Analysis
-
max time kernel
46s -
max time network
272s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19/04/2023, 14:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://infogram.com/space-1h7g6k0vvwjp02o?live
Resource
win7-20230220-en
General
-
Target
https://infogram.com/space-1h7g6k0vvwjp02o?live
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1972 chrome.exe 1972 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe Token: SeShutdownPrivilege 1972 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe 1972 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1632 1972 chrome.exe 27 PID 1972 wrote to memory of 1632 1972 chrome.exe 27 PID 1972 wrote to memory of 1632 1972 chrome.exe 27 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 1468 1972 chrome.exe 29 PID 1972 wrote to memory of 760 1972 chrome.exe 30 PID 1972 wrote to memory of 760 1972 chrome.exe 30 PID 1972 wrote to memory of 760 1972 chrome.exe 30 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31 PID 1972 wrote to memory of 576 1972 chrome.exe 31
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://infogram.com/space-1h7g6k0vvwjp02o?live1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb0e9758,0x7fefb0e9768,0x7fefb0e97782⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1204 --field-trial-handle=1308,i,12721234745398453641,8878382532810995425,131072 /prefetch:22⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1308,i,12721234745398453641,8878382532810995425,131072 /prefetch:82⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1308,i,12721234745398453641,8878382532810995425,131072 /prefetch:82⤵PID:576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1308,i,12721234745398453641,8878382532810995425,131072 /prefetch:12⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1308,i,12721234745398453641,8878382532810995425,131072 /prefetch:12⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1312 --field-trial-handle=1308,i,12721234745398453641,8878382532810995425,131072 /prefetch:22⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 --field-trial-handle=1308,i,12721234745398453641,8878382532810995425,131072 /prefetch:82⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1988
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d009c0cb77df7f5c117c07cb0bb9183
SHA1af3600c2edc170888dd9186990395d65494d512e
SHA2566f7b8d2927a868a4e97703be4b26b02beff13efb3dbc3f077c3eaa9a46a1c728
SHA5127745e2eebde12a0cae4d7eb7487f0c3ddff7dbe0141b4e82593305dc7b85eb923a5abcc9d05d4efb9fc86ca5bae528cc55cf1452c178695c0821b584bf757446
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6ed1f0.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
2KB
MD586b08fc9fa191f9f897819539a79617f
SHA1be5e8a8eeb833bda7c11e233f02be7fa8c226d0b
SHA2561225f03ce262e4aee47e5b43fd38b86a230e13be13898a43b053ef51624aa8fc
SHA51216b490090ae2fac918d9ec1de3c91046e2cfefeeed8e39d8e4e98ebcfd7e601f0d869d3fe35430e51a81c0d1b27247cdc4febec5ee5825d8739f4e016b8f77bb
-
Filesize
1KB
MD509ff750265224be932ff483dd3658b89
SHA1266b6da2ec1f26b9ad23e773d3738d6c66b9baf7
SHA2565fd09a5db525681f4ce81408209c2aaf24ea92b953636a691e8c0a7015f3e8ea
SHA512a58da47a35439cba4e556b5bdb685b69e660a5c64de8ac8b77e9f53cadc16b5e7222b88c46295dc0b94f63c966a9b3324b4bb3b4ce58d77745835bfd36b71b20
-
Filesize
4KB
MD5aeca94d77aa39c38d9d733d6ac5ad743
SHA12862609e1693781cb387316c4fe4a26c551e5b86
SHA25697fa26e274bdf28a53f9288ace765d22ae677a3c92aadf6b5cc5902585aaf7f5
SHA512c1df46e2df8c96da186d841d8c8cc5caa437f054b6f5368b61d48ad53324d5ae99f798acb011c25b04919c32b214e3ab419083ac857a7f1065bc5b15d268f37b
-
Filesize
4KB
MD599edde540d54843b20d136ea27413a2f
SHA10672e164ce184efe8dbfd11a0706c1f20dc10b26
SHA2565f2fb2eb23058a091d613ba9d7814ceebbe642eb782b57e299f56aa66bc65769
SHA51290a171ca329be8882caeab5dbbb243b2cfbd81be0428facf7b2cd26228248a364dad6d2fd019104a6abaf017c91c1cd427de6f01a291fd0ae2ea446d15d37af8
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff