Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2023, 09:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ib.adnxs-simple.com/ttj?ttjb=1
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://ib.adnxs-simple.com/ttj?ttjb=1
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133257664276883240" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 632 chrome.exe 632 chrome.exe 2460 chrome.exe 2460 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 632 chrome.exe 632 chrome.exe 632 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe Token: SeShutdownPrivilege 632 chrome.exe Token: SeCreatePagefilePrivilege 632 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe 632 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 4460 632 chrome.exe 83 PID 632 wrote to memory of 4460 632 chrome.exe 83 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 3156 632 chrome.exe 84 PID 632 wrote to memory of 1952 632 chrome.exe 85 PID 632 wrote to memory of 1952 632 chrome.exe 85 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86 PID 632 wrote to memory of 1684 632 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://ib.adnxs-simple.com/ttj?ttjb=11⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb46ef9758,0x7ffb46ef9768,0x7ffb46ef97782⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:22⤵PID:3156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:82⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:82⤵PID:1684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:12⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:12⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4508 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:12⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:82⤵PID:2216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:82⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4660 --field-trial-handle=1808,i,7482901800037432923,4799341945026283378,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3452
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\536ecc6d-43a3-4ef2-aa79-f613c36ae3c2.tmp
Filesize6KB
MD58001a9d087a6b0960d52e0244ee9d107
SHA1bf4bb7660b4270022477dddbc0e7ff3885786263
SHA2568e4838e928d228cc5c9846c6af72d0158c8e1556c8b6ff3220a8ff152a1264b3
SHA5125b50079a6b2482c40795599b44959633f5fbe025cecc40be5a3c75da94904608f92de2db48d3d71383597df42cd137f645ce3eeb31dab5e35fe32313167a4b6b
-
Filesize
6KB
MD5d4b84f2f328f774f0bc10a502a82320a
SHA1a3288585bc111c844b3edb0253268710b13ee42d
SHA2566da445dcbba55657e70f5092aa09d51c877fd1e62a26459922c885fd31bf8d64
SHA512807f6847234c709ab3c689ce5ca6dc1992a81bb02627f1f0c1bf67e427f97e149692630368c576c190af18ee1b824e808cc5c47c397733def1645a7fa632750e
-
Filesize
6KB
MD5e38d180a68382ad4ad8c582d4688f21d
SHA112e0a085a10841607007f41179d7cfd79a90be2e
SHA2565f77d4e92bdaf284f3ff7b30db8beca06255035174f46150d602695ba6ab482b
SHA5121e45b7e720673abc4db6608faf6b7a03d904d6bbe6db498729ef311bb1665a80bb8d2c381dc0528b0e37f2e84c836d84729353bb0234f30964098a769d0c07ed
-
Filesize
199KB
MD505f67d828b28523d50849810600aa033
SHA1f4e0aaa770386000de967e2493aeb29826b9609c
SHA256894df5b08d80804ff1d298dbcaeb4b38f6ec6df4b6193972f6613f514b9ac6a8
SHA512c0892948c427d79c0cbb81b484fe2b1415e4f6e9f03f7f2ce1d2cf7b560b52b2dfd51d0aad95aa853a7c34d60e876d41ea749af932df93017ed2ffbb45ead7d9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd