Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2023, 14:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.thesimplifydaily.com/
Resource
win10v2004-20230621-en
General
-
Target
https://www.thesimplifydaily.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133324348277161531" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 2052 chrome.exe 2052 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe Token: SeShutdownPrivilege 4564 chrome.exe Token: SeCreatePagefilePrivilege 4564 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe 4564 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 2620 4564 chrome.exe 82 PID 4564 wrote to memory of 2620 4564 chrome.exe 82 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2176 4564 chrome.exe 83 PID 4564 wrote to memory of 2224 4564 chrome.exe 84 PID 4564 wrote to memory of 2224 4564 chrome.exe 84 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85 PID 4564 wrote to memory of 3396 4564 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.thesimplifydaily.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa99249758,0x7ffa99249768,0x7ffa992497782⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:22⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:82⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:82⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:12⤵PID:316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:12⤵PID:1800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:82⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:82⤵PID:1912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:82⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2820 --field-trial-handle=1832,i,11305926666275144020,2711350522544404870,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD53aee1a54eabeb8dd01d38b3d41de2db0
SHA12d575fdd2f15bea7809296c5156eb9fa81166f7f
SHA256b3314bba1bff88fff11732152310f97cfc6fbab5442fed8d50c544ea36bb94f6
SHA512ee4d0e804ec4042cb5c3ea475368181d7db7722587829a9243fcbf509faab98edcec9f72f93796c12b5b595a197952b78ff24c398c12ee4912a84730520add53
-
Filesize
2KB
MD5972f4598de6790d89d8b4e9e2564ddac
SHA133a8daa6cf05dc71145e1bc58d760f15b1d54fb3
SHA25652fd295464663dcdf3aa8f93b04f656f5f7459b3ae383cd211c75118f1787ba8
SHA51217df64ef54ba6adf0aa12a4f1a999780e783ab7deb971d4809035d5696b5cb15b6828aaadf18c0429c7ccb24995efec8e57496b16cfcf6967a2ef3833cb18836
-
Filesize
5KB
MD54f70d40caf8a27b916e63716c8600908
SHA174f3b3d51cc7cbfde035b67d2d437366672add2e
SHA256aaa53e59bf783045a93256ed126310574a0dfd07b7c8dea5ff501048257c430a
SHA51221655c8925b9c5c3304e59b1741ecbd273127728e38c7e9c94c4e506488b0df66740536c295b20a35457df393d7588ccf60bc3e9b519eadc081631c98262ab6e
-
Filesize
5KB
MD510575b6c53bdf3f9b85560c614af58d6
SHA1710bd86108948fbf07ab5c1fedeb69a060cfa147
SHA25609b37357f1e10f11632805a923c5a404d91780d9634c0e8f9ae336f129b8a4a3
SHA512cae8cedb9880f8496b21c0b1967aea208985f5b723f087bb266b3fce690ca4e74afba42992e301bae52fe68898471577e70b36694ae42aca0dba32f2cf64b05f
-
Filesize
5KB
MD5f5ec11a099cf4199d898daa180204dc6
SHA1e8630dcc0d8cbd2ed87faf24e0b71c6b66c0570d
SHA25609a2ab389fbfd9879b0c6e79f5fa8915bb6d89abe8af3a65b1f978ef14bc63d6
SHA512e2507cd09254156a430ab299062804e8e385cfb8d46b96de450d0976ecb54ab91cd4abdffb508873e1c5e06764fbd48b44df377e0426e8ccd7965bf05b318a48
-
Filesize
176KB
MD5df0641e6b0239935fdf6295d428afade
SHA1179fd2c4507b0eb023fed920d5896c7dd349994e
SHA256a4b4c2567834c5959c55fe454084d471e6e6682851a823769d9c492baf78e8d1
SHA512fed7ac911f0634e66b72d0a9de2fa02fc2c1e5dea178dc03209c9df1710000cb8dde9b7cd66d487de36e82c1d4450bc05898efd36833de8049be952aeb802e55
-
Filesize
88KB
MD5419ab3e69ee624f205a39f3bf22c1269
SHA1769aef92e67f74498ea3aa37a0bf5b7602dd2a77
SHA2561ba42114f3e9956dfe3e98edde59be333e277d01310a122d6e70549821d6c9f1
SHA512c00a4150ec04847240c7d901bdfc7092907a586c0d1d242e83369c2e608b5200a589e2a1f0097231558eef7ff2d6d209b9674d7778de45fad250ef5c7ace943c
-
Filesize
176KB
MD51b724a36b8b98fedc64b470e030011b1
SHA108494b25a02ab8c19553c2909239ec54513eefa3
SHA256f1b58a8fe54cdb838800e0e6b6f6d23249ffa3a47bed1ed3d5187e81a6ac1a29
SHA512000d0d05eabc9968d58ebd49516504c8d4149107aa79b78cdae617c3b11fb7d8ee0f78a5558df5372a0439b0b76616c082d7db78cd12ccde6cb0d784bd053178
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd