Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2023, 17:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://77.73.134.27/n9kdjc3xSf/index.php
Resource
win10v2004-20230220-en
General
-
Target
http://77.73.134.27/n9kdjc3xSf/index.php
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133288243112545732" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 2116 chrome.exe 2116 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 5056 4564 chrome.exe 83 PID 4564 wrote to memory of 5056 4564 chrome.exe 83 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3196 4564 chrome.exe 84 PID 4564 wrote to memory of 3632 4564 chrome.exe 85 PID 4564 wrote to memory of 3632 4564 chrome.exe 85 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86 PID 4564 wrote to memory of 4284 4564 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://77.73.134.27/n9kdjc3xSf/index.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1e549758,0x7ffb1e549768,0x7ffb1e5497782⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:22⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:82⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:82⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:12⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:12⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4496 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:82⤵PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:82⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:82⤵PID:896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:82⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=836 --field-trial-handle=1780,i,932232793264923246,12413829952326236279,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5129ef8ce108e0dc98a442fd64f8f7e03
SHA1222ec71f128f36f2f31e269d01c1d5f0542b9898
SHA2564b7fb2ea0d2d0a1cba5eb29eaa66ca01510e384bba93ea7e15c02659f3125326
SHA5122769d544669c4a7bee6aac4137d8239ef312f2c81803865b765f611b777a95b8dc7e92b2bf70c67d702d86ecb27b532da1d03c377ff56ff460a93004af32c4e8
-
Filesize
6KB
MD53908baffaa3049de3793ae6e36e11126
SHA11d1f693ab1f900e140c435b9cc1f93237e5effc7
SHA256530c918606d9421cd18ba8f85aa757735c092c8e226ff237e015c5c62aa216ab
SHA512c5dc33c7e44037f09da9640f9defdf6402844c4876eb1f0d2b5374626f78d522c7df9ce626b127754abfc2f07cb8c9f79f8a8490f52ff0946557bb38de53dc5e
-
Filesize
6KB
MD5aad45750029136b070b0a51d083f18da
SHA135b8f47d926b2f83359f19f7bd52e0734b82aaae
SHA25634d3c9a629adb9e53281cc9ac26a5cf6f69a0567e08847da7afdfe97e19ef7ba
SHA5127c0cee40139c4e4d4a2b98161339f02cf786ca4e29d71a5818c5715543410231248290c1b2ed8ac3ee9ed7771612b8cc6e95e0d073735342f7fed689973325cb
-
Filesize
15KB
MD576d43ec4dc9cb824a38caacc0372c598
SHA1ad62b481e74629f2140ae519cc20f4e2e66c60d9
SHA2565d55915d580df61c8c877686e3639c85c921c10901001ff778493a249715e25b
SHA5127e62739d789b31d585f2df8e7ffd4109559b54370227fb5bb17fccece33cb9e66075fc6f6823d8272a7df8c6807c34343e5fc86a4f9120f836573d4ad18d895e
-
Filesize
72KB
MD5546a1d947386d60e96b457d427d3236a
SHA17471f99f094b837d89e37a3363c16ba838b75e32
SHA256d4b3ec0d9756165ff31c45fec214d5dc4d802e675a37b7e0e2c80a237487a2eb
SHA512947ecb6a6547a03767cdf2acba5a07d7ac6e11466d45264137b0138b04ee36d0b72a5a4d273c9fe7c9cfd0f00279f41c07b14e61fb60a3ca99be31c7cf9bfc90
-
Filesize
153KB
MD51200135160bef2bb52a85bdfd9c8518b
SHA1dad1be59038246b909b73b2782d99ba03b5f91e3
SHA2564e48af8b2da40b35e04844d8bb6824b0437cb47d98f7d68c95852759be16db82
SHA51269b91aa79f8da0cc95f505c278799aba4ef9eee7a296aa7c7d3721960bd000b67f74c10a7226f196ce28ea69c92e7f65945b226aad19a0906b0be921bba0f349
-
Filesize
152KB
MD5895880e47a5713fa82c435056787ed1b
SHA1b159b94dd02c44a0261e1d499188e75cd7cf648f
SHA2562e5386ad998cd6771fab2c4adaa05ea1b7feb412492157a6759f9474718691e9
SHA512cd4f6a4e577900fa330d268f971cb77bf793b8d92233b254c0ff55515af976c94fbd24a25048c4402e254749d370749c5f4880eda5923b307a459979b6d3a104
-
Filesize
153KB
MD5a8ee0f43f49e90200b66beed78a26cf9
SHA1c5f8e532fc1404a7540a965c9398144745798e69
SHA2563665817a7e3538ede411e06e29f935752edd82609c9d2d6c8d9596e566ba4b7c
SHA5120b2cb45f5a776f7915d66f022b94e316e8b3aad54fd396090514ab28036ec5c30e86e7b93dd2beea96d170723d693274dcf677960a787798f068abe40af3d212
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd