Analysis
-
max time kernel
600s -
max time network
505s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 21:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mail-cloudstation-us-west-2.prod.hydra.sophos.com/mail/api/xgemail/smart-banner/5171e6a88fd33d8ad85958ab0ca98964
Resource
win10v2004-20230220-en
General
-
Target
https://mail-cloudstation-us-west-2.prod.hydra.sophos.com/mail/api/xgemail/smart-banner/5171e6a88fd33d8ad85958ab0ca98964
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241689693103459" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3592 chrome.exe 3592 chrome.exe 2196 chrome.exe 2196 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3592 chrome.exe 3592 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe Token: SeShutdownPrivilege 3592 chrome.exe Token: SeCreatePagefilePrivilege 3592 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe 3592 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3592 wrote to memory of 4520 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4520 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 4828 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 1972 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 1972 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe PID 3592 wrote to memory of 3892 3592 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://mail-cloudstation-us-west-2.prod.hydra.sophos.com/mail/api/xgemail/smart-banner/5171e6a88fd33d8ad85958ab0ca989641⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebbbf9758,0x7ffebbbf9768,0x7ffebbbf97782⤵PID:4520
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:22⤵PID:4828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:82⤵PID:1972
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:82⤵PID:3892
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:12⤵PID:4488
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:12⤵PID:1120
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:82⤵PID:5008
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5056 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:82⤵PID:1368
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:82⤵PID:3252
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 --field-trial-handle=1816,i,16040678139847579145,14673418219270022446,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2196
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD52e33eaec196a019e3d386d36173ecb89
SHA103d83cd2f5546e951621d227c856ff1fbd42d6a3
SHA256dc6204d0c93356103d322b9ee4dce021e4108ea7c8734ba00cbe36f555510588
SHA512f7134ab174b2cc681e721401f0f44cdf3f1b9a00fc0ec07a0bf1d0ed27159b1b80af24916d561e3581a45e243fbcb57a05edfc37df47ee4db8f0c9cc8966b1e4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
539B
MD574af1acfe1189e704b5fb627c87befd0
SHA1dde56da3390289958880457fd7b07ee5133f75bd
SHA25650a7eea3449b97dcfa2bcbbd77ccb2f6d33a828d3ec78bb11103d9f47fedd793
SHA5121a027159e7f35ab3d0d97751b3abbbccb8a1ba62cb46891b99e78af4dc197524a525ccc501f2127dda93357be6b9ad62ee7eb39baf9e8b73202382be4bf5d98b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5584dc68f362b601d303895c3996611bf
SHA110af6fd4ab80661912606b422d92ceb382eda64d
SHA2562693260388b42bf9539fe08455dad75ecea30ddf41074f2fd147a8f028a3523a
SHA512f039280ee75092f1effef7e6125e6b89ca2db7f5f40070065193cffcd431dbcd54cb5bfb10ec58a4c94e65030caefdbb847f6ccce1ecb017e6d606bd3756dce3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD56f8e1f8d67a20c0b4887d2a2d4a61b28
SHA191d43f73c4639eba715aa5b5e270e59a6010128a
SHA256afcd911aa4e28a033a3c031c313c367767f7796968580f4b9ab2a54ab0a99897
SHA5123ffccdd666d5414ef5857a0f26c7d0f96398430887da68f11ce64c42b22f2cecca3a36386cbd1e377bed653a53141c08f9d0de7fe77d8daf6de0d3e064c4b6c5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD5d610ad70010c71646a1e1c1d1dfcc043
SHA137dc4a18e8b91103a3683aeb8414724e19d98bd7
SHA256e723c5f40ad083621b6f93b6d95e1f504d6064fa7165d36bf765a8915f2ed7b3
SHA512a30b57f3d687bbf40eca0e80e90dbbd6ca707bf5c1f677caa2dca10d1abebaddb856602ce0739a2a243629dc170e2b6b4a7414b14447a972575b29a85540bcd0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_3592_OZJBVPXTKDZHVXIAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e