Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 09:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.cnil.fr
Resource
win10v2004-20230621-en
General
-
Target
http://www.cnil.fr
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133325920096508408" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 2756 chrome.exe 2756 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe Token: SeShutdownPrivilege 4324 chrome.exe Token: SeCreatePagefilePrivilege 4324 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe 4324 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 2996 4324 chrome.exe 82 PID 4324 wrote to memory of 2996 4324 chrome.exe 82 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 4444 4324 chrome.exe 85 PID 4324 wrote to memory of 3896 4324 chrome.exe 86 PID 4324 wrote to memory of 3896 4324 chrome.exe 86 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88 PID 4324 wrote to memory of 3204 4324 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.cnil.fr1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb4a69758,0x7ffdb4a69768,0x7ffdb4a697782⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:22⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:82⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:82⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:12⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:12⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4848 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:12⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:82⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:82⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2840 --field-trial-handle=1820,i,8342398087447695323,18178870000414692699,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4152
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD543b9b4c1851c7e7972384026b306300a
SHA106c5b30c880ff2d2efbad2bbd8e3b654be91c410
SHA2562d4a58ab96f54f2acd667e0311dc2b74fca45cba8a56c4f13aab6af92fb3f70a
SHA51202ebe7980b589f1b47c2ddc0197fa0f11e56f8ea82d5a1a6d1cb249e22a5279c5f63e028884fd96620c1e122da96b1bb9f7b6dc7a922b38dd066792a0948a7f6
-
Filesize
144B
MD5231e06c5aa58bd53635ab72fb1ebe4a5
SHA19d95ab6f54f9b7f474ebb49944c8248f4a25a322
SHA25630907b0312578289c7f91628f95599c379f48c1d2a48d3f326fa733274a7c377
SHA51217028d6bf945a8b5190e129243727e6d255720f93713aa6e59a1a47d3835a65dd2058585eb1e75ed62a0b922cdd18da5c992a5b55e17cde3ae5731350e904b60
-
Filesize
2KB
MD5ebb37afab45fca3e2ccab90ef495070d
SHA1359da34dbda3d0fd2d3ffbd14731afa11202adcd
SHA2569bed6bbe3b3746d4c72484f90c174311f5ea18b1b43e2cee8f8f5d25659c73a1
SHA512d6d8902074ccaaa0a0e1c9bb5697d069c34280993cf367c4e03bc807e3df22605d8a63ef41f90444eabbb14adf797e8fdeb4b4889bb2fa3fdcf9692a7ea3b276
-
Filesize
706B
MD5bf7226a3827fadb0b8f99daf8dae1b32
SHA19c395175f675473ff2f75b52afbf44f7ec1e1f30
SHA25639c7ba53614177aa300e7d27a4927e0ad81d36b63870730f533e1c761e8dab24
SHA512d7efe6cb7c3fe9b076e062d331875712cbe962e36970f039154788f8377cd541cd2c5bc0a7d6516b0cc6d5d8e5670abfc0edf928c3a174ee0cdc72f6e72e5f44
-
Filesize
706B
MD58c9802acb4bb7fb2756a576a7de665fd
SHA1eb8592f5adca8db866d1dd0d985e32dcbd5a2aab
SHA256bccc7a8eff5dd6899dcec391f4af1f4a4b1dbdfc6483d69bda8e941e5323de58
SHA5127274cf65d6378f882194e210981a53ca79d7c8341f2c5fd4d9119b541a2314d2667c20daad011a081ca1aae667a4c93c0d1b6c8aa56bf766f6964be719172c31
-
Filesize
6KB
MD5e066adeed6fd023fbc738e86d0216db6
SHA13d150f27b45490f680b6b31dcf231361237285a7
SHA2567df36d91d654a15af8312d7589e7e5bfe7b5566a81eb52a2b2e47965420a45f3
SHA512260ff0b87b316ac44b945e17f58d29915de0783f71bab287228e4ca95e63de9859d8ce642fd1e967a4d7ddfe8109b4e830bca771e4d0977b93a8732618dc0d97
-
Filesize
6KB
MD5cae9eea654161485f12efab0d69e81c3
SHA1c045d2b5e3bb40fb3099ce066d9c283cb141b9b9
SHA2564c03102aea30d449c37ccc526f5dd2cabd0c242ad9b61f9ee18c01ce80de930d
SHA51256e90f0e514ec96a714678347c638e120cafdbd8837db3fff20f37a905d0b404ea39065c15d3552589641dfda7ac332aa54f8447e9ba3a37c123299e2bae6406
-
Filesize
15KB
MD5e391c4becef52611f06efe91592a5311
SHA1409241162e2be4bbaaa0c84c2b65f03a1245db64
SHA256861bb23a1e92da25e45af3af4865a2c5dc320436ad226c616619f11e6ee9b08e
SHA51229bd1322da1d097a895711335e0196bd3518aef2f806da7b34024ef3e28e7c3135a7229044923d7d7701657a9170b375c651ad50001f426368002fdbf4fd313f
-
Filesize
172KB
MD5c9876db42ab4cad75e21d51df9d59d84
SHA1c5bddd77ccaaafd6ae41a9d19c4f9bc5b95a296a
SHA2564dc9498f1ac03c960429bf42a2ab3c95bc8a81339b6545a4f79924ebefe1ad27
SHA512b32ee293f230818da9e14bd2839306a80ad4e5941db7f7e22d16fb83f7b75792d0a476c299d6f3a8ad0a2f18fa3642c0e5bf731ee978b0ea677d177b28b159a7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd