Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 05:23
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://nam02-quarantine.dataservice.protection.outlook.com/spamdigestesn/spamdigest.svc/releasespam/orgs/b55dcd02-8c11-4911-9234-0f2483650458/users/ashley.borden@murphyusa.com/mail/b8e30542-2c67-4562-4661-08db2b767ce7?token=RPHTTljFufLCy%2bu9Um%2fzJEPMoKHVIqUcsxSSAPwJ2L4%3d
Resource
win10v2004-20230220-en
General
-
Target
https://nam02-quarantine.dataservice.protection.outlook.com/spamdigestesn/spamdigest.svc/releasespam/orgs/b55dcd02-8c11-4911-9234-0f2483650458/users/ashley.borden@murphyusa.com/mail/b8e30542-2c67-4562-4661-08db2b767ce7?token=RPHTTljFufLCy%2bu9Um%2fzJEPMoKHVIqUcsxSSAPwJ2L4%3d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241990484132542" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4804 chrome.exe 4804 chrome.exe 4896 chrome.exe 4896 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 4804 chrome.exe 4804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4804 wrote to memory of 1424 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 1424 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4616 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 1176 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 1176 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4268 4804 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://nam02-quarantine.dataservice.protection.outlook.com/spamdigestesn/spamdigest.svc/releasespam/orgs/b55dcd02-8c11-4911-9234-0f2483650458/users/ashley.borden@murphyusa.com/mail/b8e30542-2c67-4562-4661-08db2b767ce7?token=RPHTTljFufLCy%2bu9Um%2fzJEPMoKHVIqUcsxSSAPwJ2L4%3d1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb76789758,0x7ffb76789768,0x7ffb767897782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1332 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3176 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4788 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=924 --field-trial-handle=1864,i,15480234329033474910,2879819438759046262,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
882B
MD52716ad9575bcb7dc947a2f7c8dd24277
SHA14535456cb5f6e07ca225d8367e7fe7bbddcf3f96
SHA2564f97be63121e3b2c306778b2cc0eaa71430771b34843685b764e220044635299
SHA5126770d1f8bb0ff643b0d3e68d7444bfbfe4217b89ff9ed4849300456d36ece2698319b8f6a7cc2d38c302f66e864d986660a166a0dc67f4d0dc3f0b8612bb7e1b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
538B
MD528111d8ae443c05da1da98a973462b32
SHA1508b29aa35d7bbdb50dea7bdbe0bdacfe7f52ab5
SHA256a94fc3360b415b0f35e11e42677bbae9b876387b6de67848b3083bcf4e845321
SHA5121cf7e0e4ec682f53693123839ae9e4c20bc570da0194077e429a712bd3f816c887c944fb56c2b84f9b01c77f74f534b6118e59a075cfb2b50757062a7e7a5937
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD53ca930cd7e9240c5e21934c80be335b8
SHA1f474f35bf6c74771d4e8cdb5efa02cd935da9fbf
SHA2563ae589f322a3a59edc290db4376a7946d34ea8ff78663349ed63cc734109b851
SHA512d5beec3a5c6b2bbe7faa8693807ebd67b99ff5b30a18ce534f6da659e3d65225ce66de7a36b33b2aba7e3ffcd0e5bb6fbeeb56ab86363183426b623f4b8df631
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD52f954fda32b6a4a6f0b5facb819e741b
SHA1b23b348a3f0b693387687d43134b6ed7d18eb608
SHA256baa3a4e3c6f41adba2ca3c90143137cc51cef4f5829775c1cebda2cf97cf33df
SHA5122de57ca9a0be2bab756c79f7d47fc79743a0a870c3e922b1602f5769a88f56b447d0f363e8b2e7c3df1e831d94f6d90d0b1f63f0254fd8ed039eb7565213b68e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD5dac31a87ed7b49490c9575ad61fc0e97
SHA1bb8e86e01116d14921d48818ff428545bbb6d17b
SHA256c80b2d2ac19b1209f64b220d23b2ceb7be438790eafd8fe71e478d2d488c72c6
SHA5127ac8caeaa857e4a71908d2285d3b784448672e2d9e8f55ee94f0f6ba113175748b5a1efff2cd226d3ac10ee6914e84567e6ff134b76646e7610cfcd7406ee925
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4804_KFRVOYPWKBSZPVFFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e