Analysis
-
max time kernel
35s -
max time network
37s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2023 08:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pressefachverlag-my.sharepoint.com/:o:/g/personal/mevluede_yuece_presse-fachverlag_de/EvcobI5k0PxNmcWMA5IDxgABHd7Lb0YJ-d8ixiGb9LTPZw?e=fNVgz3
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://pressefachverlag-my.sharepoint.com/:o:/g/personal/mevluede_yuece_presse-fachverlag_de/EvcobI5k0PxNmcWMA5IDxgABHd7Lb0YJ-d8ixiGb9LTPZw?e=fNVgz3
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133262862030941817" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3516 chrome.exe 3516 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe Token: SeShutdownPrivilege 3516 chrome.exe Token: SeCreatePagefilePrivilege 3516 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe 3516 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3516 wrote to memory of 4100 3516 chrome.exe 66 PID 3516 wrote to memory of 4100 3516 chrome.exe 66 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 4456 3516 chrome.exe 69 PID 3516 wrote to memory of 3852 3516 chrome.exe 68 PID 3516 wrote to memory of 3852 3516 chrome.exe 68 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70 PID 3516 wrote to memory of 4608 3516 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://pressefachverlag-my.sharepoint.com/:o:/g/personal/mevluede_yuece_presse-fachverlag_de/EvcobI5k0PxNmcWMA5IDxgABHd7Lb0YJ-d8ixiGb9LTPZw?e=fNVgz31⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc33ec9758,0x7ffc33ec9768,0x7ffc33ec97782⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:82⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:22⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2036 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:82⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:12⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:12⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:12⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4560 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:12⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:82⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:82⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4708 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:12⤵PID:96
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5188 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:12⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1840,i,555180783037458304,17527038694388837651,131072 /prefetch:82⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4344
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5029d0e07827044d3bd81c4828005069f
SHA11e8775f1f2dc4c007f9acb8819bc72f2e7d6221f
SHA2567eb33ae02535582f0b80b30b5e2830f7e85b1b8fd5928459793767d8eb045764
SHA512d39a9278cdd923b92d56b43cc1e32e138f8eed797e49f9a7c0fe060b3532c7535ee4819c6941b2f81eaa4d4261f25fc4c8bb03d31bcc7c8b241641ea755afaae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fe764644-9fde-4bf2-aef6-3bd842cdcc81.tmp
Filesize2KB
MD5f1f1e491158547af683fdf2925061c7f
SHA1e3318210273a313df99023811ff3a33c00bc68ce
SHA256c5d049afa182e8c59322a444587f6bddab0ed3dd0464acace33c9a7c59235548
SHA5127aaebe431917e32e139b85eacb4fb2c94f5ce1db868cbf7ffff5f4eac1053992343cd26195ad0d8576a607a32e3761f4dd544537df0469339f39fad9a1674575
-
Filesize
5KB
MD5350757c262aec4c279d653fac150348a
SHA14eb3325baddb4b8c33642ec4b426394f27d41ac9
SHA256dab4a430fb4e2e44bf97a1d8ee5421fb802241637552b43c5f82dcae77800024
SHA512e0a8e000168213dc259b76bdf146fa40df522e2197a720a7d2294f06e08bb3b48fbb71dcfb8d278ce0757129a664cc87bad1c5b0553299b8d5ded27ac1c2e39a
-
Filesize
72KB
MD5ad6a8f13a0bd43c751425d41764519e0
SHA178c548c0a469c26f7ddfa0043066192d62e6e371
SHA256ec7b570d6a34728b14429f0a478c37b1a3cf49f3eb691362c0010309da8a6c71
SHA5124a35765c33a06c97a75b7104d117f0f009f0388dcc19abcc18478803e13029dcb147ccc1ce3e07db1c00a4a2453fe2b439188abe434fdfa49ed34a5d43af41a4
-
Filesize
200KB
MD5cac8b2088b84176df59c2dfa9f6b5fe7
SHA13ff5e9d8412b16f5ef4d81093725a1a536898785
SHA25683e671132145e72bb8634e48c9757e8e13070fc88f4cd988e2af2070f4bfa7d2
SHA512f28c46cb4e12616e2f58a891e7ff202c8f897fb5532e14c7834ea00b1053dac97a7abc92821c1eb8bd0dd05361f351efd9e1efc1d6608ba5b6bacb215ce3323b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd