Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system - submitted
21/04/2023, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
Receipt.zip
Resource
win10v2004-20230220-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
INV-2131.htm
Resource
win10v2004-20230221-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target INV-2131.htm
- Size 146KB
- Sample230421-t4hy3agg98
- SHA256 85356521df25310652b87cf1ded54974a6ab506ef9d71ec52ca3debdeb408370
- MD5 ab7ed4d0e72ac79793ea50f8d0ddbc64
- SHA1 3be9af842686d24abd9573fcfb8a022dedb650d7
- SHA512 1cc77fe0e573aafcb4330d3becb5cede4253bec069e1aa830347a535d310a84bc8d446c7f2d51570b6f7c577f9f43de783754dc0c79cb7a2eff078d280c50b8b
- SSDEEP 3072:bKVvr0NOZ7hFV+yw2B1IyiCFJyrISwVAx8ZoyFF8feTIh1DYFmsxyOhmX:bwZVFVmCPmx8ZZ8feg1DYtyHX
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133265758198258749" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3040 chrome.exe 3040 chrome.exe 3752 chrome.exe 3752 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3040 chrome.exe 3040 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe Token: SeShutdownPrivilege 3040 chrome.exe Token: SeCreatePagefilePrivilege 3040 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe 3040 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 440 3040 chrome.exe 83 PID 3040 wrote to memory of 440 3040 chrome.exe 83 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 2500 3040 chrome.exe 84 PID 3040 wrote to memory of 4576 3040 chrome.exe 85 PID 3040 wrote to memory of 4576 3040 chrome.exe 85 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86 PID 3040 wrote to memory of 1320 3040 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\INV-2131.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeda999758,0x7ffeda999768,0x7ffeda9997782⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:22⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:12⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:12⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5028 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:82⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 --field-trial-handle=1840,i,15246693677960403699,15357955796494773741,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5100
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 9e351828a885dd7b35009452c3d22875cf956f5f7b30e0e75372a254cc819c17
- MD5 7eeae625be9ad54390169ae0d5ad2c58
- SHA1 f25f33b43733e471c834df117f91edaacfde04e1
- SHA512 14352337ad9a0df759b21cc22b574c7de044999d0f0faf25825ab99d4c1e31c3344dc138693cb1118fed3888c7639e45973aa826edf6f0cae5508220d11df7e5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 13b5a6923edd16bfd49cec5b7284e3a0f38974c0d58828abb18ce7e3f7230b2f
- MD5 807cfc56a30d1cce93f7910dcabf6f7d
- SHA1 ff8ba9cc9e56f6e6f1c8e55915ea77ecd9979e2d
- SHA512 2abfb9ab44e471f1e442a54999553477b21c0cacb069a09e0ff29bd08da908e2c38dcad105e7c1d16127c4f4d142ea5373ad7c6331e38b5b100464fddf6bc7a2
- SSDEEP 96:RKMlX+KI4B8iZRy7Di+6MsmdeY+IOJQ+1jVhYtjEsXt0/cg2Vup:RVlO88syy+FT+l1otjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 2815033645d92ff182dfc9f91773bbe7571b33b034ece5cfdf0347c4da248765
- MD5 a48f5668c05a2b61ff2a75b819d808ee
- SHA1 f52f442d406bca2c9af9d0ba4ef4a048e1f018a2
- SHA512 682ab2c33bf93dcf79dfa956bec6b1b60ccf1178d4e5eecd2d2f5ac7afa28851c84a6d8e0ea3335e9323bcd077c31eee75369c842c2e2b51a7bcd559d2a2754f
- SSDEEP 96:RKMlX+KI4B8iZRy7Di+6MsmdeYkGOJQ+1jVhYtjEsXt0/cg2Vup:RVlO88syy+FTkf1otjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 639dcae3f25bd5e9eb608d0a26fb6d2d42ab32be846e057f678a58f7733b4645
- MD5 315c19a82f59bd5eaa068f701b56c055
- SHA1 267c54a1fefe332ab16c9952f70d4598cce222cf
- SHA512 27e2704a7ec8fae16b5d587d9531bb2a325c0a46ef1fd7f3f8c323d0a3a2bafd355775b63789716712dc28698759206cdcc0cf251dd4b4d934f25ffed6a15662
- SSDEEP 384:X23LALPt/XW51kXqKf/pUZNCgVLH2Hfkz3rUwHGEMgQP:XYLALVvW51kXqKf/pUZNCgVLH2HfK3rO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 c83ec8c8c16da8775698ed6f899b043666623952a541d11708d86583995eaa21
- MD5 3679e3f4c2eb2802f7d8dde2629f4385
- SHA1 d47520664378d32e305fecb45d387f8c33023e83
- SHA512 77aaff2b56b785da1d7561c82819f4c27e9507f309b7fc4b6d97b6c2fa3e2346f0d8f9a7de043ac4ab67f7ff394ddde65658a132c868f23cda20b2908539b925
- SSDEEP 6144:Rcqe0kDo4z+7OHSBD/+JUys0/I04/S/viVLjhf:Rc2kBpy1/+JUys0/c/SniNp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512