Resubmissions
24/05/2023, 05:27
230524-f5qteaah26 3Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2023, 05:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://profocus.sensehq.com/survey/bda00d25-6aef-489f-9152-10ee80c9298a?module_id=2546552055991668856&module_value=New+Lead
Resource
win10v2004-20230220-en
General
-
Target
https://profocus.sensehq.com/survey/bda00d25-6aef-489f-9152-10ee80c9298a?module_id=2546552055991668856&module_value=New+Lead
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1912 2196 WerFault.exe 84 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133293868733216579" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2912 chrome.exe 2912 chrome.exe 1980 chrome.exe 1980 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe Token: SeShutdownPrivilege 2912 chrome.exe Token: SeCreatePagefilePrivilege 2912 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe 2912 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 4708 2912 chrome.exe 83 PID 2912 wrote to memory of 4708 2912 chrome.exe 83 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 4196 2912 chrome.exe 85 PID 2912 wrote to memory of 1336 2912 chrome.exe 86 PID 2912 wrote to memory of 1336 2912 chrome.exe 86 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87 PID 2912 wrote to memory of 3788 2912 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://profocus.sensehq.com/survey/bda00d25-6aef-489f-9152-10ee80c9298a?module_id=2546552055991668856&module_value=New+Lead1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc209758,0x7ffcfc209768,0x7ffcfc2097782⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:22⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:82⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:82⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:12⤵PID:3820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3320 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:12⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4908 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:12⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5456 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:82⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:82⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:82⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3672 --field-trial-handle=1812,i,18189865451932269954,3687518704373518269,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1980
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4568
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 472 -p 2196 -ip 21961⤵PID:1216
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2196 -s 14721⤵
- Program crash
PID:1912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD508f3851748975142ef7c08a8ea1ce61d
SHA131ffb52b4d2e4263a2b5a19195ee1784bc884a15
SHA256e374d418c7975a482356a79e25f0722ab71616be443cb19d96ef88706937bf30
SHA512d4b86e69582cf1bc33991cd44eb1db26eff3013dcc7ed34d8b7d890be510ef3949a50332e732c22182a8fcbba418c6ba18aa031a6f0b5b621ea2211e665af3f7
-
Filesize
192B
MD565683b23c9c4147b707a93bab3ea2aaf
SHA1bec640284ebd1680e9f0c4c3419e59166f1b6435
SHA256ba969aeef91559546e9c963c0c5e8d8ca4e23f8a286966405c7291c79dd9ef68
SHA512606348172a1d7d0fc4bb0bb02c2399f989d1469e0fbba8e8063987b339839b33283dafbe423acbc7f32ec3b38631c614c52416ba2d8a148bddd41b0a76be4533
-
Filesize
2KB
MD5e6944e39e57da0689051f6f4b456bede
SHA1db7736e0bf61ca4ff5e5d0dd84accf87cd803176
SHA256be41a1ce105df7a1fdde612f8cecd4958fad3c10a2d8957f3693b3545c8eb21b
SHA51226e1b1e1ed5c8b0698c16310428df0266aa3f61aa80618b792f6b53d0d69cba114c7e5ba2ef43342fc8a4cb13c5d12cda1d1096ddf8cce88cf58b1987eabe6dd
-
Filesize
1KB
MD5f2e62931872fc85f8e69944fc21ef7f4
SHA18c3f2412cef071afe29bb36b9831d2a4e712284b
SHA2562954c1c06f73f88f030e84b98ea832819f601c06d97a64af48d4c159d39f81cb
SHA5123f17d68763a612bb6dee60e9f4eda80410219b7ecbca0f8755916a044be01bf1b3142463070f11670eaf510d55a465fea750ddcd0e85efe323ec4d5795ac7db2
-
Filesize
6KB
MD546567f2bb4fc11f938ad85f4086e8e08
SHA14868c9952a5c01f7aea6532d2c0b310c6ab0960b
SHA25677a31604fb04d0e1e46dfa9ff8f88929a700c205aab44150d64ee8757829dfad
SHA51231a9740cf75989da3e19be4698b296c7580d07dadc5352475b9cacce570b1445a594f7ed07d4e23c3dc0aa8c68c1bb4796ffdac2ad9671772cc869f836ab79aa
-
Filesize
15KB
MD515a042bba062d4cd1ca7663c9efb309b
SHA149584df6b79b27ad2ebc6bd1e97d336a5454ac4e
SHA2566b72f522364bae65ae2dd385ced0075cde6aef66e428d7bd5c89c528aa9a41d3
SHA51290abd7639c6d18770347490cea8066066c267098c46d94939482abd0e231aa50ce0b208ed99a4b5c332a624d28346e62852b2743432cbce911bb61fd0b9e9ac8
-
Filesize
152KB
MD593ed7e314c3f4abdd238055376544ac0
SHA1ba477e871e0510c1f32b9fa20b1ba7c2041f476b
SHA256833c5f4cd62ff28c476314c9f87c60bef8c143b65a5ea641425acc4cde241dc5
SHA51257715e49709a7776000fc339e4aac591cbc6b69d5e28aa482290fd288f385ee1f4fe43944432407ccf4c4223b7419e3c2be739eeb4d4277f1ae81a5979bedc4d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd