Analysis
-
max time kernel
30s -
max time network
23s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08/05/2023, 20:12
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kmbs-konicaminolta-dot-yamm-track.appspot.com/Redirect?ukey=1NVW0XJb4CVJuP2_dkWE5zLWmlpVS4A1fGNieAC3mM94-296438517&key=YAMMID-68381446&link=https://access.fundatiababylonia.ro#c3RhdGVlbWFpbHJlZGFjdGVkQGdtYWlsLmNvbQ==
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://kmbs-konicaminolta-dot-yamm-track.appspot.com/Redirect?ukey=1NVW0XJb4CVJuP2_dkWE5zLWmlpVS4A1fGNieAC3mM94-296438517&key=YAMMID-68381446&link=https://access.fundatiababylonia.ro#c3RhdGVlbWFpbHJlZGFjdGVkQGdtYWlsLmNvbQ==
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133280503970857410" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2228 chrome.exe 2228 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe Token: SeShutdownPrivilege 2228 chrome.exe Token: SeCreatePagefilePrivilege 2228 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe 2228 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2240 2228 chrome.exe 66 PID 2228 wrote to memory of 2240 2228 chrome.exe 66 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 984 2228 chrome.exe 69 PID 2228 wrote to memory of 980 2228 chrome.exe 68 PID 2228 wrote to memory of 980 2228 chrome.exe 68 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70 PID 2228 wrote to memory of 3588 2228 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://kmbs-konicaminolta-dot-yamm-track.appspot.com/Redirect?ukey=1NVW0XJb4CVJuP2_dkWE5zLWmlpVS4A1fGNieAC3mM94-296438517&key=YAMMID-68381446&link=https://access.fundatiababylonia.ro#c3RhdGVlbWFpbHJlZGFjdGVkQGdtYWlsLmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd65d69758,0x7ffd65d69768,0x7ffd65d697782⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:82⤵PID:980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:22⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:82⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:12⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:12⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:12⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4744 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:12⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4464 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:12⤵PID:524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3204 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:12⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5036 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:12⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:82⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:82⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3160 --field-trial-handle=1788,i,1817480111009527332,16624436420277631951,131072 /prefetch:12⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f74a29cd1a8b4f8e4299747c61baf3c9
SHA1b72cee07378cd9e24721f6d5a51a706f54ceb6cb
SHA256a27bd3e605b93896c0e6843def46a4356db4b9d0624af4e92f2383ec84a35bae
SHA512e1c42388dfeb8e7128059bd39e7714173b5c66bcf8747dc33be11eabdbc3486dd4fd0f4435c0bba8d5dd322f5f95164ad6749427ab44f2d15a69216b9192cfc3
-
Filesize
149KB
MD5bace61edc046dd41c9385f14ef67d215
SHA18cd33c229d1ad6627a28ce2303e55ebcfa26d521
SHA25642045bd555f83d7a309031d007de7df4bee0f05c04f6d15adfaf2b825c1e74df
SHA5126c799644789b804d489165e0ac55d14087fe7603d82555196c9664c6b243bc4d1da790cd01aa5589bb16d96cdebb5483f9a682100954a8c86840d3b79168e874
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd