Analysis
-
max time kernel
57s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2023, 13:53
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pub--3ae838af35f14c64aaf820f6c24212de-r2-dev.translate.goog/backgroundfull.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp#[email protected]
Resource
win10v2004-20230220-en
General
-
Target
https://pub--3ae838af35f14c64aaf820f6c24212de-r2-dev.translate.goog/backgroundfull.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp#[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133250108205992071" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5084 chrome.exe 5084 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe Token: SeShutdownPrivilege 5084 chrome.exe Token: SeCreatePagefilePrivilege 5084 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe 5084 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 4988 5084 chrome.exe 81 PID 5084 wrote to memory of 4988 5084 chrome.exe 81 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 4940 5084 chrome.exe 82 PID 5084 wrote to memory of 3888 5084 chrome.exe 83 PID 5084 wrote to memory of 3888 5084 chrome.exe 83 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84 PID 5084 wrote to memory of 1580 5084 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://pub--3ae838af35f14c64aaf820f6c24212de-r2-dev.translate.goog/backgroundfull.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe74ae9758,0x7ffe74ae9768,0x7ffe74ae97782⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:22⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:82⤵PID:3888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:82⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:12⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4760 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:12⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:82⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:82⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:82⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:82⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:82⤵PID:1316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2748 --field-trial-handle=1840,i,14921991514402379489,2555028316925556067,131072 /prefetch:12⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4476
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432B
MD58bc8ca7914dc33dea7ffb665e46e80df
SHA15ef3a8a40034777bdecc3e05d407385b97b5ed97
SHA2567401043bd04f258b53dcceae82ccda99abf5bc1ff497a18a6e3ca28d3f6f10b0
SHA5125dce1ed391fdef9725ede029e5744255ef9201dedb0dfc2b31985bcf782e58300a06b292bf21f477d0155985918243d9a3407053be090cbcc59bd7a146c20d45
-
Filesize
1KB
MD52c72206de002be08b092066925e44261
SHA18fd6774d2c8f9a88be2cc062d385476455d38da6
SHA256e558a83716e48cd2bf5eb9922c85ca285f6a7990bde053a1ca50ce63a9112b14
SHA51226ae511e2a0bfa196234ec35c06bc5f3e1bc80418528dadb08bcb2385899004a2bb8118fbb208abf98f39c67b480ed0d9156b11b7b2bb44456fbca1c470f89e6
-
Filesize
6KB
MD5b80aa1974c8a7154023e591693d9bddc
SHA182aed7656ee2cfb0c25e32e90156b8946cb77967
SHA256a59ebeee8948f0fe0b5ff93e855736b67a5fe670f3991a6cbc59036a8428864c
SHA512d2bc39cbd4e0ea5dcdf70bcbe309d1b95297bf8abe2e7011401fde21a261a0e38a23115e4353468a010fbd8059312cceda4c86785b1f0881f5e66943ab37685f
-
Filesize
6KB
MD5d6c0f64f5876c5e97b10779b79dc5cda
SHA1196981f31b5369a2f2736658f2b1c8f8bd6e1a18
SHA2566cd88614d30f4388b3aa86b4c0bb676bf3810a1dff80bf128fab662a60ffe55c
SHA512dd4fcb51f3b67c848e245482318f4229d88005f4ce98b2f14377c316edbdefc083a549a3699d55dc94b0828b5d6d44b0fae713c8fbbe6eb5469b03e374cf459e
-
Filesize
15KB
MD58e0130d0752205443d63b49d0d600b9b
SHA19b4ab0a445434b910be50613935edc0b0c84be61
SHA25629bca04b8f4c8eb521f155f1e4a9f599e7fda4863c1480890d14d4ac517d163a
SHA512a675641324bedb8a67bc2820a4cee7cad9096927657cebced8bf9ec484c24c5969e8a76c3888312ea5508ac3ce5abb298156e174277b6286cf98ce06e1bd1208
-
Filesize
72KB
MD52c938f0293da14353176b74475784547
SHA1abe14b723de2ef80dcbf0a379fa9323cc2baa41a
SHA256e320fa2efb13810c19478501bc2ebe06bb13000dacef3868ad83cffdd7bbfbc4
SHA512eaf8c07dce7fade6e099f78351dc011607335913d0925ff3b605fdca823300f25d81cc092683017b195c638a1c1c8a58535aafe53edda9ed863634eb88db5c43
-
Filesize
176KB
MD56a2279ea4fbc4d09d0d93188c4fdc2a5
SHA14f9d11216189f583edf9254108e697e715bce1e0
SHA256cb86e3ab2ff199b1dfec6ee53d983ba7653f6ec37ce57deb43994d36da48e57f
SHA512de3d228ea5424f5b69c4324ad463d96290b3c4e7bb0b1ae335028e98c01cdd1f99b128fb409b8b46be260cc4452d5fe4f2783668d1b771838bb0be0aafff5ea7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd