Analysis
-
max time kernel
156s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2023, 01:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://stage.sites-nam.abb.com/sites/PmdProjectDev/Lists/Workflow Tasks/EditForm.aspx?ID=80
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://stage.sites-nam.abb.com/sites/PmdProjectDev/Lists/Workflow Tasks/EditForm.aspx?ID=80
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133257430450039881" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 1140 chrome.exe 1140 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4444 wrote to memory of 620 4444 chrome.exe 84 PID 4444 wrote to memory of 620 4444 chrome.exe 84 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2184 4444 chrome.exe 85 PID 4444 wrote to memory of 2392 4444 chrome.exe 86 PID 4444 wrote to memory of 2392 4444 chrome.exe 86 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87 PID 4444 wrote to memory of 3524 4444 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" "https://stage.sites-nam.abb.com/sites/PmdProjectDev/Lists/Workflow Tasks/EditForm.aspx?ID=80"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb16a9758,0x7ffcb16a9768,0x7ffcb16a97782⤵PID:620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:22⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:82⤵PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:82⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:12⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:12⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4112 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:12⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3332 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:12⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4860 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:82⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:82⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:82⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5044 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:12⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1748 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:12⤵PID:4248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1612 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:12⤵PID:3652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=940 --field-trial-handle=1812,i,14134867871465499487,14645684392600676651,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1892
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
882B
MD5265774ecb5291562b4ab6b0575c1b1c9
SHA10f60dcf0eccc5f698dae88d0ca5c0e6fa492a893
SHA25694eb727b189cadf44ef8682cfe00ff300165636bc8fec808938eb17d6b3e0239
SHA512b8363bde6567dcb492b5b624af8a13647451cf43ab435997e2f37744e99714e8cda727b2f13bb7e2c3e0dee550075cfa007bd36976d591a73d970bcfa5c86330
-
Filesize
6KB
MD5020d09c4d27f04d7edecf6c70b1d9cf0
SHA1fa26347b9fbc6f882d2a11c952220613fbe397c1
SHA256abaf0ee462a909267883dad1e61d601fb8975d1df2b12e0f50b4412b2e1c1cb9
SHA5124e3b76f038b81cbc2c4d24dc695fc07489663680049d5f443e3c6f0cbb449dc0e1ddf43ca4d16c66f97ac61d8f67f1ffc29b9d6b73b532c942bbe5eb8b656509
-
Filesize
15KB
MD5f013fa8cff7c0a2bf2936f1f7e3ebfe6
SHA11a416dbb30e8a173561a612eb4c7d46e3f807524
SHA2564bb024cb81bd0a0d20540713e740104dad2b14db6f3beb613c18a7e319eb0e8e
SHA512e90896ba79caf8bd1a00c9ddb7d6f06dcd72cc2744f8723be1ebc1220b1278727e0de5961e26096312585c0a6ea22dd769cee465df148ff26349a53dacdf1c12
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4ce121a-a826-47a0-b943-bf725eb70f56.tmp
Filesize6KB
MD554362a04b428394483463fb80720b015
SHA1d1726d46200b37c2d4f70a438f02f36028bd371d
SHA2562222341f5d196955ff7715fa0a18be5092145317121fe4fd2aa3c553fa2042ba
SHA5121f2b527cfdd62764d083450e796145d9d977d5878d93fa8447e6099a976e02bbad988c8ad998dd8800d011d1af0e65b88c6138829edd6bd5d564d58e34280006
-
Filesize
199KB
MD57000c031b881e15298f111503f4f5950
SHA120dd91be62f82406f1b1a49a34b3255b806b3e9c
SHA256dc2b94f75eda0f522f2d9de69bea76925c05f936a6cfe0569a497511938f5921
SHA512f6803d0ef73ff2ace431f6b163653712fc243c29a6b263e8ed7d906df0648f38476e3f07f10d7a478757285e1e734fb2ef6d01dde94837fe469b31638174fcae
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd