Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2023 11:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://458rl1jp.r.us-east-1.awstrack.me/I0/0100018869531ffb-77798b71-ffdc-48c1-b358-a58d35c2e6fd-000000/w0Z3R95KMkYCw60lwaSObw1Mn54=323
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://458rl1jp.r.us-east-1.awstrack.me/I0/0100018869531ffb-77798b71-ffdc-48c1-b358-a58d35c2e6fd-000000/w0Z3R95KMkYCw60lwaSObw1Mn54=323
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133300054222925939" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 4224 chrome.exe 4224 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4136 wrote to memory of 4216 4136 chrome.exe 84 PID 4136 wrote to memory of 4216 4136 chrome.exe 84 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 3464 4136 chrome.exe 85 PID 4136 wrote to memory of 1120 4136 chrome.exe 86 PID 4136 wrote to memory of 1120 4136 chrome.exe 86 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87 PID 4136 wrote to memory of 228 4136 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://458rl1jp.r.us-east-1.awstrack.me/I0/0100018869531ffb-77798b71-ffdc-48c1-b358-a58d35c2e6fd-000000/w0Z3R95KMkYCw60lwaSObw1Mn54=3231⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade449758,0x7ffade449768,0x7ffade4497782⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1812,i,13223290043503555097,10613808571062935231,131072 /prefetch:22⤵PID:3464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1812,i,13223290043503555097,10613808571062935231,131072 /prefetch:82⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1812,i,13223290043503555097,10613808571062935231,131072 /prefetch:82⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1812,i,13223290043503555097,10613808571062935231,131072 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1812,i,13223290043503555097,10613808571062935231,131072 /prefetch:12⤵PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1812,i,13223290043503555097,10613808571062935231,131072 /prefetch:82⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1812,i,13223290043503555097,10613808571062935231,131072 /prefetch:82⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 --field-trial-handle=1812,i,13223290043503555097,10613808571062935231,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD538a7dc46da5a0f87ef091c2c44aa578a
SHA15174ebf5348ea860dcb8e4e2adc96b88fbf01fbc
SHA256f7102dcadc5ebbbf5965accea6d5d14f3160f2d7582dbffb80bc3284aefa67d0
SHA5123f67e5f1c46c03cd89da4ed830fbb60184ddffa21ed247286972b86a2e4713c22e658caf3d77ecdc8c6acca647d2e7dc0026df4238879c2a4af5cefd300bc4ba
-
Filesize
6KB
MD531b59afc12be8d5d929bca1890c5a3bc
SHA191c860434425041f1b3b76dd8e7950e749efc6b7
SHA256ad83d8e459e858f1ee4a1c389d25124a6fd3ba956c54d7ad3d4518ab3daafb95
SHA51237dec039772c9ea595ff1bdc0c61843a675d51a988964b0c98fc8f956f1d39a75f2b35b3154d3f1a9d40cb2726d14ae957c96998400d620649249fc1af7fef8a
-
Filesize
5KB
MD54adafdb3f642ac26bbdb1039591ef49c
SHA1973d1b5ab143cdd6787851cfe931441ece4a5cfe
SHA2565eb945fd8a08b2d0ce7ccf2abe7f079f18462135c5df3b08cffb538bc6260474
SHA51254b422c6c45f0a1a8c85341dcfff39d7b3c9a775318da5dddf79545eaa9d7562c8969d1d86d3a5cc64fa1906d851c32b548c829e0d1415c9a28748a04e7523db
-
Filesize
154KB
MD5c3cc3a36017c483d7f655e500bd5c1c5
SHA17c796c78fee2fb8bcb1638b062e9b0d2b6d67898
SHA256c2bd2b527021f4f29629cd0c32c5bbd358b75a453bcf7437aeb24091f50ce42b
SHA512bf046991530065393818b6732a493ec3ef9771e3ba8db01919d7d702ba25cb793301aaffe7872dd6382ee47e7bd888b5b53213234070b10ac5a35048888dab31
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd