Analysis
-
max time kernel
60s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2023 17:14
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://4jn.4748493.gabrielgouveia.ca/ti.com/YmVuQGRvdmVyLmNvbQ==
Resource
win10v2004-20230220-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
http://4jn.4748493.gabrielgouveia.ca/ti.com/YmVuQGRvdmVyLmNvbQ==
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133293428614035130" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5040 chrome.exe 5040 chrome.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found 668 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe Token: SeShutdownPrivilege 5040 chrome.exe Token: SeCreatePagefilePrivilege 5040 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe 5040 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 4936 5040 chrome.exe 83 PID 5040 wrote to memory of 4936 5040 chrome.exe 83 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 1256 5040 chrome.exe 84 PID 5040 wrote to memory of 640 5040 chrome.exe 85 PID 5040 wrote to memory of 640 5040 chrome.exe 85 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86 PID 5040 wrote to memory of 1100 5040 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://4jn.4748493.gabrielgouveia.ca/ti.com/YmVuQGRvdmVyLmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcaaf9758,0x7ffbcaaf9768,0x7ffbcaaf97782⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:22⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:82⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:82⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:12⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:12⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4524 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:12⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3268 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:12⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:82⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3352 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:82⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:82⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 --field-trial-handle=1796,i,7591023132311250888,8104909767997002258,131072 /prefetch:82⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a32d3fb-0832-4789-adda-3b47a00244a0.tmp
Filesize15KB
MD5711a299a88c067e0f101a9e2d0827d2d
SHA11c00b0e7b73b077b1c93ff0bc7759d1b0e24298f
SHA25608886a23c104e2a3841c6d92b99f076acbb74fcc60b08b5f9ba7844580bbdb8c
SHA512bb831cf79edacef6c157312324ac4206b72dda89f3faa29803d554d662ca25df3f5ca05652510a72ff4875dcf3b9434651ed6333c8db0674b07ef6bbadb4060b
-
Filesize
96B
MD53014f95bfd05ff4020268568f4731420
SHA1e39afc4593b3df06a38e411f34fc6251b846aaa4
SHA256c704100acab31a415b185fcc01b639d4b3f44249abf8556716c64eacbe78b822
SHA512c3d372d022cee6defb64ee53ab243266ca0122dc356ea33cfac5a664dede7d1f5601852d521fa911764fc2dab78ef1807d757de54f465a0f51e262a941b10296
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2395d6f6-7ae6-4c50-b5a3-5cd26971a078.tmp
Filesize1KB
MD516a96b133f97fc2c09f1e56051ab7c39
SHA19af7442400c313aa679bd06ba24334a348f7a763
SHA25688ed084d4e7a51b0bb1982e93bfec6542b5ca0ebdd6a32f08abc7b2f1614cf0d
SHA51257904f978bd69782f76f6548965f8e5db6c39ed27381715dcc23ca7e201f12ab0bff4fbdb29d045b8db13d113be7b695e8974ed15f86edea1ff6d9d15c9a3dfe
-
Filesize
1KB
MD51c35db7ca3386c2e1cbc47d6c0c6ad09
SHA1aa5d5b7dc13f7aef046c4126c63c5c6160bde418
SHA25633ddecf492f400ce1cd467d030a1a1b652a8bca57245ff460115ac38b472b651
SHA512da204334fbd0ce5cff242d8d44d49524588d5b1863f2fe7089911718829c05b2a84d88380a53a2230fde608128c057c18421f4d310072eaa9189e7b0cbbdb5ac
-
Filesize
872B
MD531be76584d77aa61b5108113d66072ad
SHA1b954cc6ab4cbbebe4751c6263df7e7449c712943
SHA2566607f6b1972a90a77c552c80ec6179a4724918dff3e412e8dce5a1d16f82c003
SHA5122d0efd18fb3db64928a0edde23e28673d8be25060f47f67dd2f4e4b3b25b2d8ddee6e4cc8a8cfcf21425e7fbea0c1a0bb7afa46378bc9868833e9fea567a23f5
-
Filesize
6KB
MD52aaffb2907e2bbbbacea6c606428f2d0
SHA13fd11f710e7c93f0381193e291cf415387321b03
SHA256bee3e704a8f87c326a2724f66ff9084a228eb9390acfb3d787bb180030b66927
SHA5128829d9e2eb7076cd7be831c2b04f1591eabc0a8ce6bbd2c84fc1ebaebcc1e02bf181cfbeeb5a612e15ee5173e02483d296245d182047ebb01cf8aada010616db
-
Filesize
152KB
MD5b280cf8c0bac8343cce24327ec12aae4
SHA1d809ffd4a247e1966d7e0daed17b731d79fa8a75
SHA25677f58e11316a61baab788f03033ebe55ebca49f20e08440c529264d861721b1c
SHA512ac39d00ab2d9eab90b836ad1c28f005928de7eec22d77bfb361caa9301ba58f9fbfb0129523667aec829c118066fcc909568f938192d528f1b28550c6c4ff3ab
-
Filesize
103KB
MD5afee7713bac563e80c575488c2736d4f
SHA16109dc7a20a750f06af2c8cc899aae2448e2dd00
SHA256126580fa596881ae04713481a71b7fab54aa9d7e132b65955ab0e03c9c4bc4d6
SHA5129df200a9439dbc2206e64f8e0b78f4abbfaf0d02d68d83976351ec0758449af363ed2337e028a108046d7735f9f721b6af2c20bacd3f88e46cc572a4f608dcb6
-
Filesize
100KB
MD53079fa0b73fd8e8125626e014261bbae
SHA133d634deb27954a717689b961e4d1fa0b19e565d
SHA25657c4286b94ada2abb7fb1204561f9de8d676fc2db23b7eefb8547f0b5d7e5987
SHA51288f8764ed60c6c0fef222904a4dc6be89f072ee48418e6794a98a7eeb74c8b8855465cf0d8d90c9e687eb1b79de17e4110d4f7491310afb2d8f74afd7559b389