Analysis
-
max time kernel
600s -
max time network
580s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2023, 21:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://5w11mq9opp.s3.us-east-005.backblazeb2.com/uECQHg5y2S
Resource
win10v2004-20230703-en
General
-
Target
https://5w11mq9opp.s3.us-east-005.backblazeb2.com/uECQHg5y2S
Malware Config
Signatures
-
Detected phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133334975652100284" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2628 chrome.exe 2628 chrome.exe 4356 chrome.exe 4356 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2628 chrome.exe 2628 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe Token: SeShutdownPrivilege 2628 chrome.exe Token: SeCreatePagefilePrivilege 2628 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe 2628 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 4572 2628 chrome.exe 84 PID 2628 wrote to memory of 4572 2628 chrome.exe 84 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 1204 2628 chrome.exe 86 PID 2628 wrote to memory of 3824 2628 chrome.exe 88 PID 2628 wrote to memory of 3824 2628 chrome.exe 88 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89 PID 2628 wrote to memory of 464 2628 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://5w11mq9opp.s3.us-east-005.backblazeb2.com/uECQHg5y2S1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7fff29a99758,0x7fff29a99768,0x7fff29a997782⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:22⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:82⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:82⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:12⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:12⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:82⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:82⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:82⤵PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 --field-trial-handle=1840,i,1736825570867997004,7414238163051454824,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD57e78c31573a5fc8bfbfa649f6d7459d3
SHA11413be54c56dd04f6597d2b171b82a48573faf9f
SHA256b3fcb1e15a743ebeb8bfd3e9f74a3681c6e25e9ceef6840644c2bc604a9fee25
SHA5123c25f6270caab5dc03590a856e26a064c050f294a8e27d623cde1a0e8fb86acd3312f7d144c5f4a70d93664e1d72af92d973bdcf1d7a9ea04375f320e5af6d62
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7039d706-6dac-4ffd-89cc-3237342a2871.tmp
Filesize1KB
MD5c5c518f83f744c890620e328cf9e21b2
SHA10e629cbf560c41f018c37926ac18fd1afa4a7ec9
SHA2560a2f62adde483801175efc4e643f07d09c46b9d7c261427b779f9f0f025fe455
SHA51267c4dc433a96f84aadce2658d188099e5290ec07559b80b6cfa098e0c3ed51cd2caf9860058943862f014aa0fdb01f59b0808de6ad76c6157333b33dd7a0265c
-
Filesize
2KB
MD57bcb5c380122be4b32e821d2b73282b7
SHA1da7fad6a4f1bee022a5d3cc96369e6f75c047a41
SHA2564e92e0522f3eddcdf7a42c6dadb58d6476babeafdee8dc50c9c27a9e4779ec2d
SHA512f80864fb4a4e5b2961edc4f399e3e93cb0b57441da76ca5783312657c27a4763e7a4857e9d61c59640dc7ef734bbaaebd2ac27cf8ce045575e4bb6d6278b2979
-
Filesize
1KB
MD568c3513722831a2d378f2af3fed95c24
SHA1f902f8966cffd419aec96754ef0b18c728c2433a
SHA256ed98cd9fdbf138e37d064b67bf4c79216eb25f7b6846cf90d0b9caddd7ac6750
SHA512a3fee60b02f830064b32325f5dad552f6600c30edb6fb412d76896e66ae767674c55f8a35cffd97fb213944faf72f7d9547d4a64cb24c65f5d0c4a27627368e1
-
Filesize
1KB
MD5ca9f3af8bfecdd620224bc28c269ed86
SHA132dce357c98ff4abac83f6b0c7722f0c1734b229
SHA256912cc2d417985e6efdb00e61a77a0970f81cda291470755412a9f08774c72c81
SHA5120991286a2215ec564d1e1eb8333edd085a6a1d330ab80d26bcd431a582bf0e49f91bc212219d2591ac5b984c0c89be1e4111e83e6865c371f3b10d692d041630
-
Filesize
6KB
MD50c85a519a57ae219a08b6d01048fec3c
SHA10995707a84d7bc7b29601c5cdd81c3f65209aaba
SHA2567361ee987ed19730dbf031cf8ce78eb4280009f315867f0fc3127c080cc938a6
SHA512899061e2e7719af9ba4d0e7c3ee2411f3883f8aee994386cdbf5d15bdf09f153cafdcbce58a78829fca5f4de05132c428505bef017ce72577eb9ee985ead0ded
-
Filesize
6KB
MD53d5459d4ca92afde23339bcf2566bc7a
SHA1ee42931e7fb45e22cd7de7b556b0581af6c8000c
SHA2569ecad312d1e4b94917e0743559a3a8e432ce8a9e0ce7e80c2eaa1ad5e6b72e8f
SHA5121f7252b69127245e1026b47a44e9819a641198b51c309f684faca0924c9bb52f1de650dac33d46c21eab31e961854b62f16ba97e4080749efcad5eb213cb5b7a
-
Filesize
15KB
MD578d4f4df602b17cd79643891298046e0
SHA139a272f7ac7787a01a425a3b0eae43a7b193eed0
SHA25697e9208da2561088549d67db2fecb60a20fdf9d7a2dad59bc62cfa40a9c75ae7
SHA51228c298a293dc29d6445d324e44aaa5390378e53ad4715220a903d8639d95f16f342817e9d079aeb471bf306d827c5aea5195b76fca429a5e4c8487ccdcaffd47
-
Filesize
172KB
MD5c3500f2e162ae6985097ad3ba1c6ad99
SHA155030daab5f48c0f59c9835ead721af93d9c2f93
SHA256903b253695df00e0c35b22a5d443d51e295cdd6762510b90e51a3a69c2ac2677
SHA512aee543d5cb879770711ac3e6d5a03d847823eafcf3721cd4ffc584dc65699fc67a185f15982b9edc46c0bc96e6cec81e0fdba4744d7699939b8a058db1af3f41
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd