Analysis
-
max time kernel
601s -
max time network
495s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2023, 18:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.microphone-online.com/
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
https://www.microphone-online.com/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133262299358533446" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2580 chrome.exe 2580 chrome.exe 2308 chrome.exe 2308 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe Token: SeShutdownPrivilege 2580 chrome.exe Token: SeCreatePagefilePrivilege 2580 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe 2580 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 3748 2580 chrome.exe 88 PID 2580 wrote to memory of 3748 2580 chrome.exe 88 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 1716 2580 chrome.exe 89 PID 2580 wrote to memory of 2180 2580 chrome.exe 90 PID 2580 wrote to memory of 2180 2580 chrome.exe 90 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91 PID 2580 wrote to memory of 1560 2580 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.microphone-online.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff876129758,0x7ff876129768,0x7ff8761297782⤵PID:3748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:22⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:82⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:82⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:12⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:12⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4436 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:12⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3360 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:82⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:82⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4984 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:12⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2188 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:12⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=212 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:12⤵PID:348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4384 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4804 --field-trial-handle=1736,i,15602445431036519905,10239753850461872221,131072 /prefetch:12⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5be052887857d5df606cb75d8eee12d31
SHA1011ce3e79637d362f15fb68c431b3dbd42e062f6
SHA256a7c6b2f7126eb0d8a06d6286bb405f9bd1849899e74861886dcd8f3a9857e156
SHA512e4f8a025cddab554644db1605e134924f4709c266c19740c799f2993f7f4f9fc255382e6bfb72cc8216563b7a99550ed500eefd0cc9576508ca01023ea747e60
-
Filesize
5KB
MD5ee5d733dce249a4c26e7aebb64d403d7
SHA1d771bdb9597468a1d48ca1e9313561d686b86d84
SHA256837a06edfc4da96753d178cddba4d6ad801ff900cabc75e40cf63667bb436131
SHA512cdc8f864b3863e0f329dee6638b0a6157c3baa4216c2be1dc7c7f18663ab7b596c504cf3e3f90cf000b7a4093b3a3018ea12d24390606dbaabc14924e0a46051
-
Filesize
5KB
MD53d9a21c4493176736c8c1a5c92cd31f4
SHA1b6da9c49c19cfa6ed8eb4bfdbb32d45a0d04e27a
SHA256b47b0aca6221c87cc3812580451d99fee52b5a41ec370a0ad9ed7360e602aa3a
SHA5125df021317f2559de5d8d18939d96048b998e2e2dae399384c1a23fb489d056b095ade8ad233ef5b34f7ba9b83d07064f1060e3bf458279000d7e1e7131951b98
-
Filesize
199KB
MD5fc3ff7a7721d83175800dbda1f619b86
SHA14fbdb128b622240cc177c2f60592edb8b9e635b0
SHA25687a78009fd596d1dd3d02fb23994949850cd820405c155a99ff0a6ea3e849c37
SHA5124d6d0b68990f92e500fe683d927d49f62be1cb5c56f8040544644ecf4350dcf26d6609f01b82cd25d2a69521ad94e0d6d8c62dd1411fe96ef20c484a251dcdd2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd