Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2023, 15:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://protondrives.com
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
http://protondrives.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe Token: SeShutdownPrivilege 2832 chrome.exe Token: SeCreatePagefilePrivilege 2832 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe 2832 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2832 wrote to memory of 884 2832 chrome.exe 74 PID 2832 wrote to memory of 884 2832 chrome.exe 74 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 4576 2832 chrome.exe 82 PID 2832 wrote to memory of 1536 2832 chrome.exe 83 PID 2832 wrote to memory of 1536 2832 chrome.exe 83 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84 PID 2832 wrote to memory of 4264 2832 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://protondrives.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1aad9758,0x7ffa1aad9768,0x7ffa1aad97782⤵PID:884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:22⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:82⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:12⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:12⤵PID:3800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4444 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:12⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3340 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:12⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4840 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:82⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:82⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:82⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4840 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:12⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:82⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:82⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2576 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:12⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=212 --field-trial-handle=1948,i,3318276552014456104,13558345358363136783,131072 /prefetch:12⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\484f24b8-5355-4b9e-9d5e-de0ef37975fe.tmp
Filesize6KB
MD5937a04dd9d4e22c2112f4e69c29a8d05
SHA1539a7e35e826280739b8e07b8e9d7a7c57306649
SHA25696a6b11bb661dde494939165f89061126f9a5c124b401367e902cf821d6d72cd
SHA5121fe7752b9bd42a7a8cb346c314bd241a0dc7b32c52786acac38b20fd7a9015a4a9dc1fbba284c23a5c27dd7233d08fcbd776b3b08af7f24d9b1f3735d65555e0
-
Filesize
1KB
MD5aed62af1edcfaf1e8e1c09a5baeae89c
SHA1e6938cba99b5ad2cb2c441986c06003eacc4aa5f
SHA2568749145d7335a3d758989938d1bc2a83563326dbcccad47cc358d710b9904508
SHA512caeeec931a606def9918858d6b4899ced408e4d294b2f27f4b2364eed0080b2712393b13f382d61a2b52e34f9646042586c41e4a659854fa29107e0e46e137aa
-
Filesize
6KB
MD534f2d4e5adbecd7ba3709c9b661b6b51
SHA12f42cd75a914be4301f0ea273c39054e69051f47
SHA256a586097e3d69c21cf0c49fb6c121af9918215168d262d13f974399d8cc6dfe02
SHA512a190019774f146c9b4dabc4ded197b5006969d8e3ed312fbc9926433adeef453d212c1cc1b85f6c2bcad45d69d618ad296b37a2424c3e4363560fbba968592fe
-
Filesize
90KB
MD5fe2f89c80fae47a795d3da0b7a03072b
SHA13111a30f21e11d278568bf495fff36bb57073865
SHA256e5cc8dee6f0db835de3a1732245e0d89fba74781690d8c5b81261a944a53d736
SHA512e8fba93908270d67a0dc797282aa945c707267bada7235a3081400e78f3c06c06503e735740d1f2fd5539e73f0df72cd777145da6b2d644fa16d89c8771c7bf5
-
Filesize
89KB
MD5152d1b9cf53486e08646102cb2e4edc7
SHA1fa72b19e5d3d3634d6972bf47c7503367c4da2d7
SHA256fa08f5746b9e51eda3f63f20ed2be9c308af660020dcc9d6b06039baad03253b
SHA512fb8b993e4f93b4be31675c22bbd0aacd11af6139adba0169dea5621390b7dadaee99ef2d372239c037cafcd80e241322ea7e487bcf66a070943995da6d72acf4
-
Filesize
89KB
MD5d1da0ee003dc1a4a1ad2d91d66c96e9b
SHA1d15a17087f0c46af40f70f2076b46d46d6572495
SHA256a3ae75d2d2115905965d5ea3f4baf30b87249c46b68ec14f97224c1ca9b304e8
SHA512fbc69f0c00d39e1b5c0eb3ddfd5ee67f59126c41dd4e2d278befd15750958cc01ae94071a37aaf6d1dcab39c5ff60fd6f6d9ddeb1dc592d2023a4f59fb1774bf
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd