Analysis
-
max time kernel
33s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2023 18:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.artof4.com
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://www.artof4.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133340905335498141" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3220 wrote to memory of 1864 3220 chrome.exe 67 PID 3220 wrote to memory of 1864 3220 chrome.exe 67 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 1668 3220 chrome.exe 88 PID 3220 wrote to memory of 3668 3220 chrome.exe 89 PID 3220 wrote to memory of 3668 3220 chrome.exe 89 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90 PID 3220 wrote to memory of 4544 3220 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.artof4.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ff0d9758,0x7ff8ff0d9768,0x7ff8ff0d97782⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1816,i,3137781357406362295,970720867878651529,131072 /prefetch:22⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1816,i,3137781357406362295,970720867878651529,131072 /prefetch:82⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1816,i,3137781357406362295,970720867878651529,131072 /prefetch:82⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1816,i,3137781357406362295,970720867878651529,131072 /prefetch:12⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1816,i,3137781357406362295,970720867878651529,131072 /prefetch:12⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1816,i,3137781357406362295,970720867878651529,131072 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1816,i,3137781357406362295,970720867878651529,131072 /prefetch:82⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1712
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
705B
MD551fe72f02d39468af95f60075e0dcd4c
SHA1592253ce61c285d4096cd7b2a8a175b2574aa0a8
SHA25649571458891a1668b52271eab5a9a2fcf20ffcca98ae8edfca451b715aad3455
SHA51266bc655047a984b923885303054ba11d5be808f2d5b2b16ce71f5f79efce8bcd84994e6784f0274e9d226301f49e4f95b66dae19c972e81cae840e6dda8d184b
-
Filesize
6KB
MD5c65188f957d88743f6b5622ebed6f338
SHA1661ba0ce8a15999927ee54a247b65f1a750c8c9a
SHA25635791f83ef09f3cff2897c6817d3cb58875f64355f0a085c2e071e8e222adae4
SHA5126de22010344647958ce6c09332c6fac719a4aaaef5c7cf6909b8161f8b34d87a7b50d06383876a0c3d154a266900abbd1c1a346ac58be79b4246b2ed2e72b718
-
Filesize
87KB
MD566c13e37e2fa029729c37f257c5c314d
SHA17587fbdb9e567313baf08e11dcb30ec58060ce7c
SHA25692e92f3a8b1fb72e058e6168afd5ccb3359d19268932f81cefd2fa1499436e01
SHA5121a69c3216b94ae44b2f2be7979969c3524f3add3b5b922ab81c48447ce3aee6b2ddf49da522e0124bbf597d255634623335130ddac9dfaa4ff2f5fd222cb223b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd