Analysis
-
max time kernel
300s -
max time network
279s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2023 17:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://nkq14ldx.r.eu-west-1.awstrack.me/L0/https:%2F%2Fenroll.krollmonitoring.co.uk%2Fredeem/1/02020000h047kjhe-mhjbbn1q-d7r0-jqqv-hu3i-k9jq98291q80-000000/kDHZ-PM44hBwGqXHPeISDPGCu7k=317
Resource
win10v2004-20230220-en
General
-
Target
https://nkq14ldx.r.eu-west-1.awstrack.me/L0/https:%2F%2Fenroll.krollmonitoring.co.uk%2Fredeem/1/02020000h047kjhe-mhjbbn1q-d7r0-jqqv-hu3i-k9jq98291q80-000000/kDHZ-PM44hBwGqXHPeISDPGCu7k=317
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133264935082571955" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 864 chrome.exe 864 chrome.exe 4628 chrome.exe 4628 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe Token: SeShutdownPrivilege 864 chrome.exe Token: SeCreatePagefilePrivilege 864 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe 864 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 864 wrote to memory of 2720 864 chrome.exe 85 PID 864 wrote to memory of 2720 864 chrome.exe 85 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 2184 864 chrome.exe 86 PID 864 wrote to memory of 4824 864 chrome.exe 87 PID 864 wrote to memory of 4824 864 chrome.exe 87 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88 PID 864 wrote to memory of 3128 864 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://nkq14ldx.r.eu-west-1.awstrack.me/L0/https:%2F%2Fenroll.krollmonitoring.co.uk%2Fredeem/1/02020000h047kjhe-mhjbbn1q-d7r0-jqqv-hu3i-k9jq98291q80-000000/kDHZ-PM44hBwGqXHPeISDPGCu7k=3171⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaed59758,0x7ffcaed59768,0x7ffcaed597782⤵PID:2720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:22⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:82⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:82⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:12⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:12⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:12⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3452 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:12⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:82⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5456 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:82⤵PID:1216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:82⤵PID:624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2852 --field-trial-handle=1908,i,12144447900299468024,15173606001875587019,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264B
MD537d779dcc8a1209e0392f5a424123753
SHA1f1adcd69100b7ea72a4bd330cad1869f72a799c5
SHA25657e0dee4d10751e515f472187996cd2f7babbfd76e9199ebf77a69e2c3c7f176
SHA51273aec31074f5a47c1fa11af1c81a41d4e8bb64c502fe5fdd49c6492be91cf34565fcc772b45b77006aeaaa351e42ea713b344936f72c96a1c5d47be6a3f43111
-
Filesize
2KB
MD5ab8fc4a2a34e5d76c67a7a27fac53fe5
SHA12f9904242435077033c0a82fde2fff2073571e39
SHA256c002ab9220c9097984cf9df6be624acd69c240beb17e953f3db95c776c55466c
SHA51286d405d9853e080b8990de931d584492bf092445c39e1ac5f238576ef1f59edf587867b131cac055d24365692bfdcea1eab58483528a66aacbb69dfe6ed790d3
-
Filesize
1KB
MD550cc73f4a8193c2f1575b93bf10d6e4d
SHA1fa8018124bd206132c5dff0a6ba48a89e5f62860
SHA2563c373ddb879b1f5e64881424ebc5c1e48753b02a07824a3df1e3bbb966f60a4c
SHA512540405039968a66f1eaaee87dabe5c82e06864a1300bf7a0e1cc87270b11f261a69898f241b2da25c943ef9bb6b90aabd9ade90eccaebaf44f69e98bf1cca93e
-
Filesize
1KB
MD59664b203569d885269d4cdce93c7f6bb
SHA1a3abd6164575e68aa00dfb15ac5e18ad8f09f6a2
SHA256e1fc16bede9d1c52dada409587ea1cca3c2fd217f6e48c4b4014ab947a840592
SHA512ef16e2c9b95988a08c75bf8a202f66e098dba5402b48c3fbeec0afaab0201efaa0817e38fc5d7d32e9c48525648f10344df906d4168e1c4d3e48028e6a0d428e
-
Filesize
6KB
MD55631353e044d1fbbd8ec97b34da68f79
SHA14de1e74b1577a4ec8e809402175f630e92214ac7
SHA256bf6e2760a5c3968fc4700d87213f431d54b0a32e774b7ffecec46b711dfbfd9b
SHA5123a1eda454dce6bec845c42d2af2c55464da572a75907119e6c910446d128230a6a558aceb1fd814a55c12675667d9d02a65d130c274e833cde9a876cb685f4d7
-
Filesize
6KB
MD5027b9671064679330f25c90d0066a86a
SHA121384eb72e32ccb25365d165372e65ee3b520c41
SHA256a7b116417209d087e157b43d428712d5117c46e436cb8acac2bf52003464d1e1
SHA51224e410e9c27427d833beaaef155c356fb85d7cee1e638d18254e214dc3dcd42469d4e8a065863a34c977749124f28bcc429cee088cb311c14ee6d644888239c4
-
Filesize
15KB
MD547378f4f43d1471bbeaa3bbefc84db93
SHA16ddc9db594f902f571e8c5c33da31542932fb815
SHA25610f9c9d53534bbdb2075ac064955da8426ad0805a861b3553af12e8c2eb209bc
SHA51212c718b4668e866c36fa4ae4e86933484171884e8b636a2a88649015a8d995a80e491e80f6b98e3a6519934e08cfe41b0d7ce55db6f0dbf009a1be1b5e7a8930
-
Filesize
200KB
MD54423a27957f745b16b79bbb5bdf9d982
SHA1e5c04b9791d71e7523dae1f2b9d73474c56df7bb
SHA256be5eb258b20c80f57cc369cd2b83e7e254559056aa8fa541c9c901f97677928a
SHA51276381979cc60a9fd4bea5d2657a729b035de18e4253e9d7b6bec741b5d31aea556732367ad610784cbe4ff4dabc8fbbd6752621962dddbecba5d2f248dd734cd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd