Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2023 09:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://documents.dhlparcel.co.uk/
Resource
win10v2004-20230221-en
General
-
Target
https://documents.dhlparcel.co.uk/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133263766902480403" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2744 chrome.exe 2744 chrome.exe 1756 chrome.exe 1756 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe Token: SeShutdownPrivilege 2744 chrome.exe Token: SeCreatePagefilePrivilege 2744 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe 2744 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2744 wrote to memory of 4676 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4676 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1400 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1060 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 1060 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe PID 2744 wrote to memory of 4912 2744 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://documents.dhlparcel.co.uk/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc48ab9758,0x7ffc48ab9768,0x7ffc48ab97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3152 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3132 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4412 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4968 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1880,i,2838805181435361183,5118618098248259960,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
504B
MD5e4d14d20f068741074838f77b7c02ea6
SHA1dc2894e2b9139d4e85850459855833f38ba85bc2
SHA2564174883fac2cf79d9204f7241f83c2876dcab201a34f0787e5fdc4244f27327a
SHA512b321b65ebaa645fc1953c23d80058eba765b92d76520e95f01249cd86cfef47928d574f41bc94d164f71ecbeea4a39a9b33520d06f34fa28d21694b5d88cbd43
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD55101d51d5bda90679d66bc8fd06b121f
SHA1603eba917e073423216c6a071f7ac11e7d54fd52
SHA25603dfbf508e6e09617bd666597747e7385628e3c2a75536fcfffbbe1b3a5f3207
SHA5123133d47151a1463a85f601f835d2cd534db5cf766f37077d81a215062009016ad26726132c80abc8614010bb6b4c9967f7d6759a8915d492a6208a893e550d46
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
707B
MD5355d8d1b76517e4826cef82c0f566940
SHA17ecd87d1bc25b30c405428eea417f8b894c6b37f
SHA256158bbeabb4865223bf2ded51090c4200d84705668947456f1b3022e79b7d2885
SHA5125bfeb86316c7f0a3fbe084a281f67b9faf9cf3657eaeffa4c982dd0f27f8910b9b7c49f16ee17bf60b9d2fd416868da41852bd938609214e9b8a6f15a0d198f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5f5549367e2b8ddd8124de79fd684fcce
SHA12c399bc7a93a68481a6bd2c6ac734bad28c317e6
SHA256daa8dd4956e9e9dc5957a28febf0c69d665dec2723ed03bccc8c295124079e83
SHA51211bb7556b7365fa017976de3547a9f0c2c894af21a9caaf5fb79b20f42a3169f1f65dd201bac997c6b4b46ecc9c899d80eb6fc00339183c07d48e542062809ef
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD52c012794df921bdd88dad9d419d3ec92
SHA1e3e9248fa1dd264174d8c596f5db909a0b75b405
SHA256ba8767b26954d6a673686c904e08117c671ceea06b60c228d1fa8cdf9c9251c8
SHA512b02ad8c5068ee260e038e447ad3b656c2b4aba8a35a4a15216a95c93afd3fc52e86b2cd7bb0af92fa9d7c9137a98af5f6e11202875ee8d27e3a1832a9b8f1bf0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
200KB
MD52dede97896463556ea237d09f430638e
SHA12113275d696a04a719c641071013edc62c0eece4
SHA256211095afe90e432d7d850fab5a4bd0c9fa1954ee43702866a7d26044c1bcb901
SHA512676d026dd8c6497582979510504a85b8b892e61c35c3713da183f5a965bccf6edd0de77f44ef79c76e173074dd47540c179e2a27e0cb1b6ddeee16057cb4e368
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2744_SICFYEKSBXAOFQECMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e