome.exe 86 PID 64 wrote to memory of 2688 64 chrome.exe 86 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87 PID 64 wrote to memory of 1780 64 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\ATT00012002.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd72bd9758,0x7ffd72bd9768,0x7ffd72bd97782⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:22⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:82⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:82⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:12⤵PID:680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:12⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4464 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:12⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4612 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:12⤵PID:776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5092 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:12⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5244 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:82⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:82⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:82⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4700 --field-trial-handle=1744,i,6629343817584962327,16041985796152408369,131072 /prefetch:12⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD561737e76ed07b554ba5542cb4ac00029
SHA1262aa49bd6e84e461f4027057339696fcad8b2f2
SHA2566c2ccba39a4f00df76c339a84ca2c4525a88142294caaab1e1b79fb6c696661c
SHA512e145cfedb68d4e2487e15130d716259b7a281e05154748d47abf43b394db95dce47cbc80862042e92817a45b1636e0584f7e11c6239ca8c4978b2e516d3f34ee
-
Filesize
1KB
MD571d3160e05fcce7a3beea2bed4c46a1e
SHA1aa6450ba363cf48c51920ab947d77fd5176f0a71
SHA256d1e560a79a383836c6e62d8ed791735799ae55963d4e4042da8b3b1d0b6367eb
SHA5127f66e70ab8fc3a76f32b579260660d7f2a4c6504e8ac45fc3e6dd59f5a0668d381f168cd2dbaf5db4e24103ccfea4e557e66f7229ebe1688534e807bc0ec0c1d
-
Filesize
538B
MD5bb3eac888522974c774e90d782f39d37
SHA1a837a367aba84c04773d9e5830f24c545d9b4083
SHA256f2284ae178cdef2e4685facffe8acf04a34059ff9888b5830a2958ca15d4d73d
SHA512df3d15da8dd398acd0fdcdd5f2868e4f62a58b66193227ef5afa25b46f859052313a4f3484d74a37e627bb6f1f8c7d18e23d95571fe70c8a80cfee556fa916f7
-
Filesize
6KB
MD5ef3995d8bbc79e41346bd6c20e0f4600
SHA14d897b8f3e594a6103ce1ecef5094281530d0b51
SHA2565a6657e1fb81513d2aea8ea5baf40503be7c2f1df15b7a3b3195f80a2b486b6f
SHA512bac1f93b714ccab8cf47f74d28210e076c60ede288006f68736b24a91f00d79b3e028d661e566d2edca8ba4c4eb8be1def6a492c22840b2a195d419196a749fd
-
Filesize
6KB
MD51ce49a68b65df972acfeb3f2f60a8cc2
SHA1680ac180b5c700d9a9b6d2e3514beb02cc2d6714
SHA256768e33579273ea2b198baa4485604d90b6426e8893244f15ee008f8e610367a2
SHA5128ef80b95d5d73c8a5e4e72ab3aa55ed49dc08e3b3f1a70e86537ba380ecc4348fddbe83fd5fbbe63449aba4abce66bb051872de555ee7836dafad0f4364612a0
-
Filesize
6KB
MD542a9ebda34cd3bdde8ee086fd9ed799d
SHA17dfea13fdd44c13505df51f36c55fda28a5b70e9
SHA2566c55bb46ae28f04cc77892f289ab3c483d7f0732db5d8983e612d170ce987f12
SHA5122b7a29b22a6867269399b9b08d8588d31ec8f1ac7a2907b5347547dd0b1f5d58ae690229830b57110c8f9c02318ff9558fdc68f51f7a33cd663515575d4d268e
-
Filesize
15KB
MD5d9c4a6cdd296cea00409b2228a9e0657
SHA1ea304b2913110047c050da743f5d099521e6b646
SHA2567731b33d501bcd76faf9de6cbea3ef7202b936f79d7565f3feb0c76b6182d5c1
SHA5122741e4c6100f5026683bf8855e791d21526023aad27e0f6294171d1ece8146f8814556d11b2d0d28b67a2a0b8e6c62989049301e1e0bcbbea9b8ab3efe179bf6
-
Filesize
145KB
MD5ea671c5dcd181e9ef608374cd94130ab
SHA1aa6cceb393b6e8b4b43df3fcee7395fe4214faab
SHA256b953eab93e6eed49c741df54eaed1791b49544745fb3727c282506daf28ae3e7
SHA512e0d483b61ab226f96ec15280e348276b79271f85e8235ff7fe01304297498f6cd3f5c5d09c9f91a3cc90e40804b5d3526c14879c313d78ef6a0bcd6a1bf4b3d0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd