Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 05:20
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://nam02-quarantine.dataservice.protection.outlook.com/spamdigestesn/spamdigest.svc/releasespam/orgs/b55dcd02-8c11-4911-9234-0f2483650458/users/[email protected]/mail/1c1be26a-bbc5-41ce-8c27-08db2b9a7b8b?token=Jz1h%2brRj%2f%2by5e8OpYC7yW4rD4hw7ckJep%2bLvInZl090%3d
Resource
win10v2004-20230220-en
General
-
Target
https://nam02-quarantine.dataservice.protection.outlook.com/spamdigestesn/spamdigest.svc/releasespam/orgs/b55dcd02-8c11-4911-9234-0f2483650458/users/[email protected]/mail/1c1be26a-bbc5-41ce-8c27-08db2b9a7b8b?token=Jz1h%2brRj%2f%2by5e8OpYC7yW4rD4hw7ckJep%2bLvInZl090%3d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241988532541743" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3596 chrome.exe 3596 chrome.exe 4968 chrome.exe 4968 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3596 chrome.exe 3596 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe Token: SeShutdownPrivilege 3596 chrome.exe Token: SeCreatePagefilePrivilege 3596 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe 3596 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3596 wrote to memory of 5084 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 5084 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1232 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1736 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 1736 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe PID 3596 wrote to memory of 264 3596 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://nam02-quarantine.dataservice.protection.outlook.com/spamdigestesn/spamdigest.svc/releasespam/orgs/b55dcd02-8c11-4911-9234-0f2483650458/users/[email protected]/mail/1c1be26a-bbc5-41ce-8c27-08db2b9a7b8b?token=Jz1h%2brRj%2f%2by5e8OpYC7yW4rD4hw7ckJep%2bLvInZl090%3d1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b2fe9758,0x7ff9b2fe9768,0x7ff9b2fe97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3784 --field-trial-handle=1812,i,9750067333193879140,16552804708493059739,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
882B
MD5fa775566d36f6d6dd1bafdf16863316d
SHA1a91eec8579dfa0883825a92ef4fea77ec738db35
SHA256e5c042240dd4835fa89f82668c80ca380614693f8c74216c6ba1edd6d537a45e
SHA51270529a502f3430de25b33145054a7f071cf1e8a19ae22a9a5b9e073f1ea2ad35d90d219a478516baf7d1814fe9c74ec0fea7e9f77a8a461a469d01cf27d243ed
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
538B
MD59464364c7cc8125b55da6ec0d17640ab
SHA192cfb0a88c632284abcb521b530ebbd1935a600e
SHA256ec2209dfa64258f157a7e5d4d1872a7893911d128522c29654f2d4901aee6a0a
SHA512c9eb89dfe0c06ee7be19aee0554decb4c59f4823e1fee699065f562cfe5725bcc575c5704831cc4643ce0f5aa76493912803392c74cbdd7f16d1507ac6fdd759
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5c4152fc045fd89b6268f5a9c50920a09
SHA151fab7708125baafbbc30dcb076534486e73bd05
SHA256f29720589d86851384a44ffd194ab4cfbba1d1ff3b4a50f91ee646accc35018d
SHA512dd3b67efe4a47ca9eadbdd2057371bea42c0ad79790c1a3683061ca836c548a977524f56833ef5ecdb4e5e8ea2c4069b9966a940c8386cd5328132e5838808a7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD54e4a5c75ce5c53316105b18c5c7ce1e2
SHA1f181961624567a219919d62b1519d0aa6a90f26d
SHA25645319fd2ae3bacda946843ae21c7bdecaf81170bb6d09e82dfac9ee5d72a0228
SHA512cfa74c9b94a3ccaafaaadd752bffaa45995b9445e988b8a226d190a044b94e1ff63031fc2d0bbd3f25a22f363888ca252abf2985c8217f4ee493f74a0d2feccc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD59d5eb8f6b95299bbb264081b2bc53c6a
SHA1c7b52594b24f216bd7297f78dcde6bfed1dd53be
SHA2569108a714a8b4663d75ee7ea83e29cc8d6dbecd373571a7d06b95000e305a8893
SHA51210799a873e92efe986182835aa7367f6f305b7c6644b63417fefc5ae146275c406f73b02e340e65fa34e523af804b8b65310aaf4677086d65aab99242e4a6344
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_3596_IEOIGFFZCKAXXWHSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e