Analysis
-
max time kernel
45s -
max time network
46s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2023 19:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kmbs-konicaminolta-dot-yamm-track.appspot.com/Redirect?ukey=1NVW0XJb4CVJuP2_dkWE5zLWmlpVS4A1fGNieAC3mM94-296438517&key=YAMMID-68381446&link=https://FBHLNI8Y.fundatiababylonia.ro%23amFjbHluLnNuZWxsQGpldHN0YXIuY29t
Resource
win10v2004-20230220-en
windows10-2004-x64
9 signatures
600 seconds
General
-
Target
https://kmbs-konicaminolta-dot-yamm-track.appspot.com/Redirect?ukey=1NVW0XJb4CVJuP2_dkWE5zLWmlpVS4A1fGNieAC3mM94-296438517&key=YAMMID-68381446&link=https://FBHLNI8Y.fundatiababylonia.ro%23amFjbHluLnNuZWxsQGpldHN0YXIuY29t
Score
10/10
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133276228966856120" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 756 2716 chrome.exe 84 PID 2716 wrote to memory of 756 2716 chrome.exe 84 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 1568 2716 chrome.exe 85 PID 2716 wrote to memory of 604 2716 chrome.exe 86 PID 2716 wrote to memory of 604 2716 chrome.exe 86 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87 PID 2716 wrote to memory of 4168 2716 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://kmbs-konicaminolta-dot-yamm-track.appspot.com/Redirect?ukey=1NVW0XJb4CVJuP2_dkWE5zLWmlpVS4A1fGNieAC3mM94-296438517&key=YAMMID-68381446&link=https://FBHLNI8Y.fundatiababylonia.ro%23amFjbHluLnNuZWxsQGpldHN0YXIuY29t1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2de49758,0x7ffb2de49768,0x7ffb2de497782⤵PID:756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:22⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:82⤵PID:604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:12⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4796 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:12⤵PID:1804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3792 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:12⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3212 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:82⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 --field-trial-handle=1820,i,9811454455573763955,780164530410621970,131072 /prefetch:82⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1556
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5b7e6dba4416a3a668bfa5b2252c70629
SHA14ff2e0ce84037a499d2bd5529de2f76765472441
SHA256d79cb8588168de662165cc1e11868557b6aa7e2f6739d1294e1eab716a155e68
SHA5126441cef91cd681cfa5b6285595b0352516c433b190250cade2d36c1e278c045d4ae737c9b8af05d8f5d90862a27aa686faae052f2eb484eec3a3b3b455434ea0
-
Filesize
4KB
MD583b6e28e6fe30ac91d9968d73369ed1e
SHA1bb3fe3fb6c5d95483f04e31579c57a30107dac56
SHA256e5fc7f5bc0617b82b27f70c96e6690e95058cae0ddab9b62b0eb21de375ce5ce
SHA512b06bf51888893fa1767d0be77503ccee114b6bd85d38984a1c212fdb4363bbc5dfc3c6fb030a1060080db4bad7904f4589ac09a90e15233225570b28fbedbf0c
-
Filesize
147KB
MD5db29ed38e8ad793d9f5d4e7a1ec8ea52
SHA1ab07c4f60e09938c98f93c2ad6dee40305ad93e8
SHA25671aaabaf815635ea409cd761aad52b984e77495b852bce945f2a492586b3e528
SHA51261cdc0da1c00583d4f98641fc5ffb7449a0a437f52bccd70255a40601dbe258413fbd8e49b838d6e2c790359b8b624a17c5012380d2ccde4856c35fc6c991d89