Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2023, 17:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://slickdeals.net/?adobeRef=3419c106dd6341edbcf19341010a0a01ff0190&sdtid=34519596&sdpid=102196346&sdfid=34&lno=3&trd=https%20go%20195a%2019%20t%20com%20&pv=&au=&u2=http://2547606.automotrizvip.com/al/cnlhbi5tY2Nvbm5lbGxAa2FudGFyLmNvbQ==
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://slickdeals.net/?adobeRef=3419c106dd6341edbcf19341010a0a01ff0190&sdtid=34519596&sdpid=102196346&sdfid=34&lno=3&trd=https%20go%20195a%2019%20t%20com%20&pv=&au=&u2=http://2547606.automotrizvip.com/al/cnlhbi5tY2Nvbm5lbGxAa2FudGFyLmNvbQ==
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133302021478933368" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4648 chrome.exe 4648 chrome.exe 3496 chrome.exe 3496 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 1696 4648 chrome.exe 84 PID 4648 wrote to memory of 1696 4648 chrome.exe 84 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 1500 4648 chrome.exe 85 PID 4648 wrote to memory of 3964 4648 chrome.exe 86 PID 4648 wrote to memory of 3964 4648 chrome.exe 86 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87 PID 4648 wrote to memory of 3852 4648 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://slickdeals.net/?adobeRef=3419c106dd6341edbcf19341010a0a01ff0190&sdtid=34519596&sdpid=102196346&sdfid=34&lno=3&trd=https%20go%20195a%2019%20t%20com%20&pv=&au=&u2=http://2547606.automotrizvip.com/al/cnlhbi5tY2Nvbm5lbGxAa2FudGFyLmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81e3b9758,0x7ff81e3b9768,0x7ff81e3b97782⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:22⤵PID:1500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:82⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:82⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3216 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:12⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3244 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:12⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4588 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:12⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4732 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:12⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5072 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:12⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5076 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:12⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:82⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:82⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 --field-trial-handle=1820,i,2280093824141969959,10579912520995187809,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5662e744772e6694685cd07099c75df76
SHA1393cd0320dfa6701cbf06e6e059a7264d747014b
SHA256ab2093230eea684a0e306c72c72aca4f6ced5a463f2482af32ae2576f720ff5d
SHA5125cd7ee936a67e256e0ffa72180fc45bfac70add275e7dd5050b24cedc262e4f71b1bf4857b1215d0fbd39de5f4168b48f211e633056750f8436becc67db0c89e
-
Filesize
1KB
MD56053a70930b5002c374d7bb7649ef18c
SHA1480337ad2e1183cab132c93a44ffac9f5d0fc2c5
SHA2560d69b075bd71d50a798b85b23c1101afd1b6489499b16e62ffebd8357fc489e5
SHA512e93ffc9e2a7ee8f7d94f99d37a0ad18813ba1a0f463e1b58a82c52efe1274506756e8e69ea84dc55ef9cc83b8665e8d09b137e2b189f4fc2a9f993094e9300d8
-
Filesize
1KB
MD5abe5bb15437f0e53e3b77797a93c1e35
SHA1d4b2ccdb1ed79dc147d617fadd47376ff05daf3b
SHA256d432cfd1e36249b793a1eb36085793de1f5abe5d584889f4b37bdd0c32bb21d1
SHA5125881fd9830101747cd2fe5e1e3eb72bd5092117e362ee3f13584dade1a34848fb5724430b2f0c3a3d30f6135eec8b773796509b64fabcce872028e151a59d321
-
Filesize
5KB
MD54b233d5634e0e170c1230665cb7b838d
SHA1bc014bf47fe95a96cf7f788f6cdb49c7561f3842
SHA256da61037320d09dc05ef07da4d17b6f106955e098d85762b664b69462b5a8a829
SHA512083c12e54987d8074eb5b791217423fcf8b239e2638c298de9cfc0f050ada955d74cbba1d11e2602ef2768aeb9bd257c782406521df379b0ea22b1f1e4833508
-
Filesize
5KB
MD569d90cda4c23f89e403afec26de05b01
SHA104ff4e2f3c33f7374e77c34b3fb12a200421235a
SHA256d4ea4f9144e15d5695aca5c02f06e876b37375830208b337ecd0ae7a9f8f4a30
SHA512beea642c2ed53863a46809d4fc008b10f6017a56ebcb4f2ba078e87c31842465d24bc18599f96b9ddb4c9183b9d8d1dbbdc42c4df70158003e6006be15dc5b7f
-
Filesize
158KB
MD59c1fa7af9ff68d9679c054a2816bd5d2
SHA1fa6308534a37f13dc54aeda7378841823625dcc7
SHA256e4e2a1105fbdd220647b5a6eb68f589a7bf9a4bc4f11166b0e941dca414f6633
SHA5122c7e6806702e194e8b381d777b8096e8047f4dea639caef4ace9d4abaded4ae56cd4ee9b2550159c689e4c01bc8b434996641064338eb0f7c548b765a2510c5c