Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08/05/2023, 15:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.avantlink.com/click.php
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://www.avantlink.com/click.php
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133280340954623105" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2456 chrome.exe 2456 chrome.exe 5048 chrome.exe 5048 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2456 chrome.exe 2456 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe Token: SeShutdownPrivilege 2456 chrome.exe Token: SeCreatePagefilePrivilege 2456 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe 2456 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2484 2456 chrome.exe 66 PID 2456 wrote to memory of 2484 2456 chrome.exe 66 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4180 2456 chrome.exe 69 PID 2456 wrote to memory of 4116 2456 chrome.exe 68 PID 2456 wrote to memory of 4116 2456 chrome.exe 68 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70 PID 2456 wrote to memory of 3580 2456 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.avantlink.com/click.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa03d49758,0x7ffa03d49768,0x7ffa03d497782⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 --field-trial-handle=1832,i,12730445632693355134,4332493957166275520,131072 /prefetch:82⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1832,i,12730445632693355134,4332493957166275520,131072 /prefetch:22⤵PID:4180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2004 --field-trial-handle=1832,i,12730445632693355134,4332493957166275520,131072 /prefetch:82⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1832,i,12730445632693355134,4332493957166275520,131072 /prefetch:12⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1832,i,12730445632693355134,4332493957166275520,131072 /prefetch:12⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1832,i,12730445632693355134,4332493957166275520,131072 /prefetch:82⤵PID:4136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1832,i,12730445632693355134,4332493957166275520,131072 /prefetch:82⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4164 --field-trial-handle=1832,i,12730445632693355134,4332493957166275520,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704B
MD5045444968affe74209ab72bb63f58ccb
SHA1ddc0e9df430eb51e27340e6421ff63be1f7c4aa3
SHA2567df553528f642f87b15a57073248c6362a484263d95c10cc513b6fcefc816877
SHA5125a41649342f172593b58911d0c668eac0e3568ea615bb320c9bc80d6229b9af89871e8ca2f58845d2e421576e3d367a15b621ac1a2f32cc7a47d009067486ef1
-
Filesize
5KB
MD5a4888f6dce94577d5ca2e0415c40ee03
SHA125602618eb7d5d75233011316c81751128e3ac97
SHA2561c0e40bf4ce3d0d3e63d8e2e760b4037265380df376c154bcb8a26471e702934
SHA5125863b10999ffb40623e1bbf55784352fe656ae105b22cd05352a6caf0aeacbc1219048ce720a786e44f686247bea241feedb581f1ddbb11cbf89fd0cdf803533
-
Filesize
5KB
MD5532dd17ac0f3aca4f5e70be334ed5b68
SHA1e0229ed2288fa0572329a6e09f263e18b27a78b7
SHA256d97203da1ef2daccba88854f496874e7d0f9a415fa1f948a4f4256d97aa2ca96
SHA51269336a2ee9b75e6cb341fbe148b7e7794bf66250a331ede76596f5f95b1f5a86bbc6a91f6dc54795cdae3dc32c29755edd2a4d37d7a1426e6b230405c11c0a40
-
Filesize
5KB
MD5b568b0e5599cf3e551394988704a09f4
SHA1196b7a625e258227b97f1182ef9292e832ea6bcc
SHA256e5b68bc4a3e2f1622786f817ec61c10b7a95408b30b2ad0ff26e781bb85b2a46
SHA5127e005c9f66cc08875983bc76434b33b3d241304e82e9915908a8a1777c419b693eac8568ed75e3fe9d038cf6277c143da5a337fc8d292cb1b61e896e225e6f83
-
Filesize
149KB
MD557aec1fb41e50e06de7757429ad97b25
SHA1d14bf932bc9ca1197e7b4a581de981d35612fe1f
SHA256375e85e5cba0e0b8a6899d2f15ff5d41cac09dc9e8252dacd64940265d9c7dbe
SHA51228a685b6514453f1dfd600f70e86e66164b0deac9d109d074e7ecec544169734bfb0c999b264df71738193b5972bb125de9edc579751b0f22fde12f52ae41f63
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd