Analysis
-
max time kernel
42s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2023 12:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sites.google.com/view/businessmessage/home
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
300 seconds
General
-
Target
https://sites.google.com/view/businessmessage/home
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133340707249437780" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3804 chrome.exe 3804 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe Token: SeShutdownPrivilege 3804 chrome.exe Token: SeCreatePagefilePrivilege 3804 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3804 wrote to memory of 3272 3804 chrome.exe 83 PID 3804 wrote to memory of 3272 3804 chrome.exe 83 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 3916 3804 chrome.exe 86 PID 3804 wrote to memory of 4704 3804 chrome.exe 87 PID 3804 wrote to memory of 4704 3804 chrome.exe 87 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88 PID 3804 wrote to memory of 4588 3804 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/businessmessage/home1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc42c9758,0x7ffcc42c9768,0x7ffcc42c97782⤵PID:3272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:22⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:82⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:82⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:12⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:12⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4664 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:12⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4876 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:12⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:82⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 --field-trial-handle=1884,i,18187446735798544036,1054817566473099749,131072 /prefetch:82⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5abc855dfdef77cbff385801f11cdf203
SHA1395661e216a4d426069e2d471321f8de29945cd0
SHA2563ec13979bf10bcfb7ded57f997e346aca97a76728d412894a104b3c171af24fd
SHA5122666b030000915a579d10e74319ac620d748b43cb72d6a910a029497b68fdf87bdc52d4e678a7042f0da2c08f122aabad08db1222023ed406bc41c14c851c128
-
Filesize
539B
MD55b1bc8412dc11f3e5e050157cdd3fb1d
SHA1a11f09655896083f507ef98aeb9a4247f79b7829
SHA256bd5e662875d4cb08c7b920b9d7535a9b666eb3cce58f0543f8eaa84da7a16da2
SHA51245d5c966a491b297952e6625916d0ba7ac1e67a5f3dc9ce755f6d31c7029c2cb98400a4c7a7f2eb7b09654d1b80a4d2a567a9f2e289cea78b77bd9aca4bbefd3
-
Filesize
5KB
MD58bed761e1ac2d4da60fb6741ba4b9cf8
SHA1f460a9e1f91bc0d8df9f032ad7b452fcca2f3dc5
SHA25697b6d7a3e8ff1a4d1ac75e532aabd5afcc0972ca2bfff2cabf6f6513bbcf58d8
SHA512be550505b01ca483a5df58d1c6d6bdfec0afbdfb691e87d59c1cb4565795f72c625438f38ffd7c68dc0d3800a172c4148d6e4ce5c8e5511c955b25d966f1cc40
-
Filesize
87KB
MD57ba7975b903b6e9f53d0c9e82c2475c6
SHA1dbfc116ea4fc1e0046df24ccc61bb4d3315ae0ed
SHA2562e6e36a561234846167b201df76b94e2b48a39e198857323008bc8083cf2d8f6
SHA5128d3806e3845e5c20fa9eec868add45ced16e62e66459ed807740ae880e25ef906cb16d6225a8a54d5ac682087a39488e86f4c9b9035db290d541168dd1f12077
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd