Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2023, 11:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://my-account.it-security-group.com/settings/4d335f/3e5bbf09-155e-4410-829f-21127795ada3/?
Resource
win10v2004-20230220-en
General
-
Target
http://my-account.it-security-group.com/settings/4d335f/3e5bbf09-155e-4410-829f-21127795ada3/?
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133243959605048845" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 424 chrome.exe 424 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeCreatePagefilePrivilege 2080 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 4244 2080 chrome.exe 85 PID 2080 wrote to memory of 4244 2080 chrome.exe 85 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 4396 2080 chrome.exe 86 PID 2080 wrote to memory of 1404 2080 chrome.exe 87 PID 2080 wrote to memory of 1404 2080 chrome.exe 87 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88 PID 2080 wrote to memory of 212 2080 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://my-account.it-security-group.com/settings/4d335f/3e5bbf09-155e-4410-829f-21127795ada3/?1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9bae69758,0x7ff9bae69768,0x7ff9bae697782⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:22⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:82⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:82⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:12⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:12⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:82⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5384 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:82⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:82⤵PID:3104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2808 --field-trial-handle=1752,i,16515554460721718441,12407154311002570901,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:424
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4456
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264B
MD5fd1819224f4d178dc00b3dd529da42e3
SHA1bd7190c5d71f10b6d99ab87785be2525f85b6e77
SHA25691f18ceb256e42eb05d933a7fb6131fa6fce049347ddf109c310a6fa95ee8fac
SHA5120290bd7a12225b948b35572df27a1f48b107a3a419bedba9f488e9294935ac75bf164bf86737cbe83f343e4d54b9e32f8135e02fffe4cfbb6a419c7cbb94b2f4
-
Filesize
2KB
MD5ccea99f756a1dfcc9e72da9c1fe2630d
SHA1706b3743bca4e189e2494850c1faad6f37a7a036
SHA25621b5b960777f5d7f09124c570bdd650ae27f4e88540d2ec7b4b4fb717e14fc34
SHA512785f7e8f3c2d418dc5c455cb88b1b01efed625a130656910290fa110aa650610f8994085dedfcb294ad9d93e293e59e4ed7f8956d3a264770e2200ef5bccf416
-
Filesize
1KB
MD5084d259b289bc4b6f456b66f42f19dd7
SHA1f7888a678a9278a4a31001d09e463d3642b34298
SHA2560beb741f72753a87c7e9ede3c71745326ece9c9206f6cb14ea11aa2118cac1af
SHA512cc2301f29cb0d0810d633718a2257f8309a7595e5b79e04930daca18081296d1ba13213bf4b0b8a9c42355d7e185be4cc723a0ad7dafc029f387769a55574fc0
-
Filesize
1KB
MD549b5dcb5f328a357ecdbc23917837db8
SHA1f9a0c5f602165b3efce455872aae1ec65f9f22cc
SHA256fecc001fb15ce8eb8085ca8a853b0da8ea5f142905a20c39bc791bfb344d7098
SHA51236248ed997b562ac28e31c0be67a6c6b7b1b084899d6bacf5c8417449bcd35010f23bf91233d1a09a1669fd52d82a6a3a44972ed0d59ce7af113f63839b83c3a
-
Filesize
6KB
MD5f8a5d7eee90d7a8b0112c4e30699beac
SHA1ddede1c82e0b58858ee19849d7cdc1d861072d9c
SHA256ed853f8bcaa622d3aa2c5e55bf08528b6137fd41aeb9cc9a82b04cf08179e581
SHA51208330c81924e5266f3ab92d35cff6225dec99342ccea22a4f93ec3bb3605b41c8623933ba73cd5b5547fc50f5fa11e33efe31fd356f7669ec628722eb71516d5
-
Filesize
6KB
MD5ba55fc7ec55ced08ba66f144364156ac
SHA1877d825af7433da98231e8e15e649c0bf45da6af
SHA256241a8e89d09a7b4b3efbd6aec1ece6515e01db39c50c636616d8242942936b36
SHA512d5babeb841e80c5c21ed8a9822554a5bb8c4e5358559aadfff6e96d0e01eb1762bee0b424c0ffe6acb7a6b74238bddaff7a8b22f9c43bbe8de562cebe7ed8f3c
-
Filesize
15KB
MD5e66942e05a42aece77506f5d493b53bd
SHA1b92d166b9f6e761646c7d857f82207430094cff5
SHA256e7dac15aa992992e876fcf466ee464132587708da5f8f32e0c57bb0013099845
SHA51265e66736b38a22a11b7819cf9d3ce899bf4dfa1ed55237e74b20ae2d3beb30324b2fe33196e51e8e8e5e15a65b4b7b66dda888c7a3edb8655be218470d1c3114
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c1e62ef8-5d2e-417d-a041-33db969eb2e4.tmp
Filesize6KB
MD543ef51e24a5c945b361982231671b9d2
SHA15dc076dcf80cf7838bc31b7466a424d0a97994c3
SHA256a2e847225450fcd7eb094e2e615112628fd53df1de1576adbda3008d55d5faed
SHA512d5e7b42e24faf77ab57b0faba31713cc44e3ddb61043f6d3f51e9d95296ae95e01142aae332934a6cb9841b78f07ed3cf0d340a414e0ee1b90a36a0f822d2ab6
-
Filesize
144KB
MD5c167505a96063b33203ac4afacf2e84f
SHA124e6dcf60a96c0331bb95c8420c7f90113572b15
SHA25658a7f26a74c5cb414c059d83ad3a98880efd3930a62f027636fa32330d684f9c
SHA512a3668fec003edca6ccd3e1aac8aa2e96b8e5ffc9ea71862aae6ccabd39691d5c174a31f2fb801c29905061ff9e43948b6778cf121d902931f90a1e63ed98ae2a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd