Analysis
-
max time kernel
15s -
max time network
21s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
07/07/2023, 08:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.fleetclaims.co.uk/
Resource
win10-20230703-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://www.fleetclaims.co.uk/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133331923173928426" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4924 chrome.exe 4924 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe Token: SeShutdownPrivilege 4924 chrome.exe Token: SeCreatePagefilePrivilege 4924 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe 4924 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4924 wrote to memory of 2156 4924 chrome.exe 70 PID 4924 wrote to memory of 2156 4924 chrome.exe 70 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 1348 4924 chrome.exe 74 PID 4924 wrote to memory of 3564 4924 chrome.exe 72 PID 4924 wrote to memory of 3564 4924 chrome.exe 72 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73 PID 4924 wrote to memory of 2144 4924 chrome.exe 73
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.fleetclaims.co.uk/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff95d479758,0x7ff95d479768,0x7ff95d4797782⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1756,i,362704296093763228,17035636448156412441,131072 /prefetch:82⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1756,i,362704296093763228,17035636448156412441,131072 /prefetch:82⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1756,i,362704296093763228,17035636448156412441,131072 /prefetch:22⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1756,i,362704296093763228,17035636448156412441,131072 /prefetch:12⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1756,i,362704296093763228,17035636448156412441,131072 /prefetch:12⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1756,i,362704296093763228,17035636448156412441,131072 /prefetch:12⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1756,i,362704296093763228,17035636448156412441,131072 /prefetch:82⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=1756,i,362704296093763228,17035636448156412441,131072 /prefetch:82⤵PID:516
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2216
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
702B
MD5ca489d8bd012b95e4b1fa758ac1d07ed
SHA10c0c53f959050d2acf91baeced12a527aed25b2b
SHA256bcf31fa5600e7846490f2d1e9325287fcd93b9a9536530a4016a5ec2f18c5bf0
SHA5126ef1b466bf1adddc855fafc8238c12a8a16549fed88bc5b6caf1a75e740ec22a28cdfe57b286d9b8798922191be66b178e3f98e2cf2c23a31614c7757074a5d5
-
Filesize
5KB
MD54a112ab54e7a7fffe7187de94d66af7d
SHA1a839c6879471bc849b3bd06f2ec17b6042891962
SHA256f9fd47c36105acd49f4a27b7159ec7de247a5f098568bfb3565eb91cf9003355
SHA51225afd07b81e50b0244f89e8b77f5739ad96495d5af0cb84a8b7e5d14b31a9e1ce3da2d36d601ea90408707adff7799578caf05b4e64ffefae2f5a87a248eabdd
-
Filesize
172KB
MD5b84656a67808422df17f40bec9073faa
SHA12f8a4c6936634382b8f51d2183f49fe3a92b54ed
SHA2562ee095e4c9d5dc72d18b6a1ebda80f3b08f9710b80cc6cb27ed9212de23b422f
SHA5129e2c752c294dd1745ee92415f9d225cfc54bad969d96438a0aedd904172e5d4e597c70aec00bf46b7906c1c645e89fc6b6500d157ed69c11bee8c6dc6d22d176
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd