Analysis
-
max time kernel
61s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-de -
resource tags
arch:x64arch:x86image:win10v2004-20230703-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
05/07/2023, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
Vnote.html
Resource
win10v2004-20230703-de
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Vnote.html
-
Size
1KB
-
MD5
53becd3b3af6d4a8ad7b625a779eb431
-
SHA1
d6b6f958bb42c0ded928bcf365079f7c63191ba0
-
SHA256
4e2297726ec279bb193a253d1c87df016d14a81c01df569307ace4370b11acf5
-
SHA512
28e0f4d3b341f47fd52d2db687b48dd796337e54c3311c204c5259854fbef4312dd46a56b26cedfcef2c3fd1c174378b4ad2b1fcc853190fd48758602124ffb2
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 60 chrome.exe 60 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 60 chrome.exe 60 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe Token: SeShutdownPrivilege 60 chrome.exe Token: SeCreatePagefilePrivilege 60 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe 60 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 60 wrote to memory of 4340 60 chrome.exe 83 PID 60 wrote to memory of 4340 60 chrome.exe 83 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 2744 60 chrome.exe 85 PID 60 wrote to memory of 3868 60 chrome.exe 86 PID 60 wrote to memory of 3868 60 chrome.exe 86 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87 PID 60 wrote to memory of 3224 60 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\Vnote.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9ff19758,0x7ffe9ff19768,0x7ffe9ff197782⤵PID:4340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1876,i,1556021240043285071,10773869217197304050,131072 /prefetch:22⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,1556021240043285071,10773869217197304050,131072 /prefetch:82⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1876,i,1556021240043285071,10773869217197304050,131072 /prefetch:82⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1876,i,1556021240043285071,10773869217197304050,131072 /prefetch:12⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3140 --field-trial-handle=1876,i,1556021240043285071,10773869217197304050,131072 /prefetch:12⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1876,i,1556021240043285071,10773869217197304050,131072 /prefetch:82⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1876,i,1556021240043285071,10773869217197304050,131072 /prefetch:82⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1736
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\76422701-595b-4ed1-920e-94a9a6789fe8.tmp
Filesize875B
MD5aa7a679f0770c61f99f6d567aab7482d
SHA1c939c055f7e958ec5d714fe924620b4cbe7f7ea3
SHA256cc6812f7883a9c7763077e6859adec5bfbc3e1d3d67efd89dd655dac1f41128c
SHA5125bc635c6a2d6d805bc08a5ce2d2d1e54dfa392332ec08d3be37dffc242b6c828136b9aa88709e4ace1deea5cc05b19af8979be66d51c6c42052dbb2ab635c8ab
-
Filesize
5KB
MD52a4f40ce9981234df1a9ebced9405239
SHA1978a533af05f8bca4917984f41d20a94aab4ea48
SHA2561a149396c5711e485f6a5e1f7b3768e3ce2feeae8c9086482d9f27f34e8f6841
SHA512a605222499ed8afa6c33bb8f22fbd0694f0b218843985e5f0782a9021ffcc4f0a62d7c286fdce3fe5ec6c18c36f08fd42e9a644002885f7737911ab34a37f888
-
Filesize
5KB
MD5aa7bd78d0800bbafd5627ea33d3dd74a
SHA123a397494d7b37828bcb1dd36650266254c9d08a
SHA2561c39ed0d00715b60a5df7c36f297c7fdfb451e7d30979a3ab4492db21703705b
SHA5129893001a7693e708caddf942bfb1efa1378c17fdf69edc4dbe63d9d7555e6def8b90dddd0aec2dab5e523673a7c27e879a55f4f3a14b236957252a44d85de980
-
Filesize
87KB
MD530d821dc2bac420225353e38d5a5f8b3
SHA10b45b9e79968ab47493b22dd1a2c975da7321061
SHA256eb54e67fd1264cc7efe21922593d6609776874adb3ad8ba3f0234c4165fc212b
SHA5121b7239e6492e796fe574558f0707fb2c9a33e4a7cf6cc0e7bc1e9e141b03dbe225162be079de7af79d13357bab3586e3a81761ef3ed4d898225025a87e0a468b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd