Analysis
-
max time kernel
49s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 22:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://valium.z13.web.core.windows.net/
Resource
win10v2004-20230621-en
General
-
Target
https://valium.z13.web.core.windows.net/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133326365944253222" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2640 chrome.exe 2640 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 2640 chrome.exe 2640 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe Token: SeShutdownPrivilege 2640 chrome.exe Token: SeCreatePagefilePrivilege 2640 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe 2640 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2640 wrote to memory of 4188 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4188 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 3776 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4824 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 4824 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe PID 2640 wrote to memory of 180 2640 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://valium.z13.web.core.windows.net/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c30a9758,0x7ff9c30a9768,0x7ff9c30a97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1792,i,17094091184427368226,1722522960005684998,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1792,i,17094091184427368226,1722522960005684998,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1792,i,17094091184427368226,1722522960005684998,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1792,i,17094091184427368226,1722522960005684998,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1792,i,17094091184427368226,1722522960005684998,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1792,i,17094091184427368226,1722522960005684998,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5032 --field-trial-handle=1792,i,17094091184427368226,1722522960005684998,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1792,i,17094091184427368226,1722522960005684998,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5aad830329b330a6da17d2b3635c22191
SHA18267d99c1dc9e67499efbfdca385353a09953617
SHA256b9bc7987b77179c69460a5b61766054b6f241a3af13d9be2dea56de39eb66cb6
SHA5120adbc91f445983f271d9f38bb09aed54e3384df5743a59140c5e4e6f91aa390932d7a91840b97f07bc5ebce9fdf773a2e9760824a8726652be13fdea7a6faad8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD51fbd91f917c687b1858719d2a8a6d90f
SHA1d786c72668d9ba7f8b27ffa9c72e54424a5bb3dc
SHA2566adf1f110c9c55f5de357678321baf134abae55853bc1286be81487d358e2b2d
SHA512260f08bdae157ba037c7552605e23d13df0324167a7da723e25fd3e16ecb3e66c015cbfd77974f2dc8f3e9c8382c223f3bdf670cebaf223000f2041430a2357d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD55b293e1a2536e6fc4fddc8001b72056d
SHA18a78758840df55cbe4c80ab1ab9cf903dddb4e34
SHA25649d98c1deae70d3c1a6138534cbca13d1bf216974fbe2a5d4e6a123a67308c92
SHA512b1da82fd9c49b191e16290d2a6cac0de57113a98dc2ef686ca3ca11d522004a6680e1fd9c0a9f44c2fbafdf391f015c1f78991df7633828d4fd632937c44fbb2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
172KB
MD55ab553a39359b3db6f9f5902416d2ef0
SHA14d01fbe1278f7c3748c2376f65614b3dde6ee459
SHA2561cd66b67f69eb7a7a9dbab3322e4ce8ad964070f099cb73548bc5045c122bf70
SHA51201ff3762208b1b0167a0c5375920aa1a5927b55e56bdc5bfbc82d627040e609554421947c84f1043d90d4a823efe68710246d0c0524f37110917a9a20c5f6351
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2640_VMWRGBFPOGYRLXYFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e