Analysis
-
max time kernel
120s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2023, 12:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://c-suite.biz
Resource
win10v2004-20230703-en
General
-
Target
http://c-suite.biz
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1200 1752 chrome.exe 80 PID 1752 wrote to memory of 1200 1752 chrome.exe 80 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 2728 1752 chrome.exe 83 PID 1752 wrote to memory of 4728 1752 chrome.exe 82 PID 1752 wrote to memory of 4728 1752 chrome.exe 82 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84 PID 1752 wrote to memory of 3748 1752 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://c-suite.biz1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff913769758,0x7ff913769768,0x7ff9137697782⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:82⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:22⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:82⤵PID:3748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4040 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3092 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:82⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4980 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:82⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:82⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5056 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4716 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:4080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5048 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2884 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3948 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:3624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2928 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2372 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:64
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3796 --field-trial-handle=1880,i,15891092731905044925,9762815249004832148,131072 /prefetch:12⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c351a80d9e06de7c7284289aa8406262
SHA179aa5e86fdbd2af9abab203a55744efc31987302
SHA256e2718c00c41fa784753c50d860cdc2346d3c07c288edb57aaf489b47a2f7e187
SHA5124886e0cec8861c9926ea0c1731baa7f25d483d85569d57f41717daa90332e1854c122c1bdf8494570dd2577b355cb8c2d372c85b5e8ba0ff8e978789651438f7
-
Filesize
6KB
MD560f1e4a470922c4f0dbb1a64a5d2003a
SHA14ddb625ac0632cb08c681f7cdcd59de4a656f1d5
SHA2563db8990c131eb1b44083bbf89659e1158e0f0fceceedd894716eb49074cc3028
SHA512151347d5d0f4dc86533ce697a5d57b0e7c5509a27d39b3fa81baf2840e71480317d782e8f5e4ff7ad0598c63aede1d8462ad286da4f9ebf25d8d443c6e330428
-
Filesize
171KB
MD530f15a9d6d1cf0254d52e4b044ca1b50
SHA1430cc508973731350de3ce415abc45ffe60b6d3e
SHA256e14c0d7fb46df14477cf7f6d5dc5627591d94991a3907ef78ff967f447369266
SHA512be41e8216928fedb33afa9c79bf4161a8721eeb76b3cb9502d0ddf8f93b50644f238404781a0e1487fb412c7d1804f1c86e3efdf23df3035d4e21c65e6fa0dd8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd