Analysis
-
max time kernel
81s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-04-2023 12:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.engelvoelkersberlin.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.2
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://www.engelvoelkersberlin.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.2
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133258707130863667" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 116 chrome.exe 116 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 116 chrome.exe 116 chrome.exe 116 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe Token: SeShutdownPrivilege 116 chrome.exe Token: SeCreatePagefilePrivilege 116 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe 116 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 116 wrote to memory of 4616 116 chrome.exe 85 PID 116 wrote to memory of 4616 116 chrome.exe 85 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 3396 116 chrome.exe 87 PID 116 wrote to memory of 1600 116 chrome.exe 88 PID 116 wrote to memory of 1600 116 chrome.exe 88 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89 PID 116 wrote to memory of 2452 116 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.engelvoelkersberlin.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.21⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92acd9758,0x7ff92acd9768,0x7ff92acd97782⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1792,i,16253628032607933068,16137849474857611232,131072 /prefetch:22⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1792,i,16253628032607933068,16137849474857611232,131072 /prefetch:82⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1792,i,16253628032607933068,16137849474857611232,131072 /prefetch:82⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1792,i,16253628032607933068,16137849474857611232,131072 /prefetch:12⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1792,i,16253628032607933068,16137849474857611232,131072 /prefetch:12⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=1792,i,16253628032607933068,16137849474857611232,131072 /prefetch:12⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1792,i,16253628032607933068,16137849474857611232,131072 /prefetch:82⤵PID:3356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 --field-trial-handle=1792,i,16253628032607933068,16137849474857611232,131072 /prefetch:82⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5108
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5070756c1c09698a79a1e60bc25f37aa8
SHA12b0a1a008bf887fb9a6868cd4b67d632334ad3a5
SHA25664078c33fe2484d437c757cc48fdf81da3ad7894b1b5c816bfb0b6f53071e3aa
SHA5123298b960c7e0974cf1ff00013e2589ecadc2c84a1f73eba09b4717a2c0de376f48681694366ca3e5e4408814b58e8ccdf86a5ca2c27a99ce7ce7757b7123a013
-
Filesize
4KB
MD50ebd4ca4c6bb144d2e05ac3ca5fd6ee1
SHA13fa11c008b178b65f6328e3f55418d6e011b12fe
SHA2568a4592aa2def22deabd4561a643d9910f712f7897e9fd993683c2370d9a55d21
SHA512bb4682f35d1fb5d7063a5524caf7d90cb727cf5040d638c62240e33f0fc5c9a9bcd1b7484461791e75d57663b238cc2114df612222c6811411c67ffde19c3ab5
-
Filesize
4KB
MD53117bbf5f4aa4718697163eca13210d1
SHA1144f57d026d1a5058c714116d4ec3ab247b160b1
SHA2565bd7f2cdced1b25f78ac51a49eac21174acf219b70d2690d3d7c705e6267b0fd
SHA512bf899db6fcddad2798c07b56ee2b71c7405fb0b6957584103921bfd436b725e84ab649782f61eb05d9ba8b8feef40618734eb98749088c67167c7e7c0b00728d
-
Filesize
199KB
MD52b7f6c32b401a9bcdeaa3a02da84d685
SHA1fcac1b69bdd30e4a06ea7c4cdb241bd9e7c7ffcf
SHA256f896cc51b466a98cf919536321c4868891272b5bf4f2cb548b84a37dd441b162
SHA512d28566ddef6b207a97b98a0fa6722f5a4a86e33ab4abf1fac4ec2b5c55f64f177abaac18412b2984bf48030b8dc057f6c7c53cf7abc23adacf00cfd8ed00d088