Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/07/2023, 22:48
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://serchramirez.com/.askamayas/729780/cmFuQGRvbS5lbWFpbA==
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://serchramirez.com/.askamayas/729780/cmFuQGRvbS5lbWFpbA==
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133341077106704306" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2944 chrome.exe 2944 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe Token: SeShutdownPrivilege 2944 chrome.exe Token: SeCreatePagefilePrivilege 2944 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe 2944 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2852 2944 chrome.exe 70 PID 2944 wrote to memory of 2852 2944 chrome.exe 70 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 5100 2944 chrome.exe 89 PID 2944 wrote to memory of 1708 2944 chrome.exe 87 PID 2944 wrote to memory of 1708 2944 chrome.exe 87 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88 PID 2944 wrote to memory of 4712 2944 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://serchramirez.com/.askamayas/729780/cmFuQGRvbS5lbWFpbA==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2e529758,0x7ffc2e529768,0x7ffc2e5297782⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:82⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:82⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:22⤵PID:5100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2912 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:12⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:12⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4816 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:12⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:82⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3188 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:82⤵PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 --field-trial-handle=1880,i,8977704053861178015,7171082357282667386,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3060
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1672
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD58f7c8634f9a455f07e6c48de35c2bff9
SHA1b27cd4e422c75464c539b95226254fabbbea6a7b
SHA2562e90dced17d617cf89115abfa23b7cc8356b66fbb1fdd118241fa7beb7ff5c4f
SHA512026ae0833b4d78aeb49f16437bec3a22a36b01fe3e865871a8b24343c4b76ca44fba11638553b7b120e8794ba005071951666acc17e989fc7e00b4680833af27
-
Filesize
2KB
MD59a1c4b42f6a3880bc295967b21ae3c4c
SHA1d0b889c8364cc55141fb48cc100b5b0230f59c1c
SHA25611c7545d9e38f58f18e8cecea6926bf5862b99e3e7eab24e289157ce801f5c93
SHA5124471c077dee157ca3620c73a814bbf4e10e70ec801d9fd50b0fbf3d386fc1562bd41400a7f2a95244a2e00e5a84d4b6373c2d9a8991c4a97648621c7f4b7a810
-
Filesize
6KB
MD5a9c757be07c3a7873077911a4edf01e8
SHA111dc7fb5f7832d841e04e681a68667cc7c56536a
SHA25632cd80cb1e5d6cc65f3d9d572fa3f2e47d7ecbd93979d98f3e80ac3c43724169
SHA5128c379bcc1752f55f9cf06c458128ed93ecc83f1eb2ab86a049d9a71faaf06567829442283a0dca7d54603232e6dd12fac82504e972ea1359a31c6721d3d87cc2
-
Filesize
87KB
MD507fc58a362eadd048fc39e76ea2e41e1
SHA1ab7d8551e815438aac445fc60f333d37876c8a7d
SHA256df3bc77354e11eba4d9dfa532344b42276012f0023541bbb31670e728cde68c6
SHA512e39dd07cc1a3c96134e2bfcf2d33883133b57d186fa4dab2c376e5bba651f5005744c527c90def13769e218831ef9e4909f0788d17cf59fca49c34ae2cdb4bc4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd