Analysis
-
max time kernel
74s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 16:16
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133244145940019379" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 5092 chrome.exe 5092 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 5092 chrome.exe 5092 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 5092 wrote to memory of 4504 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 4504 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 2096 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 4388 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 4388 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe PID 5092 wrote to memory of 216 5092 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://vscode-update.azurewebsites.net/api/update/win32-x64/stable/6a6e02cef0f2122ee1469765b704faf5d0e0d8591⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff9b60f9758,0x7ff9b60f9768,0x7ff9b60f97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1836,i,14506867167499786327,13113385521265540986,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1836,i,14506867167499786327,13113385521265540986,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1268 --field-trial-handle=1836,i,14506867167499786327,13113385521265540986,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1836,i,14506867167499786327,13113385521265540986,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1836,i,14506867167499786327,13113385521265540986,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1836,i,14506867167499786327,13113385521265540986,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1836,i,14506867167499786327,13113385521265540986,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1836,i,14506867167499786327,13113385521265540986,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\33ff1740-5bdf-4a99-b9c2-7abe1d80437d.tmpFilesize
6KB
MD5afbf94431038524bc2dcbbd2a3cf3e1a
SHA1d0446f7b5741b4128b16d278d446f73b0278cc3a
SHA25653be7418e3e6ff21d27c079ce07fd3b9645132ee94b655f97f43c24fe8f4ba07
SHA512f4178b6f035f1d8c8841d428c6350f9eea9cfbeb3f9921d2e498f9acb4077f337df29461e27323d843d97fdb7a2c5c8dc209d2e1b44d5cce8a7bb59ba98cedc6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5483fc23a3fb3183430f94c4790ddbbab
SHA1e984b14909ea8a626d963ed7074beccd71eab8f1
SHA25697840531d6f0fd888248def82e373cdcad87fe933958456a50c057a69bfe936e
SHA512fe2df9fe2c102bbf499c8adb00fe5409df9e716ef34b337b180aacaf1b905ea4ae3868066d4debeea75a4a2b48addf2234c3777799609db2369450f41580a741
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD50a80cd0c9013e126e5e9bf854906469b
SHA120656baa2fa42c2d3849d1e9232461b211e0d37d
SHA256b684ef40b5f36b68ca77474dc444e70129dab90dc9ab8ce2427ba97818c83b34
SHA51203fd29196d8499709cec998923fa6d2ce76ced0196c1bbe1f6ecee160a91a2fa546ba6bcdc8a8f470f5d46cfbfabedd9c85e600a458d2c01b919bb22a128a2fc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5cc83ea138e8f74da23bad5bb9c661a1c
SHA1b52ed5a84cfc9058ad1ecf10139701c1f8c0088a
SHA2567774bceefe722c71377e1c2a3c6eaac07b0e5e5f9ef24e29cacc216292a81e20
SHA512201029c8e43148aca549c6e3f09d58a5933197f161b798b121596cff505a61b5bd517f59a28aae506714b34bfa994b5bf5790f7e554684bd3d018a787fd93c90
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD500a6dcd68c518878797ff47540cb2b18
SHA123443f3aba09ea8fe6eab73c1d89be3a86c0f805
SHA25628707a97e9027be461406c60bdb14d9646123a0c36b1bca138ee5b0a099ed31c
SHA5126111e8db2493280a407c5e9e9dec6bcefa5b360b57a42aa9a5b78d8a510973dd1afdf06cdc9141f19403d2edb266353991137bcbf0a65bce615ed51cde0b6722
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD554c6bc3c66b82f138aef67fff2ceb703
SHA17c1c327431389b3c1df13e1bf535f6039cfe3b0a
SHA256a1650a8f11d0b1245858f869a7d75a98ad09bde12eb2133e2ebca79a0a3a5f51
SHA5123018bb5a65bd2aa03c359c573f2484bc1d441d78259e33bd4e165442555310a64c00a333ab9c7b48a80e499306f85b6f17b1aaf92c736c92a61db4c76b70d5aa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c4c956d1-6c19-4ab2-aa09-a477a6ec26fd.tmpFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_5092_NKRDOAVATHBTEXOHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e