Analysis
- max time kernel
26s - max time network
26s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
22/05/2023, 12:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://nintendo.com/CI0/01000188073823f2-335e330c-85d2-470b-ad5e-8d09ebb395c3-000000/IFeWLBY8as76iN68CReS7X4m0p9vPXXnXtYUfXEo8PA=300
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target http://nintendo.com/CI0/01000188073823f2-335e330c-85d2-470b-ad5e-8d09ebb395c3-000000/IFeWLBY8as76iN68CReS7X4m0p9vPXXnXtYUfXEo8PA=300
- Sample230522-plgaasbb4y
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133292391112892876" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe Token: SeShutdownPrivilege 1152 chrome.exe Token: SeCreatePagefilePrivilege 1152 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1704 1152 chrome.exe 83 PID 1152 wrote to memory of 1704 1152 chrome.exe 83 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3248 1152 chrome.exe 84 PID 1152 wrote to memory of 3924 1152 chrome.exe 85 PID 1152 wrote to memory of 3924 1152 chrome.exe 85 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86 PID 1152 wrote to memory of 1812 1152 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://nintendo.com/CI0/01000188073823f2-335e330c-85d2-470b-ad5e-8d09ebb395c3-000000/IFeWLBY8as76iN68CReS7X4m0p9vPXXnXtYUfXEo8PA=3001⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd44349758,0x7ffd44349768,0x7ffd443497782⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:22⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:82⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:82⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:12⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:12⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4504 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:12⤵PID:3888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3412 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:12⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5544 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:82⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:82⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=1784,i,9869910636571016035,13499947676431073909,131072 /prefetch:82⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4448
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 3KB
- SHA256 8176604e69f647a21df99f6136be9b2a567b0bdfcda7312f4951a7641950667d
- MD5 c68f671379ad31dd7e4bb96e46b5c0de
- SHA1 1fd575da6069e05238bef64b0361077e2958d897
- SHA512 afcb763896ff0b12e3909a751b3a056a51c34dbc84d6efda1c92e682bd628fa535734d6b2d25b0972ca70374cc255f8cafeeb7ec48e279e534d2919a0ce8ced0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 3KB
- SHA256 007398c04199c0bc6cb702ff035559312e3382def9c453b3bad79594d7528b10
- MD5 c38fc37fddf2e5aa9574cd2f447d8638
- SHA1 aaf63593398d3267deddd04a749799a230430618
- SHA512 bb02a8083ac037d84dda30fd1abf37199127d8b8491f0d5b0e39462cb70067d4925470e00633439787e9fe83d07429957a2de4a26274dc85710cd8b01dc9a8ea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 f3ee72f99d5ab7811829fc6363ea85116c31f180ebcde41926e3b487c00d67a9
- MD5 9465c8967b918dfec78429c1609e75b6
- SHA1 aafce6831eecaf693ce3042e150992efb2cc98c7
- SHA512 7c4dd83d9fb20cf0aaeab78d2ca300e7ff0f63a48dbc2f70046def979cce0ca38f53e6264048ce7301542a79b9e6ec05468e2e13fea9a77467957600474edcd2
- SSDEEP 96:wABSXaqk3KI4Ayy8iZRy7Di+6Msmde9km1fQOtCa+jVhYtjEsXt0/cg2Vup:wiS83pV8syy+F2km5t+otjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 5074f15487907538e2ed842156cb700956212ba07e2e03fb821bfbb6c644b456
- MD5 33d98e68f95b68ca7db6ff6501e4a06a
- SHA1 8ad5827ac9f7cc1efdc345b5d881228237264ea9
- SHA512 e539de3f0002a4288284c912fd297372b4f581d9f570b22d11dddafb2ca1b6f66fe368689e6d74a91e5c9197ff97635038841388661a13ee87e3ad6c776be96f
- SSDEEP 384:BzLALPqXp1kXqKf/pUZNCgVLH2HfkErUuHGqBTS4+NG:JLALAp1kXqKf/pUZNCgVLH2HfLrUeGqf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 72KB
- SHA256 5348d1127968cfec993ce9e532a12d260dc2bc4390345566a03013184f9d754b
- MD5 8fae6e6a6d497bb1124a97f2cab83e91
- SHA1 e8f5b6ab956cd6e354f11e45f7ddad072581bdb4
- SHA512 a2371160f996343a3811aec8b9dafa5090b890bf1215472d7b645271dd8b2dc6f21a898ef5d87aa643254b5d7b12d7cd586ebac6b649d04e75fe88755a5f2042
- SSDEEP 1536:7t428rYk/Q/OccbxYiWU/vXyVOlgZiHGOM7nF+ABbauqzgW:7GH/Q/6Zp/viVwg0GOM7VzW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 153KB
- SHA256 0d0bd5fae2a143c928ebb46f02d3ff2bd3798af4780e4d314a3b6d561f84b9bc
- MD5 1a0886a4e5a4bb2abaf7dd3375228fce
- SHA1 6d9694c158f3337684f4646e6650f5f24bc9e09d
- SHA512 d0aa5dc6759241431a37b5ea2b5899e83dbe95ec6c09d4299986aec47d3da9d99fcf1d07f9d8db9e226eede635a3aba29388a7e211f036f60ed0ca4445c3bbc9
- SSDEEP 3072:6DRPI9vPTl8FHGxIytp/3+tUH/Q/6Zp/viVwg0GOM7Vzr:60PTmHGiytZ3+tU4/S/viVLjhH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512