Analysis
-
max time kernel
300s -
max time network
283s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2023 13:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://yyyyyyy.info/
Resource
win10v2004-20230621-en
General
-
Target
https://yyyyyyy.info/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133324341346101227" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1916 chrome.exe 1916 chrome.exe 3600 chrome.exe 3600 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1680 1916 chrome.exe 83 PID 1916 wrote to memory of 1680 1916 chrome.exe 83 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 3236 1916 chrome.exe 84 PID 1916 wrote to memory of 2728 1916 chrome.exe 85 PID 1916 wrote to memory of 2728 1916 chrome.exe 85 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86 PID 1916 wrote to memory of 2904 1916 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://yyyyyyy.info/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff17f39758,0x7fff17f39768,0x7fff17f397782⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:22⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:82⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:82⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:12⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:12⤵PID:3232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:12⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5328 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:12⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5256 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:12⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5744 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:82⤵PID:1984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:82⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:82⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2828 --field-trial-handle=1812,i,1991900150114701835,11184188318710157736,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3136
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5843f1bfd89c791ab03594684976f9cd8
SHA1c21dcbc31bc1f7949e68b4611dd52cdec66b0e36
SHA256441bfc4ae20dbeddce6ef652b0eb7f8c1521e32536031632a9338edd7b2bca3e
SHA512cedb7d6572a1521f319259df55c54d37b153ad2ad7783bc235cd72eb345fb7025f186c9a63a0ab78759df8d93226a0226030ccccfb086fcc1ece2327374746fa
-
Filesize
3KB
MD52c0becf2f3a03e3bb4d236eb98ed85ff
SHA108d553655e38c04bd005cd42c32571fdcf6afa8d
SHA2567d89dc433dc8c0ffc5c4ce3163f83885740f416bc51516f28cc646f7c13b43d0
SHA512665a73391f815dd70a7921bc51f9165d431ed4cb69514c124c103b6572177ec27e5a046d4d82d9aa877faea4ca70c6afb2ce4848742ddd4c5c88a970995dce74
-
Filesize
3KB
MD56c12d5af5d3e943e3da97c1ba3c389fd
SHA119d3d8a762156e4799596467f9af2d5dc3da22aa
SHA256a92024c0af8c79cc05c75ed4890739ae716979b1e3fb4f45da1058b7ea2983e7
SHA5123e5c54f888e3a83ed1d9c3fd352ced317a76df2221026731974fbccd6712c5b6629303e6b09af47b8a8e8d9683e14dc5445ea5ea140b0132c28a49c1e1552fd7
-
Filesize
6KB
MD5c5de31d3f4d5ca32aa939682e71917a6
SHA1d4773c23813381af50d1030f41354e536b2b48d9
SHA256fa0b276dfcf8a3a4fabbda2a13e0412a66af9d619ed2cb821fcbfb18bf31d3b6
SHA512f880e23780263fe079b1ff9e0c190be24c10e5257798b8f4620a74f39bdda5ab3d37d88e606631af3f8b07e9b47a679409dd74b3d91a4ca5207045a6ddc3f880
-
Filesize
15KB
MD5eb97a584f11a7b078084c526f048604b
SHA1c26e28b2e3ad7886f631abf3a062b9cfbfb968e4
SHA256bd4809fe982c4df275dc2e5603da9bce922d3bd66d0a4badba92899658ac8f8f
SHA5123708a50a0b07882378ae35a5d0e12a9467bed79be1058d75805074b74a9f1ca530e1efda1b6860973f21d215418e2144c9d5ab24d097d8fa1293e26118509545
-
Filesize
15KB
MD58834d01d3265abf973d949ac21df27ea
SHA19a1fc9c26b3435333bc75b99ce1ad6b3abca5e00
SHA256e12f8e8d48ae696b30809d9c884db7b27c76001b0884231f805ec2280db34365
SHA512a7729e98dd7e5da75dec67812d81874d9721a4fe8bdf4f982ac3b1c2edf4cb96fb1b182a4fbfb5eb52c965d2c2ea38cbb715b7a7cfd09c1164d7cf2267138a13
-
Filesize
174KB
MD5e82471cc6aa79b1766aebf6df8f83e85
SHA1be9384c54674dcb71debeb0e6fac4dd3bb748767
SHA256cb4f89888a9f5d93bb789832f7c4c4ab03c9aa77d7af6c8bf8bde1007f2f6ddd
SHA5120eb05f6c68a891fa05d0533730f233ed1d4212621fd188cb70c64727332f885fe066be444d034b65ac883bf87fee0c0a1c23cae46dee540c795c9b918211023d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd