Resubmissions
01-04-2023 10:58
230401-m2zqgahe53 101-04-2023 10:45
230401-mtds2aah5s 1001-04-2023 10:35
230401-mmtwnshd84 6Analysis
-
max time kernel
1800s -
max time network
1692s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
01-04-2023 10:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win10-20230220-en
General
-
Target
http://google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248275260031554" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe 3320 chrome.exe 3320 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2524 2408 chrome.exe 66 PID 2408 wrote to memory of 2524 2408 chrome.exe 66 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 4060 2408 chrome.exe 69 PID 2408 wrote to memory of 2936 2408 chrome.exe 68 PID 2408 wrote to memory of 2936 2408 chrome.exe 68 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70 PID 2408 wrote to memory of 3036 2408 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xac,0xd8,0x7ff824059758,0x7ff824059768,0x7ff8240597782⤵PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:82⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:22⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:82⤵PID:3036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2732 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:12⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2740 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:12⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:12⤵PID:3084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:82⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:82⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2580 --field-trial-handle=1776,i,14557212032867262460,9018433698517225001,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3320
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3864
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c811a21-6a39-4b80-bbc8-4c56e13a407d.tmp
Filesize6KB
MD57b399f182e8ea3c86ede8c2f0186dfee
SHA17422dcb32cabbe94d257198cd57b7751da9af5ca
SHA25617e57bf7e1ca883bc776cde05f9daa4cdcd8cec931f1bd47248d25a2e6cc956b
SHA5120f335046792f8d7815922454a1c0bc0b856dd865581a53e21039f4f607d823630ea695c3b0bac573abd2021b59f552ef3252ce3a4023a4d45d2810b6f4f04291
-
Filesize
288B
MD55639fb4d5968247ba3b33cacf0fa848d
SHA1bdc05964a9522abc0d0f9c4cb2241a70433d6df6
SHA2560ca595379e319ca22ea2d098f62a56572193300f9e1133d3e09f790847fdaf1d
SHA512125317d8856fcd1965e550c9c46f20b1d740b46abb47840c61b0d724351003f6084f70bd6326514a375b5fec20928dc1fa2734aade4a064fcc8c7e1402b7d27d
-
Filesize
2KB
MD5f87f21dc9fbc045ebf7974a8db246add
SHA1b265c43fa57b4abaff36b56dc81e3eaff93ae022
SHA2561a73ec0a7f904d7d105061e4fa17ea62cc7784bf8250ebbc7a725ae2d0405978
SHA512ba009315fc667eb851d6bd0cccd9145d25566b9999fd456046f326ff6dc5a9bb99e0a189d1ae301564af3ecc8a5cae63b982263c560c0ad9e02c037f1d58f838
-
Filesize
2KB
MD52e4fbb164b06c69f8af6d6e93e1346da
SHA1c392f2800a97b57add03a6b8a8da4b9682bbdbfd
SHA2562b95f8f44189e551dfba7135455fac72eaa9da9147de6d3bac6e621fda2760dc
SHA512075ccd1d43fc7314212ffd960817c7718187bfd8c13e416edeb0a7c37038b948856c60aecf0afdcdf8d9eb3c5b7980eae1f400162b7cca43e00755bcb0b2b1f6
-
Filesize
2KB
MD564906d203ebfed8d7768d3ddffd23cee
SHA147ad00cc86fd136798e19851eaaa5c9ee1820784
SHA256bb4258fd4cf31bde5a8cb868f7a1a51b9f1782b559007842c06c6d77c01d5604
SHA51224eec5954541873feb68d3d62a9da1a59552f1104187487c6f55b7fa1d41d6b8687b2df1f166b58db7c1a037f8dec555eb72ffef2192ec20e830da605d6efac0
-
Filesize
539B
MD580d1a6a6f9aff797553596ccdcc769fe
SHA1a91b726fa5067279e618c0e1bd20ac6183ddadcf
SHA25676fbf67d5c0a927a76364d3be0e3e0bc0d22139d942e712e9e4e6b82fa702fe1
SHA51231e7d0dc45234458f43e37708d7a5bc2c4a56a23e1248a12d22a2fa5df493b4e5260514d76fc77f823c1f38131b62bb19e1fe9f4847d8f9b07c185a3e1f1aeca
-
Filesize
6KB
MD5078a37026b440f6678dd4652d0a71ced
SHA18aea2d18d30550c34158d0ce89f7eeefa050102d
SHA256ae9c376f9a37accb7bde9e06f0c4c91bb85b57ae3bc2ef65a139c90bfa7d5530
SHA51288d6a29d068374f73117ced0e07204c5aff1c4a4060821edb0693ffa41182cf9bcf923c2e3bd03a17f3fc43f8ae5adc46a2ea49c2592b46269a82fecfb587082
-
Filesize
6KB
MD58f2127a61da2b229566195ccf8c645b8
SHA188b8bcb303c7b944038b75710da22e0e005a1777
SHA256927997bd6b8cb2f347bb05faf45a3d0a9fb8fb911f03703572364d91164387eb
SHA5128b1dbbdd18c1919360dd8c51b3c17c376067c872041e9e4541bdedd8a03551f44561f3b46f03ccdce8e3415bf4383556aa5570f4f12af1e6f205dfaf8a221c59
-
Filesize
173KB
MD5473ef37e98076010d839991c3a37bba4
SHA14c474140e511213c989dad5fcc4ff9984145c1d7
SHA256c53efe2a729d8a51095436ee1e3d5aa191b1b34cd21815694d8ac7e842e58ffd
SHA5122bca4efe700d623652b36f8d5b878f68882ff901635b7b8ead57ffa5acd9636fcac9f46757406474d2f1a761b7924a8b611f07f719efa7a8263978d9c117457e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd