Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2023 07:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mkto-sj240021.com/NTYxLVpOUC04OTcAAAGLpZZMZG5eQvb9EPW0kS6xh5xrRfAyEkYwEUAk8L0bNgvYwvZ87V4PgQZrZfIL4jjjQBKQRI8=
Resource
win10v2004-20230220-en
General
-
Target
https://mkto-sj240021.com/NTYxLVpOUC04OTcAAAGLpZZMZG5eQvb9EPW0kS6xh5xrRfAyEkYwEUAk8L0bNgvYwvZ87V4PgQZrZfIL4jjjQBKQRI8=
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133282636702614094" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4572 chrome.exe 4572 chrome.exe 1628 chrome.exe 1628 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe Token: SeShutdownPrivilege 4572 chrome.exe Token: SeCreatePagefilePrivilege 4572 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe 4572 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4840 4572 chrome.exe 83 PID 4572 wrote to memory of 4840 4572 chrome.exe 83 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1916 4572 chrome.exe 84 PID 4572 wrote to memory of 1952 4572 chrome.exe 85 PID 4572 wrote to memory of 1952 4572 chrome.exe 85 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86 PID 4572 wrote to memory of 3848 4572 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://mkto-sj240021.com/NTYxLVpOUC04OTcAAAGLpZZMZG5eQvb9EPW0kS6xh5xrRfAyEkYwEUAk8L0bNgvYwvZ87V4PgQZrZfIL4jjjQBKQRI8=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb46e39758,0x7ffb46e39768,0x7ffb46e397782⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:22⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:82⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:82⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:12⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:12⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4484 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:12⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:82⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:82⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5132 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:12⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4636 --field-trial-handle=1812,i,3471958819980919713,15254792381774665056,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\53a00384-12d6-4811-a320-e4711c4f4783.tmp
Filesize6KB
MD58963ceb97bdd8007fff05bd4eff959ed
SHA120e99ac3e90310960614d058eb57d8742a34381c
SHA2565883ffbd001d4366ca39a302773abdb343a7c0737f128a8cf3b7b24a2a8431a6
SHA5121c49f95d28d37e1d689f0829ead44cd64cedfdac4880151831d06ddd36bd978294d20cfc4f6a588bbcd5298bb730442582120d32e9e38d9a2069627a2daaa1db
-
Filesize
288B
MD52e6f7d4d51065bb718788e868f8ae29c
SHA1eb5669e6064d38c088ab80677328a2cd63bc92ce
SHA256c5463e39d56c99b3b858bce84342b260fe2cdde6d3f38e81cadefa0dd2e9611c
SHA512221bb55caae2ab3e516b3b6cf2fa9009bd8eec5538dee3b2c375ad0d1c03fae7656a42f4f3037079cb1c37780c3091b89c08ee1b5e8effd16d4aef1645ced8c2
-
Filesize
2KB
MD582e24637f97436143484bd51b2f9742b
SHA106b57d33fc4a400c3ee51a8d7cca61b0d5d6984e
SHA256d3c97560deb3b7a6e563c3cca209097783839109427a8f2b419cb4bf48dbcb0f
SHA5129da86bf0ec13125e0a3e008c72ecbd208ae7358aefb9d6517a1f5b45c3eb4a478bc06b208936272ca8570074a517299d0445a08a503b8a65d81ec868040a2895
-
Filesize
2KB
MD5651e031a42fb3479416ca37a38b8f937
SHA15323454a110be156b5cae4b8ba780befc7dc442c
SHA2565e5d9996faf2f78191467c397414e34d5da2ea5b839ba0430abb03735bcf4ba9
SHA512442e32513413965d14be39df30c16e2d57d508d10b69a8b459358bb347a95b5889e401e440ab645a1444be73fd468cfb32853b722907a8a1c1f1afec05954f5c
-
Filesize
706B
MD5ccf710a0c7dd6d6b52afe9cd332937a6
SHA107e37e0385af4fdc0559bbbefb443d6c7deee8ef
SHA2562ccd97a92de7e5649d84b0abf717bb36bb9e423e501c78ec2196bfe49976506a
SHA512ddd07bf2e01adf3ebe51cf42ab5db8932c35e3db49a9c2915db68f223607bec7638ee52f21598451cc3fa54f0d1ac685e547aa5452c9b24de3960e96151a43e9
-
Filesize
706B
MD50de4d1682724eefe66bb4fff5e922e59
SHA173c0f225b2cebb6f4b99af5689232e85e5ccf9c1
SHA25673f8c7f6bd0ed4803dc7cec3372c9f4c596b334697172c1c210703107f2c24e7
SHA512f1f6007ee095650e2e51202c60671f3921862d87e0803a22d71585fa9a506cffea84a39f3a2bf00f439ee9fae832b120fd5bf7cbba8d50d4e0f416cb74ff546b
-
Filesize
6KB
MD508301dbd511d24fe1a7c7cdcfc546392
SHA13dbe9e1464c39a410fa3a8045872b614a4953522
SHA25653694a1e36e490f53aec2e3692c5307820f5bc8e31e4bf9919474456e56b48ac
SHA5122a7adca6e36e0d264fcf352745b70c6efd35d004178ae10cdedc1c925b5ecddb2dbf746c8bf2df5e6582dd10c2a13020b2bad012046bcfa6c17d28acae4fb6fc
-
Filesize
149KB
MD50e3b2c144b8b76a983e09028bf91aaf4
SHA1ad19559ddcb1a3a05c5baba1b2f40c7d06428264
SHA25677b13f8fafcab686a5b8c22b9eb940aa079ccb3c501087024ffba4c429edfe1f
SHA512c5793964c3a0875f1fdc1b678612dabfb5b3049469160f86b4dadb45748eb0ffaac357594235ae16a9b58f2834998ea1e6e99cf0fb47da5baaf6bffb2d18658d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd