Analysis
-
max time kernel
228s -
max time network
232s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2023, 17:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://objects.githubusercontent.com/github-production-release-asset-2e65be
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
http://objects.githubusercontent.com/github-production-release-asset-2e65be
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133337447909118640" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4964 chrome.exe 4964 chrome.exe 2228 chrome.exe 2228 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe Token: SeShutdownPrivilege 4964 chrome.exe Token: SeCreatePagefilePrivilege 4964 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe 4964 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 2752 4964 chrome.exe 41 PID 4964 wrote to memory of 2752 4964 chrome.exe 41 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 4376 4964 chrome.exe 87 PID 4964 wrote to memory of 2732 4964 chrome.exe 89 PID 4964 wrote to memory of 2732 4964 chrome.exe 89 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88 PID 4964 wrote to memory of 376 4964 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://objects.githubusercontent.com/github-production-release-asset-2e65be1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7be89758,0x7fff7be89768,0x7fff7be897782⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:22⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:82⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:82⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:12⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:12⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4504 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:12⤵PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:82⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:82⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2684 --field-trial-handle=1732,i,14897468361024505694,6593525119791180849,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2228
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3476
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD509dbf54e14ca275128d505f14bc963ff
SHA1cef51e33cf0bf2d623288cac03459386b311b40e
SHA256844b861ee89e7b8f0ed721419fd981a1a0f01aca201de582d5d525335f0f0540
SHA512c9d13eceee92c91742a60b77faa28a6313897d0b75cdd66681f630acdd2db5b637e99713709a5ca8581dad3c50dce1421d2df2ca8cdbc9f9fb16c9d84cdefa8a
-
Filesize
6KB
MD59dfd871016025cd9e81315c5dd52bc67
SHA12ddf36218e5f94041e6f9355974258634050fbee
SHA256705d604d37aa2398748905d19ee450fb7c5b8a1c3a6839214386ad289141d4b9
SHA51213650d044c58f2beade4f2ba7a36929437627c4be348071b6bbbf17cf8c6025912261a045c0322372b332ec343fa6319c1ebfcd50204e2a54b796cb049510fea
-
Filesize
6KB
MD53d64d316278b89bf5ce658e7ae2f6149
SHA19f2d43878bbc1988921d5c9f9e3544f6f57b105f
SHA256569849bee8f85773df1be6c2a26c838f8ce45800d98fdcebd7114cd45b8c352f
SHA51214bc8242165fc56297b3b6a179bba0dcd30bc88c616cd1cab4df267c4d27c8d7e1640084fe9107831bdcaa4aa58746909965873be222d8c384fec755c2304a57
-
Filesize
87KB
MD50ae3fd687d96fb7e2f08058650b43531
SHA1786f6e59a0dabb9b3bde95d6e7206cce6eaac3d7
SHA256cabecb0545717c53925cf9398e8a22e07c2de2a3fc6371513e6ea3ca93d37e8a
SHA512f947c5fd854128d535efdcabcbaa2a364c08e8a6375da40d33495aae72333b4c131521ee89e3bde4f45091b15b3b60a18c14e8c3cbc5928e8fe3fce0bd67bb94
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd