Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2023, 22:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://r.srvtrck.com/v1/redirect?yk_tag=337_47d_c3_3b6f&site_id=56e7d51be4b05d750682348a&api_key=abbc5236946676eae219a734c0a1c5e8&url=http://q2U7WJVOW.jackfrostloghomesanddesign.com%2F%3Fregister=cm9uYWxkLmZ1ZW50ZXNAc21pdGgtbmVwaGV3LmNvbQ==
Resource
win10v2004-20230621-en
General
-
Target
https://r.srvtrck.com/v1/redirect?yk_tag=337_47d_c3_3b6f&site_id=56e7d51be4b05d750682348a&api_key=abbc5236946676eae219a734c0a1c5e8&url=http://q2U7WJVOW.jackfrostloghomesanddesign.com%2F%3Fregister=cm9uYWxkLmZ1ZW50ZXNAc21pdGgtbmVwaGV3LmNvbQ==
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133325508070027107" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4176 chrome.exe 4176 chrome.exe 1688 chrome.exe 1688 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe Token: SeShutdownPrivilege 4176 chrome.exe Token: SeCreatePagefilePrivilege 4176 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe 4176 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4176 wrote to memory of 4764 4176 chrome.exe 86 PID 4176 wrote to memory of 4764 4176 chrome.exe 86 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 1928 4176 chrome.exe 87 PID 4176 wrote to memory of 232 4176 chrome.exe 88 PID 4176 wrote to memory of 232 4176 chrome.exe 88 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89 PID 4176 wrote to memory of 4856 4176 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://r.srvtrck.com/v1/redirect?yk_tag=337_47d_c3_3b6f&site_id=56e7d51be4b05d750682348a&api_key=abbc5236946676eae219a734c0a1c5e8&url=http://q2U7WJVOW.jackfrostloghomesanddesign.com%2F%3Fregister=cm9uYWxkLmZ1ZW50ZXNAc21pdGgtbmVwaGV3LmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd64479758,0x7ffd64479768,0x7ffd644797782⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:22⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:82⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:82⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:12⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3188 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:12⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3920 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:12⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4644 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:12⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:82⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:82⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:82⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3740 --field-trial-handle=1808,i,629248899467481942,5237430521806191772,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2272
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD5a1b4c829997f1968805df2eb3c5be17e
SHA1c72164c93ecff8e3d2eff594745962514d68054e
SHA256c1bd04d00418298650d700c1d2eb4baa9470a9fa2965844673b4bb30fc628f0b
SHA5122632c1ab7953777332e4d5d42929c8be97d7448b93ab17ea761e86eff619aa51b2ae8bc2ecee75bad2affe19063cc0bf060dd36f5df52b244b7e28835f6d93d1
-
Filesize
2KB
MD5db2bbe20773df1db069e58bb9f7d5bb5
SHA171997bdb74b9e265f057e8752fb3f8a60fb51ce0
SHA2561792ba797fb0eaa2f8bcfb239f83dad3587a2201abe938445d9b69c182c4496d
SHA51288801523bb5ab72e97f879248be58abd43e4a7f72292b10a591dfc128350bc9be956b827d20bf1a74b44db6aadcbecf9e0a3b8c149ddf6b47f9aa49dab668e09
-
Filesize
539B
MD5044c374a1e538608addd5125d48a7d8c
SHA13ec391db3dafdffe3d5c85fd4bca3d927b4b4318
SHA25642deeaabf47df6ae270ebeefcdd0d730391a489552de66f85fb8a9d2a0df5d84
SHA512eef8c9cb2d93cd4466a3dbf4c85516d8ecef9ab83a586b45b9569e76c93f222cfb1d3b44038f54eb69604675e57e0ac5e80638bb05bdb4baaeb5e73aadc90d66
-
Filesize
6KB
MD5caeea7be0f0e6ce9fcd20397c0c18e08
SHA19bdbc4172808cc6e9f647ed69a62e9bd2c115a62
SHA256cecb46a31b59a6e098d175c0d65f5cbb918248c9f89f8efe6890a141d3f281d1
SHA512c35b35c1e80cce617f32b35175d25ae7a7b6de4197befec145e25682114497da6448c08ae644cc1839e645e44f4b7349fb4653ba9cce097adf1777e76eb22794
-
Filesize
15KB
MD5c72ac44b6fcf4469539cebb6e0356b1e
SHA16a4a28084a1684a0c057ef8113b3dc9cdac2564e
SHA256375bd119f8df606b80c923000004909c1b6bf236dd01fd986a3540c556a56ad5
SHA51205dce751d0504ba16ffed090be2d1da68fe2b45eb9e6f2684beb7f92c36e60aa24bc44b281b01a984049a7a08134888f9b228eb6ce8b0213a347689498c4788d
-
Filesize
172KB
MD54fa4f91d5dbc699c78a198966b150ee3
SHA1a5a2a029860a86466f38aae4840fd29bc87a4e0a
SHA2566d947fcc575ee80b6584153ec1e6c964b49a19eba01f504e086edf809b04b299
SHA512631eac59ecb58639c7fb5fd72b0e4731720b74998ff417b0c4bf40bbeb219fdc08929739ed90953f109551a970aed833aead0f1cbb8e8804a48d98bf838cddcf
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd