Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2023 09:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://1xdll6.sewep.cc/34546de4235m342356
Resource
win10v2004-20230220-en
General
-
Target
http://1xdll6.sewep.cc/34546de4235m342356
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133292279575063751" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 5104 chrome.exe 5104 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4628 chrome.exe 4628 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe Token: SeShutdownPrivilege 4628 chrome.exe Token: SeCreatePagefilePrivilege 4628 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe 4628 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4628 wrote to memory of 4500 4628 chrome.exe 87 PID 4628 wrote to memory of 4500 4628 chrome.exe 87 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 1420 4628 chrome.exe 89 PID 4628 wrote to memory of 4172 4628 chrome.exe 90 PID 4628 wrote to memory of 4172 4628 chrome.exe 90 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91 PID 4628 wrote to memory of 2288 4628 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://1xdll6.sewep.cc/34546de4235m3423561⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7e6f9758,0x7ffa7e6f9768,0x7ffa7e6f97782⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:22⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:82⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:82⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:12⤵PID:1684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:12⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:82⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:82⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:82⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:82⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:82⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 --field-trial-handle=1832,i,18088197808927583421,15962923783825254253,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
954B
MD5d6d88bddf985c7eba0b588c85f12f62c
SHA135170d83a0076dd835c4fd17f5c585ea38625c18
SHA2560e7fc72f095bf3878c071a76e3933d20acc8bf9b40e305eadcb6948975d50575
SHA5122c8e1c288eb3019fcf6ce0081d186526c7c06251d186a94751fdd0c7b53fa45de48e8eaa36855d2e8beaf313154104775c0e1a52feee1e3ccaf53d7166d846d1
-
Filesize
539B
MD5c8b72e410b30a656074a496086525eb8
SHA108c43ff4086215559033f20a71f185b8e8b235b5
SHA25606395e10f788ee1bec9f0f0076d5b15ca58d4ee76079ec123d9dffd280561eef
SHA512e82b199d4a91fd3eb96e308e1cacd892b979598ebf0988396a69b3ada8875c1104f7a24a7d5e160043dc11bc562ac49a243c507a37791cb7b916c4a950d24285
-
Filesize
6KB
MD5f624ef46deb617cb226d3c4f5c090f9b
SHA176bfac6d9fffdebac052983d3093e9b803e11965
SHA256978d358d2ab6bd0e09b91eab4a7ce1dac6bf3d92a25c56a6722a638b9d5bb983
SHA512470d171625d38be33960a6411613d9434f7783e2188c680d588a35bfed6140ed258978c7ba55479b506d2fdeff12160ddb415d6a5510fdba3c3644b26f5eacb4
-
Filesize
15KB
MD50541cf899ff303b3f029362dd2dabc9e
SHA16d85ae6a1a2080f23f1a0ea194659764e6d3fb09
SHA256fb109f67518c90f3d61ddca545c776bc326191108a89b76fedf8d260d4c63d6c
SHA5122b54f7a9449e2fb02556da30cbf5c917bcae2a5f98ac099f4bf754c6fc73c66bf2d5c627c922193e4194c0d276684ef8f809c69e0957e53b94f1b302e0e39518
-
Filesize
153KB
MD57d8f1461522f4a5e554fe5c8997ec635
SHA1309f94343244c23b29d490000239814d3f973471
SHA256e163621f170f2cb3c3d388134e3b0101d34dc16f6d3ce313035821f9dc22cec4
SHA512bd2deee260ae70b8b3fc7f479a0ef832b36c2e30bc01dfd67854ffd98bf826b28cbd36afa0954ec2118e9b071473753881a09b2f9a5a51e89230fd9cec576d4c
-
Filesize
72KB
MD5a969201483796cfa96f0c5c197278126
SHA1eefd9f13f5bf95ad9e4bdbc4dfb414bacc2bd440
SHA2569e3f83adde1271af99e22fcd0d7708d4b78908a53e521a3c0bf69b026cd04815
SHA5125695594a89f5b78ce7ece2bf688ac540a26dd8830db55d90a4bd6be2a13039687d84681524c4e184f76361f793127a1f6e5db680a1292c86e515255d8adf15fb
-
Filesize
153KB
MD53cd125078cb633476f30097b6f6807bd
SHA1eb4f5dcef01ad6d23366d82cbb3666ce7a27c635
SHA2566ddda6792be0666006d464f5630bf498e703d5db7672656e17fc7d806a5eaff3
SHA5122c328c8d5e945d1c097984ee76e2a3056699822a3d6daff34cf95cb84b6ca8da6ac039d2e00aafc138498509251373fce17fbf3370fd025c365cb1690c54a395
-
Filesize
154KB
MD5c4b029b203b6ac097c3940e15283cc83
SHA11770d982d0a2b2b3c83b2f309924a972c20d8cf2
SHA2563987c98e1ade8d54f5b0696c8da41b6bbb08998f6f58371e18f0d529daf7650e
SHA51213cdda5bbe884bf000f59bc4defdc6e2f31f7f1e02417669d60a0e36b4df70ab6f71c78065d1e247f60eee8f8014cb9e840baa0fb14347b70b2c641a59fc5838
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd