Analysis
-
max time kernel
19s -
max time network
23s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
12/07/2023, 09:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bo6ywmqs2jm7nwyrydczztrjw37wujez2siertufibxgmiq4-ipfs-dweb-link.translate.goog/?_x_tr_hp=bafybeifvok&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&
Resource
win10-20230703-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://bo6ywmqs2jm7nwyrydczztrjw37wujez2siertufibxgmiq4-ipfs-dweb-link.translate.goog/?_x_tr_hp=bafybeifvok&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133336278922775272" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 820 chrome.exe 820 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 820 chrome.exe 820 chrome.exe 820 chrome.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe Token: SeShutdownPrivilege 820 chrome.exe Token: SeCreatePagefilePrivilege 820 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe 820 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 820 wrote to memory of 816 820 chrome.exe 53 PID 820 wrote to memory of 816 820 chrome.exe 53 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 3992 820 chrome.exe 72 PID 820 wrote to memory of 4016 820 chrome.exe 71 PID 820 wrote to memory of 4016 820 chrome.exe 71 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73 PID 820 wrote to memory of 2956 820 chrome.exe 73
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://bo6ywmqs2jm7nwyrydczztrjw37wujez2siertufibxgmiq4-ipfs-dweb-link.translate.goog/?_x_tr_hp=bafybeifvok&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb7c3b9758,0x7ffb7c3b9768,0x7ffb7c3b97782⤵PID:816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1664,i,992017915542569945,4463998151128702405,131072 /prefetch:82⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1664,i,992017915542569945,4463998151128702405,131072 /prefetch:22⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1664,i,992017915542569945,4463998151128702405,131072 /prefetch:82⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1664,i,992017915542569945,4463998151128702405,131072 /prefetch:12⤵PID:196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1664,i,992017915542569945,4463998151128702405,131072 /prefetch:12⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1664,i,992017915542569945,4463998151128702405,131072 /prefetch:12⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1664,i,992017915542569945,4463998151128702405,131072 /prefetch:82⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1664,i,992017915542569945,4463998151128702405,131072 /prefetch:82⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5e5ef4aa8255a641ca8b7a88d14e443ef
SHA147d548e4a4c585b6d6da00e6f43cc2a7565e5dd7
SHA256ef5098c5f5e6df3af103fe81b0b02360cfff8c9061900ca84df01794e123ab16
SHA512f713221d0269f7cc098cc4b3e12cf583f2f88964b5c20e7c2f4245c51e328c998994bd124a91e6b483a4d238f61f7af605492211b5173a41eaa9c43a6b4a9cab
-
Filesize
173KB
MD5c89488bd26ee1dbed6bacb979eb2a1b5
SHA10acd64c3b72d6ea5d7496a809c1a8cbea47e1bd5
SHA25614e6f9648b14ff5fef65229df7137cfb24498e0b2483d0a3d6bbae7737289d54
SHA5126b74635396d1f1b0456540b18c5317a82d8b982d0f8da19a89fcf8e3ea8c9e20d52ebbb026f3e4f7c5e5a8d448f94c144bbad73cf726c5243ebf3ae7c9874640
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd