Analysis
-
max time kernel
158s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2023, 16:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://repo.kmi-enclosures.com/kmi-enclosures.com/Untitled%20d
Resource
win10v2004-20230621-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
https://repo.kmi-enclosures.com/kmi-enclosures.com/Untitled%20d
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{47ED4D06-2C9F-4677-BF66-C295416A3D92}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E20AB230-29C5-4AB2-A920-73F2FEB351AA}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9A4F746E-BEDF-4871-A243-390845721B3B}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6EE16F4F-90DD-49D2-B1E3-37E98B143B3F}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{316E6559-D31C-46A6-94A9-E71351D4BBDF}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{C36D2DF2-E117-4208-84F0-EAFB6688100A}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3E26F919-492F-417C-9F64-8B2A7EC750C3}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{333982E6-D1A7-4C3C-B6D9-81F050998200}.catalogItem svchost.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133324446661807702" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4008 chrome.exe 4008 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4008 chrome.exe 4008 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4008 wrote to memory of 2496 4008 chrome.exe 81 PID 4008 wrote to memory of 2496 4008 chrome.exe 81 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2356 4008 chrome.exe 83 PID 4008 wrote to memory of 2272 4008 chrome.exe 84 PID 4008 wrote to memory of 2272 4008 chrome.exe 84 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85 PID 4008 wrote to memory of 1840 4008 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://repo.kmi-enclosures.com/kmi-enclosures.com/Untitled%20d1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98dac9758,0x7ff98dac9768,0x7ff98dac97782⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:22⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:82⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:12⤵PID:2140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:12⤵PID:1872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:82⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:82⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:82⤵PID:3136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1800,i,11831046942707402545,9525655865847167158,131072 /prefetch:22⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3656
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:932
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51710c2c228ad9e33ca5a7f5e78122fd0
SHA1510f4d44e5494e4785e85795351d639ccfed42f3
SHA25695b48795eb6b66ad4f88be96abd6301f30da3974a80beea178ba90fd212d1c8e
SHA512a15c516100ad898091fd66d63784edede8e231f51660130b2444cfc374d4d549483b6f2a2528523b98785c5214fc009e6a753ef5faf61bab6deba9e34f19c957
-
Filesize
6KB
MD5d777c64ce5eb8e7653905da9731b33d8
SHA149200c0bfdf7a26d106982b349e986dca6b260fe
SHA256f27aa65e969f1f3bba110a77d1aeb47a18e34fd9f283fbbc30d73f27d958e011
SHA512dad6d7698495896b0a3e34b667563433c622eaf014a85fdb4f423f107782c7c08a43a20e752e0ddea65d159d340bce88776ff55483796034ae93521041979cab
-
Filesize
15KB
MD56e08d49be452fce45cec5294c7e6fb73
SHA1ece595771e1640ef62727df51031eda03d349a07
SHA256870d7499ee358ee2596043233a4cc82115c486076d34ee63987cfd85a1fb04bb
SHA5120f6cf1023e835cb8a3cc780ba611b79a6e276dabf809eb64bd8d3d0eddee22e63a742e1be8350ad6772038eb520ff9f49e8ce3d5b59811b6355e0f71cb531e19
-
Filesize
174KB
MD58e967370fd447541f56d78ef1156706b
SHA198b50b547e21838e45196d0990d6887adeebd60d
SHA256ccbd39655b567a8ef6a6727e96a8c4cdb3bd22e659db0da970947a1406eb6bf2
SHA5126571d0a8c9b3c1153ba33c52e8a740b8d6c5e1212c5a89fc50c5737f8a921b05c2e356c8c9f86d81a2393252430a59ced52e7b79a08f8693974db75016766996
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd